Series comparison

-[Qemu-devel] [PULL 0/4] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-A surprisingly short target-arm queue, but no point in holding
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
 onto these waiting for more code to arrive :-)
-thanks
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
 -- PMM
-The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-are available in the git repository at:
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
 for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:
   target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: ignore writes to CONTROL.SPSEL from Thread mode
+ * Fix coverity nit in int_to_float code
- * KVM: Enable in-kernel timers with user space gic
+ * Don't set Invalid for float-to-int(MAXINT)
- * aspeed: Register all watchdogs
+ * Fix fp_status_f16 tininess before rounding
- * hw/misc: Add Exynos4210 Pseudo Random Number Generator
+ * Add various missing insns from the v8.2-FP16 extension
  * Fix sqrt_f16 exception raising
  * sdcard: Correct CRC16 offset in sd_function_switch()
  * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Alexander Graf (1):
+Alex Bennée (5):
-      ARM: KVM: Enable in-kernel timers with user space gic
+      fpu/softfloat: int_to_float ensure r fully initialised
       target/arm: Implement FCMP for fp16
       target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Joel Stanley (1):
+Peter Maydell (3):
-      aspeed: Register all watchdogs
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
       target/arm: Fix fp_status_f16 tininess before rounding
       tcg: Optionally log FPU state in TCG -d cpu logging
-Krzysztof Kozlowski (1):
+Philippe Mathieu-Daudé (1):
-      hw/misc: Add Exynos4210 Pseudo Random Number Generator
+      sdcard: Correct CRC16 offset in sd_function_switch()
-Peter Maydell (1):
+Richard Henderson (7):
-      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+      target/arm: Implement FMOV (general) for fp16
       target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
       target/arm: Implement FCVT (scalar, integer) for fp16
       target/arm: Implement FCVT (scalar, fixed-point) for fp16
       target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
- hw/misc/Makefile.objs       |   2 +-
+ include/qemu/log.h         |   1 +
- include/hw/arm/aspeed_soc.h |   4 +-
+ target/arm/helper-a64.h    |   2 +
- include/sysemu/kvm.h        |  11 ++
+ target/arm/helper.h        |   6 +
- target/arm/cpu.h            |   3 +
+ accel/tcg/cpu-exec.c       |   9 +-
- accel/kvm/kvm-all.c         |   5 +
+ fpu/softfloat.c            |   6 +-
- accel/stubs/kvm-stub.c      |   5 +
+ hw/sd/sd.c                 |   2 +-
- hw/arm/aspeed_soc.c         |  25 ++--
+ target/arm/cpu.c           |   2 +
- hw/arm/exynos4210.c         |   4 +
+ target/arm/helper-a64.c    |  10 ++
- hw/intc/arm_gic.c           |   7 ++
+ target/arm/helper.c        |  38 +++-
- hw/misc/exynos4210_rng.c    | 277 ++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
- target/arm/helper.c         |  13 ++-
+ util/log.c                 |   2 +
- target/arm/kvm.c            |  51 ++++++++
+files changed, 428 insertions(+), 71 deletions(-)
 files changed, 394 insertions(+), 13 deletions(-)
  create mode 100644 hw/misc/exynos4210_rng.c

-New patch
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+From: Alex Bennée <alex.bennee@linaro.org>
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
+later on so we might as well mirror that.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ fpu/softfloat.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+ static FloatParts int_to_float(int64_t a, float_status *status)
+ {
+-    FloatParts r;
++    FloatParts r = {};
+     if (a == 0) {
+         r.cls = float_class_zero;
+         r.sign = false;
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+In float-to-integer conversion, if the floating point input
+converts exactly to the largest or smallest integer that
+fits in to the result type, this is not an overflow.
+In this situation we were producing the correct result value,
+but were incorrectly setting the Invalid flag.
+For example for Arm A64, "FCVTAS w0, d0" on an input of
+x41dfffffffc00000 should produce 0x7fffffff and set no flags.
+Fix the boundary case to take the right half of the if()
+statements.
+This fixes a regression from 2.11 introduced by the softfloat
+refactoring.
+Cc: qemu-stable@nongnu.org
+Fixes: ab52f973a50
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+---
+ fpu/softfloat.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+             r = UINT64_MAX;
+         }
+         if (p.sign) {
+-            if (r < -(uint64_t) min) {
++            if (r <= -(uint64_t) min) {
+                 return -r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
+                 return min;
+             }
+         } else {
+-            if (r < max) {
++            if (r <= max) {
+                 return r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+In commit d81ce0ef2c4f105 we added an extra float_status field
+fp_status_fp16 for Arm, but forgot to initialize it correctly
+by setting it to float_tininess_before_rounding. This currently
+will only cause problems for the new V8_FP16 feature, since the
+float-to-float conversion code doesn't use it yet. The effect
+would be that we failed to set the Underflow IEEE exception flag
+in all the cases where we should.
+Add the missing initialization.
+Fixes: d81ce0ef2c4f105
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
+---
+ target/arm/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+                               &env->vfp.fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding,
+                               &env->vfp.standard_fp_status);
++    set_float_detect_tininess(float_tininess_before_rounding,
++                              &env->vfp.fp_status_f16);
+ #ifndef CONFIG_USER_ONLY
+     if (kvm_enabled()) {
+         kvm_arm_reset_vcpu(cpu);
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+From: Richard Henderson <richard.henderson@linaro.org>
+Adding the fp16 moves to/from general registers.
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
+file changed, 21 insertions(+)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+             clear_vec_high(s, true, rd);
+             break;
++        case 3:
++            /* 16 bit */
++            tmp = tcg_temp_new_i64();
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
++            write_fp_dreg(s, rd, tmp);
++            tcg_temp_free_i64(tmp);
++            break;
++        default:
++            g_assert_not_reached();
+         }
+     } else {
+         TCGv_i64 tcg_rd = cpu_reg(s, rd);
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+             /* 64 bits from top half */
+             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
+             break;
++        case 3:
++            /* 16 bit */
++            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
++            break;
++        default:
++            g_assert_not_reached();
+         }
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+         case 0xa: /* 64 bit */
+         case 0xd: /* 64 bit to top half of quad */
+             break;
++        case 0x6: /* 16-bit float, 32-bit int */
++        case 0xe: /* 16-bit float, 64-bit int */
++            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++                break;
++            }
++            /* fallthru */
+         default:
+             /* all other sf/type/rmode combinations are invalid */
+             unallocated_encoding(s);
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+From: Richard Henderson <richard.henderson@linaro.org>
+No sense in emitting code after the exception.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+         default:
+             /* all other sf/type/rmode combinations are invalid */
+             unallocated_encoding(s);
+-            break;
++            return;
+         }
+         if (!fp_access_check(s)) {
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+From: Richard Henderson <richard.henderson@linaro.org>
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.h        |  6 +++
  target/arm/helper.c        | 38 ++++++++++++++-
  target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 files changed, 122 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
 +DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
  DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
 +DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
 +DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
  DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
  #undef VFP_CONV_FIX_A64
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
 .17.0

-New patch
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+From: Richard Henderson <richard.henderson@linaro.org>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 17 +++++++++++++++--
+file changed, 15 insertions(+), 2 deletions(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+     bool sf = extract32(insn, 31, 1);
+     bool itof;
+-    if (sbit || (type > 1)
+-        || (!sf && scale < 32)) {
++    if (sbit || (!sf && scale < 32)) {
++        unallocated_encoding(s);
++        return;
++    }
++
++    switch (type) {
++    case 0: /* float32 */
++    case 1: /* float64 */
++        break;
++    case 3: /* float16 */
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++            break;
++        }
++        /* fallthru */
++    default:
+         unallocated_encoding(s);
+         return;
+     }
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+From: Richard Henderson <richard.henderson@linaro.org>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 30 ++++++++++++++----------------
+file changed, 14 insertions(+), 16 deletions(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+     return v;
+ }
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
++{
++    TCGv_i32 v = tcg_temp_new_i32();
++
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
++    return v;
++}
++
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
+  * If SVE is not enabled, then there are only 128 bits in the vector.
+  */
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+ {
+     TCGv_ptr fpst = NULL;
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
++    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+     TCGv_i32 tcg_res = tcg_temp_new_i32();
+-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
+-
+     switch (opcode) {
+     case 0x0: /* FMOV */
+         tcg_gen_mov_i32(tcg_res, tcg_op);
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
+         tcg_temp_free_i64(tcg_op2);
+         tcg_temp_free_i64(tcg_res);
+     } else {
+-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
+-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
++        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
++        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
+         TCGv_i64 tcg_res = tcg_temp_new_i64();
+-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
+-
+         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
+         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
+     fpst = get_fpstatus_ptr(true);
+-    tcg_op1 = tcg_temp_new_i32();
+-    tcg_op2 = tcg_temp_new_i32();
++    tcg_op1 = read_fp_hreg(s, rn);
++    tcg_op2 = read_fp_hreg(s, rm);
+     tcg_res = tcg_temp_new_i32();
+-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
+-
+     switch (fpopcode) {
+     case 0x03: /* FMULX */
+         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
+     }
+     if (is_scalar) {
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
+-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
+-
+         switch (fpop) {
+         case 0x1a: /* FCVTNS */
+         case 0x1b: /* FCVTMS */
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+From: Richard Henderson <richard.henderson@linaro.org>
+We missed all of the scalar fp16 binary operations.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
+file changed, 65 insertions(+)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+     tcg_temp_free_i64(tcg_res);
+ }
++/* Floating-point data-processing (2 source) - half precision */
++static void handle_fp_2src_half(DisasContext *s, int opcode,
++                                int rd, int rn, int rm)
++{
++    TCGv_i32 tcg_op1;
++    TCGv_i32 tcg_op2;
++    TCGv_i32 tcg_res;
++    TCGv_ptr fpst;
++
++    tcg_res = tcg_temp_new_i32();
++    fpst = get_fpstatus_ptr(true);
++    tcg_op1 = read_fp_hreg(s, rn);
++    tcg_op2 = read_fp_hreg(s, rm);
++
++    switch (opcode) {
++    case 0x0: /* FMUL */
++        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x1: /* FDIV */
++        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x2: /* FADD */
++        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x3: /* FSUB */
++        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x4: /* FMAX */
++        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x5: /* FMIN */
++        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x6: /* FMAXNM */
++        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x7: /* FMINNM */
++        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
++        break;
++    case 0x8: /* FNMUL */
++        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
++        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
++        break;
++    default:
++        g_assert_not_reached();
++    }
++
++    write_fp_sreg(s, rd, tcg_res);
++
++    tcg_temp_free_ptr(fpst);
++    tcg_temp_free_i32(tcg_op1);
++    tcg_temp_free_i32(tcg_op2);
++    tcg_temp_free_i32(tcg_res);
++}
++
+ /* Floating point data-processing (2 source)
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
+         }
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
+         break;
++    case 3:
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++            unallocated_encoding(s);
++            return;
++        }
++        if (!fp_access_check(s)) {
++            return;
++        }
++        handle_fp_2src_half(s, opcode, rd, rn, rm);
++        break;
+     default:
+         unallocated_encoding(s);
+     }
+--
+.17.0

-[Qemu-devel] [PULL 2/4] aspeed: Register all watchdogs
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-From: Joel Stanley <joel@jms.id.au>
+From: Richard Henderson <richard.henderson@linaro.org>
-The ast2400 contains two and the ast2500 contains three watchdogs.
+We missed all of the scalar fp16 fma operations.
 Add this information to the AspeedSoCInfo and realise the correct number
 of watchdogs for that each SoC type.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  4 +++-
+ target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
- hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
+file changed, 48 insertions(+)
 files changed, 20 insertions(+), 9 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
- #include "hw/net/ftgmac100.h"
+     tcg_temp_free_i64(tcg_res);
+ }
- #define ASPEED_SPIS_NUM  2
-+#define ASPEED_WDTS_NUM  3
++/* Floating-point data-processing (3 source) - half precision */
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
- typedef struct AspeedSoCState {
++                                int rd, int rn, int rm, int ra)
-     /*< private >*/
++{
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
++    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
-     AspeedSMCState fmc;
++    TCGv_i32 tcg_res = tcg_temp_new_i32();
-     AspeedSMCState spi[ASPEED_SPIS_NUM];
++    TCGv_ptr fpst = get_fpstatus_ptr(true);
-     AspeedSDMCState sdmc;
++
--    AspeedWDTState wdt;
++    tcg_op1 = read_fp_hreg(s, rn);
-+    AspeedWDTState wdt[ASPEED_WDTS_NUM];
++    tcg_op2 = read_fp_hreg(s, rm);
-     FTGMAC100State ftgmac100;
++    tcg_op3 = read_fp_hreg(s, ra);
- } AspeedSoCState;
++
++    /* These are fused multiply-add, and must be done as one
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
++     * floating point operation with no rounding between the
-     const hwaddr *spi_bases;
++     * multiplication and addition steps.
-     const char *fmc_typename;
++     * NB that doing the negations here as separate steps is
-     const char **spi_typename;
++     * correct : an input NaN should come out with its sign bit
-+    int wdts_num;
++     * flipped if it is a negated-input.
- } AspeedSoCInfo;
++     */
++    if (o1 == true) {
- typedef struct AspeedSoCClass {
++        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2400-a1",
          .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2400",
          .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2400_spi_bases,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .wdts_num     = 2,
      }, {
          .name         = "ast2500-a1",
          .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spi_bases    = aspeed_soc_ast2500_spi_bases,
          .fmc_typename = "aspeed.smc.ast2500-fmc",
          .spi_typename = aspeed_soc_ast2500_typenames,
 +        .wdts_num     = 3,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                                "ram-size", &error_abort);
 -    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
 -    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
 -    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
 +    for (i = 0; i < sc->info->wdts_num; i++) {
 +        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
 +        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
 +        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
 +    }
++
-     object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
++    if (o0 != o1) {
-     object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
++        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
++    }
-     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
++
++    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
-     /* Watch dog */
++
--    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
++    write_fp_sreg(s, rd, tcg_res);
--    if (err) {
++
--        error_propagate(errp, err);
++    tcg_temp_free_ptr(fpst);
--        return;
++    tcg_temp_free_i32(tcg_op1);
-+    for (i = 0; i < sc->info->wdts_num; i++) {
++    tcg_temp_free_i32(tcg_op2);
-+        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
++    tcg_temp_free_i32(tcg_op3);
-+        if (err) {
++    tcg_temp_free_i32(tcg_res);
-+            error_propagate(errp, err);
++}
 +
  /* Floating point data-processing (3 source)
   *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
   * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
          }
          handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
-+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
++        if (!fp_access_check(s)) {
-+                        ASPEED_SOC_WDT_BASE + i * 0x20);
++            return;
 +        }
 +        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
          unallocated_encoding(s);
      }
--    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
-     /* Net */
-     qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 3/4] ARM: KVM: Enable in-kernel timers with user space gic
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
-From: Alexander Graf <agraf@suse.de>
+From: Alex Bennée <alex.bennee@linaro.org>
-When running with KVM enabled, you can choose between emulating the
+These where missed out from the rest of the half-precision work.
-gic in kernel or user space. If the kernel supports in-kernel virtualization
-of the interrupt controller, it will default to that. If not, if will
+Cc: qemu-stable@nongnu.org
-default to user space emulation.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Unfortunately when running in user mode gic emulation, we miss out on
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-interrupt events which are only available from kernel space, such as the timer.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-This patch leverages the new kernel/user space pending line synchronization for
+Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
-timer events. It does not handle PMU events yet.
+[rth: Diagnose lack of FP16 before fp_access_check]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Alexander Graf <agraf@suse.de>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/sysemu/kvm.h   | 11 +++++++++++
+ target/arm/helper-a64.h    |  2 +
- target/arm/cpu.h       |  3 +++
+ target/arm/helper-a64.c    | 10 +++++
- accel/kvm/kvm-all.c    |  5 +++++
+ target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
- accel/stubs/kvm-stub.c |  5 +++++
+files changed, 83 insertions(+), 17 deletions(-)
- hw/intc/arm_gic.c      |  7 +++++++
- target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
+diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 files changed, 82 insertions(+)
 diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/kvm.h
+--- a/target/arm/helper-a64.h
-+++ b/include/sysemu/kvm.h
++++ b/target/arm/helper-a64.h
-@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
+@@ -XXX,XX +XXX,XX @@
- int kvm_cpu_exec(CPUState *cpu);
+ DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
- int kvm_destroy_vcpu(CPUState *cpu);
+ DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
-+/**
++DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
-+ * kvm_arm_supports_user_irq
++DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
-+ *
+ DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
-+ * Not all KVM implementations support notifications for kernel generated
+ DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
-+ * interrupt events to user space. This function indicates whether the current
+ DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
-+ * KVM implementation does support them.
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 + *
 + * Returns: true if KVM supports using kernel generated IRQs from user space
 + */
 +bool kvm_arm_supports_user_irq(void);
 +
  #ifdef NEED_CPU_H
  #include "cpu.h"
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper-a64.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
-     void *el_change_hook_opaque;
+     return flags;
+ }
-     int32_t node_id; /* NUMA node this CPU belongs to */
-+
++uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
-+    /* Used to synchronize KVM and QEMU in-kernel device levels */
++{
-+    uint8_t device_irq_level;
++    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
- };
++}
++
- static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
++uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
-diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
++{
 +    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
      return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/kvm/kvm-all.c
+--- a/target/arm/translate-a64.c
-+++ b/accel/kvm/kvm-all.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
+@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
-     return kvm_state->intx_set_mask;
+     }
  }
-+bool kvm_arm_supports_user_irq(void)
+-static void handle_fp_compare(DisasContext *s, bool is_double,
-+{
++static void handle_fp_compare(DisasContext *s, int size,
-+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
+                               unsigned int rn, unsigned int rm,
-+}
+                               bool cmp_with_zero, bool signal_all_nans)
 +
  #ifdef KVM_CAP_SET_GUEST_DEBUG
  struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                   target_ulong pc)
 diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/stubs/kvm-stub.c
 +++ b/accel/stubs/kvm-stub.c
@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
  {
-     abort();
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
- }
+-    TCGv_ptr fpst = get_fpstatus_ptr(false);
-+
++    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
-+bool kvm_arm_supports_user_irq(void)
-+{
+-    if (is_double) {
-+    return false;
++    if (size == MO_64) {
-+}
+         TCGv_i64 tcg_vn, tcg_vm;
- #endif
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
+         tcg_vn = read_fp_dreg(s, rn);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
---- a/hw/intc/arm_gic.c
+         tcg_temp_free_i64(tcg_vn);
-+++ b/hw/intc/arm_gic.c
+         tcg_temp_free_i64(tcg_vm);
-@@ -XXX,XX +XXX,XX @@
+     } else {
- #include "qom/cpu.h"
+-        TCGv_i32 tcg_vn, tcg_vm;
- #include "qemu/log.h"
++        TCGv_i32 tcg_vn = tcg_temp_new_i32();
- #include "trace.h"
++        TCGv_i32 tcg_vm = tcg_temp_new_i32();
-+#include "sysemu/kvm.h"
+-        tcg_vn = read_fp_sreg(s, rn);
- /* #define DEBUG_GIC */
++        read_vec_element_i32(s, tcg_vn, rn, 0, size);
+         if (cmp_with_zero) {
-@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
+-            tcg_vm = tcg_const_i32(0);
-         return;
++            tcg_gen_movi_i32(tcg_vm, 0);
-     }
+         } else {
+-            tcg_vm = read_fp_sreg(s, rm);
-+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
++            read_vec_element_i32(s, tcg_vm, rm, 0, size);
-+        error_setg(errp, "KVM with user space irqchip only works when the "
+         }
-+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
+-        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
++    switch (type) {
-     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
++    case 0:
++        size = MO_32;
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
++        break;
-index XXXXXXX..XXXXXXX 100644
++    case 1:
---- a/target/arm/kvm.c
++        size = MO_64;
-+++ b/target/arm/kvm.c
++        break;
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
++    case 3:
-      */
++        size = MO_16;
-     kvm_async_interrupts_allowed = true;
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++            break;
-+    /*
++        }
-+     * PSCI wakes up secondary cores, so we always need to
++        /* fallthru */
-+     * have vCPUs waiting in kernel space
++    default:
-+     */
+         unallocated_encoding(s);
-+    kvm_halt_in_kernel_allowed = true;
+         return;
-+
+     }
-     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
+         return;
-     type_register_static(&host_arm_cpu_type_info);
+     }
-@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
+-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
- MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
++    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
- {
+ }
-+    ARMCPU *cpu;
-+    uint32_t switched_level;
+ /* Floating point conditional compare
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-+    if (kvm_irqchip_in_kernel()) {
+     unsigned int mos, type, rm, cond, rn, op, nzcv;
-+        /*
+     TCGv_i64 tcg_flags;
-+         * We only need to sync timer states with user-space interrupt
+     TCGLabel *label_continue = NULL;
-+         * controllers, so return early and save cycles if we don't.
++    int size;
-+         */
-+        return MEMTXATTRS_UNSPECIFIED;
+     mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    cpu = ARM_CPU(cs);
++    switch (type) {
-+
++    case 0:
-+    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
++        size = MO_32;
-+    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
++        break;
-+        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
++    case 1:
-+
++        size = MO_64;
-+        qemu_mutex_lock_iothread();
++        break;
-+
++    case 3:
-+        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
++        size = MO_16;
-+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+                         !!(run->s.regs.device_irq_level &
++            break;
 +                            KVM_ARM_DEV_EL1_VTIMER));
 +            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
 +        }
-+
++        /* fallthru */
-+        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
++    default:
-+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
+         unallocated_encoding(s);
-+                         !!(run->s.regs.device_irq_level &
+         return;
-+                            KVM_ARM_DEV_EL1_PTIMER));
+     }
-+            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-+        }
+         gen_set_label(label_match);
-+
+     }
-+        /* XXX PMU IRQ is missing */
-+
+-    handle_fp_compare(s, type, rn, rm, false, op);
-+        if (switched_level) {
++    handle_fp_compare(s, size, rn, rm, false, op);
-+            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
-+                          __func__, switched_level);
+     if (cond < 0x0e) {
-+        }
+         gen_set_label(label_continue);
 +
 +        /* We also mark unknown levels as processed to not waste cycles */
 +        cpu->device_irq_level = run->s.regs.device_irq_level;
 +        qemu_mutex_unlock_iothread();
 +    }
 +
      return MEMTXATTRS_UNSPECIFIED;
  }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 1/4] hw/misc: Add Exynos4210 Pseudo Random Number Generator
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-From: Krzysztof Kozlowski <krzk@kernel.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-Add emulation for Exynos4210 Pseudo Random Number Generator which could
+These were missed out from the rest of the half-precision work.
 work on fixed seeds or with seeds provided by True Random Number
 Generator block inside the SoC.
-Implement only the fixed seeds part of it in polling mode (no
+Cc: qemu-stable@nongnu.org
 interrupts).
 Emulation tested with two independent Linux kernel exynos-rng drivers:
 . New kcapi-rng interface (targeting Linux v4.12),
 . Old hwrng inteface
    # echo "exynos" > /sys/class/misc/hw_random/rng_current
    # dd if=/dev/hwrng of=/dev/null bs=1 count=16
 Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
 Message-id: 20170425180609.11004-1-krzk@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: wrapped a few overlong lines; more efficient implementation
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
- of exynos4210_rng_seed_ready()]
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
 [rth: Fix erroneous check vs type]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/misc/Makefile.objs    |   2 +-
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
- hw/arm/exynos4210.c      |   4 +
+file changed, 25 insertions(+), 6 deletions(-)
  hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
 files changed, 282 insertions(+), 1 deletion(-)
  create mode 100644 hw/misc/exynos4210_rng.c
-diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/misc/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
- obj-$(CONFIG_REALVIEW) += arm_sysctl.o
+     unsigned int mos, type, rm, cond, rn, rd;
- obj-$(CONFIG_NSERIES) += cbus.o
+     TCGv_i64 t_true, t_false, t_zero;
- obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
+     DisasCompare64 c;
--obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
++    TCGMemOp sz;
-+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
- obj-$(CONFIG_IMX) += imx_ccm.o
+     mos = extract32(insn, 29, 3);
- obj-$(CONFIG_IMX) += imx31_ccm.o
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
- obj-$(CONFIG_IMX) += imx25_ccm.o
++    type = extract32(insn, 22, 2);
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
+     rm = extract32(insn, 16, 5);
-index XXXXXXX..XXXXXXX 100644
+     cond = extract32(insn, 12, 4);
---- a/hw/arm/exynos4210.c
+     rn = extract32(insn, 5, 5);
-+++ b/hw/arm/exynos4210.c
+     rd = extract32(insn, 0, 5);
-@@ -XXX,XX +XXX,XX @@
- /* Clock controller SFR base address */
+-    if (mos || type > 1) {
- #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
++    if (mos) {
++        unallocated_encoding(s);
-+/* PRNG/HASH SFR base address */
++        return;
 +#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
 +
  /* Display controllers (FIMD) */
  #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
      sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
      sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
 +    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
      /* PWM */
      sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
 diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/exynos4210_rng.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  Exynos4210 Pseudo Random Nubmer Generator Emulation
 + *
 + *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
 + *
 + *  This program is free software; you can redistribute it and/or modify it
 + *  under the terms of the GNU General Public License as published by the
 + *  Free Software Foundation; either version 2 of the License, or
 + *  (at your option) any later version.
 + *
 + *  This program is distributed in the hope that it will be useful, but WITHOUT
 + *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + *  for more details.
 + *
 + *  You should have received a copy of the GNU General Public License along
 + *  with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "crypto/random.h"
 +#include "hw/sysbus.h"
 +#include "qemu/log.h"
 +
 +#define DEBUG_EXYNOS_RNG 0
 +
 +#define DPRINTF(fmt, ...) \
 +    do { \
 +        if (DEBUG_EXYNOS_RNG) { \
 +            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
 +        } \
 +    } while (0)
 +
 +#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
 +#define EXYNOS4210_RNG(obj) \
 +    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
 +
 +/*
 + * Exynos4220, PRNG, only polling mode is supported.
 + */
 +
 +/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
 +#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
 +#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
 +/* RNG_STATUS register bitfields, reset value: 0x1 */
 +#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
 +#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
 +#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
 +#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
 +#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
 +#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
 +#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
 +#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
 +                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
 +                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
 +
 +#define EXYNOS4210_RNG_CONTROL_1                  0x0
 +#define EXYNOS4210_RNG_STATUS                    0x10
 +#define EXYNOS4210_RNG_SEED_IN                  0x140
 +#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
 +#define EXYNOS4210_RNG_PRNG                     0x160
 +#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
 +
 +#define EXYNOS4210_RNG_PRNG_NUM                 5
 +
 +#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
 +
 +typedef struct Exynos4210RngState {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +
 +    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
 +    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
 +    uint32_t seed_set;
 +
 +    /* Register values */
 +    uint32_t reg_control;
 +    uint32_t reg_status;
 +} Exynos4210RngState;
 +
 +static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
 +{
 +    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
 +
 +    /* Return true if all the seed-set bits are set. */
 +    return (s->seed_set & mask) == mask;
 +}
 +
 +static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
 +                                    uint64_t val)
 +{
 +    /*
 +     * We actually ignore the seed and always generate true random numbers.
 +     * Theoretically this should not match the device as Exynos has
 +     * a Pseudo Random Number Generator but testing shown that it always
 +     * generates random numbers regardless of the seed value.
 +     */
 +    s->seed_set |= BIT(i);
 +
 +    /* If all seeds were written, update the status to reflect it */
 +    if (exynos4210_rng_seed_ready(s)) {
 +        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
 +    } else {
 +        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
 +    }
 +}
 +
 +static void exynos4210_rng_run_engine(Exynos4210RngState *s)
 +{
 +    Error *err = NULL;
 +    int ret;
 +
 +    /* Seed set? */
 +    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
 +        goto out;
 +    }
 +
-+    /* PRNG engine chosen? */
++    switch (type) {
-+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
++    case 0:
-+        goto out;
++        sz = MO_32;
 +    }
 +
 +    /* PRNG engine started? */
 +    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
 +        goto out;
 +    }
 +
 +    /* Get randoms */
 +    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
 +                               sizeof(s->randr_value), &err);
 +    if (!ret) {
 +        /* Notify that PRNG is ready */
 +        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
 +    } else {
 +        error_report_err(err);
 +    }
 +
 +out:
 +    /* Always clear start engine bit */
 +    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
 +}
 +
 +static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
 +                                    unsigned size)
 +{
 +    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
 +    uint32_t val = 0;
 +
 +    assert(size == 4);
 +
 +    switch (offset) {
 +    case EXYNOS4210_RNG_CONTROL_1:
 +        val = s->reg_control;
 +        break;
-+
++    case 1:
-+    case EXYNOS4210_RNG_STATUS:
++        sz = MO_64;
 +        val = s->reg_status;
 +        break;
-+
++    case 3:
-+    case EXYNOS4210_RNG_PRNG_OFFSET(0):
++        sz = MO_16;
-+    case EXYNOS4210_RNG_PRNG_OFFSET(1):
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+    case EXYNOS4210_RNG_PRNG_OFFSET(2):
++            break;
-+    case EXYNOS4210_RNG_PRNG_OFFSET(3):
++        }
-+    case EXYNOS4210_RNG_PRNG_OFFSET(4):
++        /* fallthru */
 +        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
 +        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
 +                offset, val);
 +        break;
 +
 +    default:
-+        qemu_log_mask(LOG_GUEST_ERROR,
+         unallocated_encoding(s);
-+                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
+         return;
-+                      __func__, offset);
+     }
-+    }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+
+         return;
-+    return val;
+     }
-+}
-+
+-    /* Zero extend sreg inputs to 64 bits now.  */
-+static void exynos4210_rng_write(void *opaque, hwaddr offset,
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-+                                 uint64_t val, unsigned size)
+     t_true = tcg_temp_new_i64();
-+{
+     t_false = tcg_temp_new_i64();
-+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-+
+-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-+    assert(size == 4);
++    read_vec_element(s, t_true, rn, 0, sz);
-+
++    read_vec_element(s, t_false, rm, 0, sz);
-+    switch (offset) {
-+    case EXYNOS4210_RNG_CONTROL_1:
+     a64_test_cc(&c, cond);
-+        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
+     t_zero = tcg_const_i64(0);
-+        s->reg_control = val;
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+        exynos4210_rng_run_engine(s);
+     tcg_temp_free_i64(t_false);
-+        break;
+     a64_free_cc(&c);
-+
-+    case EXYNOS4210_RNG_STATUS:
+-    /* Note that sregs write back zeros to the high bits,
-+        /* For clearing status fields */
++    /* Note that sregs & hregs write back zeros to the high bits,
-+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        and we've already done the zero-extension.  */
-+        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
+     write_fp_dreg(s, rd, t_true);
-+        break;
+     tcg_temp_free_i64(t_true);
 +
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
 +    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
 +        exynos4210_rng_set_seed(s,
 +                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
 +                                val);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
 +                      __func__, offset);
 +    }
 +}
 +
 +static const MemoryRegionOps exynos4210_rng_ops = {
 +    .read = exynos4210_rng_read,
 +    .write = exynos4210_rng_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +};
 +
 +static void exynos4210_rng_reset(DeviceState *dev)
 +{
 +    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
 +
 +    s->reg_control = 0;
 +    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
 +    memset(s->randr_value, 0, sizeof(s->randr_value));
 +    s->seed_set = 0;
 +}
 +
 +static void exynos4210_rng_init(Object *obj)
 +{
 +    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
 +    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
 +                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
 +    sysbus_init_mmio(dev, &s->iomem);
 +}
 +
 +static const VMStateDescription exynos4210_rng_vmstate = {
 +    .name = TYPE_EXYNOS4210_RNG,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
 +                            EXYNOS4210_RNG_PRNG_NUM),
 +        VMSTATE_UINT32(seed_set, Exynos4210RngState),
 +        VMSTATE_UINT32(reg_status, Exynos4210RngState),
 +        VMSTATE_UINT32(reg_control, Exynos4210RngState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = exynos4210_rng_reset;
 +    dc->vmsd = &exynos4210_rng_vmstate;
 +}
 +
 +static const TypeInfo exynos4210_rng_info = {
 +    .name          = TYPE_EXYNOS4210_RNG,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210RngState),
 +    .instance_init = exynos4210_rng_init,
 +    .class_init    = exynos4210_rng_class_init,
 +};
 +
 +static void exynos4210_rng_register(void)
 +{
 +    type_register_static(&exynos4210_rng_info);
 +}
 +
 +type_init(exynos4210_rng_register)
 --
-.7.4
+.17.0

-New patch
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+From: Alex Bennée <alex.bennee@linaro.org>
+All the hard work is already done by vfp_expand_imm, we just need to
+make sure we pick up the correct size.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
+[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
+file changed, 17 insertions(+), 3 deletions(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+ {
+     int rd = extract32(insn, 0, 5);
+     int imm8 = extract32(insn, 13, 8);
+-    int is_double = extract32(insn, 22, 2);
++    int type = extract32(insn, 22, 2);
+     uint64_t imm;
+     TCGv_i64 tcg_res;
++    TCGMemOp sz;
+-    if (is_double > 1) {
++    switch (type) {
++    case 0:
++        sz = MO_32;
++        break;
++    case 1:
++        sz = MO_64;
++        break;
++    case 3:
++        sz = MO_16;
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++            break;
++        }
++        /* fallthru */
++    default:
+         unallocated_encoding(s);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+         return;
+     }
+-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
++    imm = vfp_expand_imm(sz, imm8);
+     tcg_res = tcg_const_i64(imm);
+     write_fp_dreg(s, rd, tcg_res);
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+From: Alex Bennée <alex.bennee@linaro.org>
+We are meant to explicitly pass fpst, not cpu_env.
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
+         break;
+     case 0x3: /* FSQRT */
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
++        fpst = get_fpstatus_ptr(true);
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
+         break;
+     case 0x8: /* FRINTN */
+     case 0x9: /* FRINTP */
+--
+.17.0

-New patch
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+  The block length is predefined to 512 bits
+and "4.10.2 SD Status":
+  The SD Status contains status bits that are related to the SD Memory Card
+  proprietary features and may be used for future application-specific usage.
+  The size of the SD Status is one data block of 512 bit. The content of this
+  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
+Thus the 16-bit CRC goes at offset 64.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20180509060104.4458-3-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/sd/sd.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/sd/sd.c
++++ b/hw/sd/sd.c
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+     }
+     memset(&sd->data[17], 0, 47);
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
+ }
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
+--
+.17.0

-[Qemu-devel] [PULL 4/4] target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-For v7M, writes to the CONTROL register are only permitted for
+Usually the logging of the CPU state produced by -d cpu is sufficient
-privileged code. However even if the code is privileged, the
+to diagnose problems, but sometimes you want to see the state of
-write must not affect the SPSEL bit in the CONTROL register
+the floating point registers as well. We don't want to enable that
-if the CPU is in Thread mode (as documented in the pseudocode
+by default as it adds a lot of extra data to the log; instead,
-for the MSR instruction). Implement this, instead of permitting
+allow it to be optionally enabled via -d fpu.
 SPSEL to be written in all cases.
 This was causing mbed applications not to run, because the
 RTX RTOS they use relies on this behaviour.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
+Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 13 ++++++++++---
+ include/qemu/log.h   | 1 +
-file changed, 10 insertions(+), 3 deletions(-)
+ accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/qemu/log.h
-+++ b/target/arm/helper.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
-         }
+ #define CPU_LOG_PAGE       (1 << 14)
-         break;
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-     case 20: /* CONTROL */
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
--        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
++#define CPU_LOG_TB_FPU     (1 << 17)
--        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
--                                  R_V7M_CONTROL_NPRIV_MASK);
+ /* Lock output for a series of related logs.  Since this is not needed
-+        /* Writing to the SPSEL bit only has an effect if we are in
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-+         * thread mode; other bits can be updated by any privileged code.
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-+         * switch_v7m_sp() deals with updating the SPSEL bit in
+index XXXXXXX..XXXXXXX 100644
-+         * env->v7m.control, so we only need update the others.
+--- a/accel/tcg/cpu-exec.c
-+         */
++++ b/accel/tcg/cpu-exec.c
-+        if (env->v7m.exception == 0) {
+@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
-+            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
          && qemu_log_in_addr_range(itb->pc)) {
          qemu_log_lock();
 +        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
-+        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
+ #if defined(TARGET_I386)
-+        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
+-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-         break;
+-#else
-     default:
+-        log_cpu_state(cpu, 0);
-         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
++        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.7.4
+.17.0

A surprisingly short target-arm queue, but no point in holding
onto these waiting for more code to arrive :-)

thanks
-- PMM

The following changes since commit 3d0bf8dfdfebd7f2ae41b6f220444b8047d6b1ee:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20170710a' into staging (2017-07-10 18:13:03 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170711

for you to fetch changes up to 792dac309c8660306557ba058b8b5a6a75ab3c1f:

target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode (2017-07-11 11:21:26 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: ignore writes to CONTROL.SPSEL from Thread mode
 * KVM: Enable in-kernel timers with user space gic
 * aspeed: Register all watchdogs
 * hw/misc: Add Exynos4210 Pseudo Random Number Generator

----------------------------------------------------------------
Alexander Graf (1):
      ARM: KVM: Enable in-kernel timers with user space gic

Joel Stanley (1):
      aspeed: Register all watchdogs

Krzysztof Kozlowski (1):
      hw/misc: Add Exynos4210 Pseudo Random Number Generator

Peter Maydell (1):
      target-arm: v7M: ignore writes to CONTROL.SPSEL from Thread mode

From: Krzysztof Kozlowski <krzk@kernel.org>

Add emulation for Exynos4210 Pseudo Random Number Generator which could
work on fixed seeds or with seeds provided by True Random Number
Generator block inside the SoC.

Implement only the fixed seeds part of it in polling mode (no
interrupts).

Emulation tested with two independent Linux kernel exynos-rng drivers:
1. New kcapi-rng interface (targeting Linux v4.12),
2. Old hwrng inteface
   # echo "exynos" > /sys/class/misc/hw_random/rng_current
   # dd if=/dev/hwrng of=/dev/null bs=1 count=16

Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Message-id: 20170425180609.11004-1-krzk@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: wrapped a few overlong lines; more efficient implementation
 of exynos4210_rng_seed_ready()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/Makefile.objs    |   2 +-
 hw/arm/exynos4210.c      |   4 +
 hw/misc/exynos4210_rng.c | 277 +++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 282 insertions(+), 1 deletion(-)
 create mode 100644 hw/misc/exynos4210_rng.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IVSHMEM) += ivshmem.o
 obj-$(CONFIG_REALVIEW) += arm_sysctl.o
 obj-$(CONFIG_NSERIES) += cbus.o
 obj-$(CONFIG_ECCMEMCTL) += eccmemctl.o
-obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o
+obj-$(CONFIG_EXYNOS4) += exynos4210_pmu.o exynos4210_clk.o exynos4210_rng.o
 obj-$(CONFIG_IMX) += imx_ccm.o
 obj-$(CONFIG_IMX) += imx31_ccm.o
 obj-$(CONFIG_IMX) += imx25_ccm.o
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* Clock controller SFR base address */
 #define EXYNOS4210_CLK_BASE_ADDR            0x10030000
 
+/* PRNG/HASH SFR base address */
+#define EXYNOS4210_RNG_BASE_ADDR            0x10830400
+
 /* Display controllers (FIMD) */
 #define EXYNOS4210_FIMD0_BASE_ADDR          0x11C00000
 
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple("exynos4210.pmu", EXYNOS4210_PMU_BASE_ADDR, NULL);
 
     sysbus_create_simple("exynos4210.clk", EXYNOS4210_CLK_BASE_ADDR, NULL);
+    sysbus_create_simple("exynos4210.rng", EXYNOS4210_RNG_BASE_ADDR, NULL);
 
     /* PWM */
     sysbus_create_varargs("exynos4210.pwm", EXYNOS4210_PWM_BASE_ADDR,
diff --git a/hw/misc/exynos4210_rng.c b/hw/misc/exynos4210_rng.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/exynos4210_rng.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  Exynos4210 Pseudo Random Nubmer Generator Emulation
+ *
+ *  Copyright (c) 2017 Krzysztof Kozlowski <krzk@kernel.org>
+ *
+ *  This program is free software; you can redistribute it and/or modify it
+ *  under the terms of the GNU General Public License as published by the
+ *  Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful, but WITHOUT
+ *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ *  for more details.
+ *
+ *  You should have received a copy of the GNU General Public License along
+ *  with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "crypto/random.h"
+#include "hw/sysbus.h"
+#include "qemu/log.h"
+
+#define DEBUG_EXYNOS_RNG 0
+
+#define DPRINTF(fmt, ...) \
+    do { \
+        if (DEBUG_EXYNOS_RNG) { \
+            printf("exynos4210_rng: " fmt, ## __VA_ARGS__); \
+        } \
+    } while (0)
+
+#define TYPE_EXYNOS4210_RNG             "exynos4210.rng"
+#define EXYNOS4210_RNG(obj) \
+    OBJECT_CHECK(Exynos4210RngState, (obj), TYPE_EXYNOS4210_RNG)
+
+/*
+ * Exynos4220, PRNG, only polling mode is supported.
+ */
+
+/* RNG_CONTROL_1 register bitfields, reset value: 0x0 */
+#define EXYNOS4210_RNG_CONTROL_1_PRNG           0x8
+#define EXYNOS4210_RNG_CONTROL_1_START_INIT     BIT(4)
+/* RNG_STATUS register bitfields, reset value: 0x1 */
+#define EXYNOS4210_RNG_STATUS_PRNG_ERROR        BIT(7)
+#define EXYNOS4210_RNG_STATUS_PRNG_DONE         BIT(5)
+#define EXYNOS4210_RNG_STATUS_MSG_DONE          BIT(4)
+#define EXYNOS4210_RNG_STATUS_PARTIAL_DONE      BIT(3)
+#define EXYNOS4210_RNG_STATUS_PRNG_BUSY         BIT(2)
+#define EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE BIT(1)
+#define EXYNOS4210_RNG_STATUS_BUFFER_READY      BIT(0)
+#define EXYNOS4210_RNG_STATUS_WRITE_MASK   (EXYNOS4210_RNG_STATUS_PRNG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_MSG_DONE \
+                                           | EXYNOS4210_RNG_STATUS_PARTIAL_DONE)
+
+#define EXYNOS4210_RNG_CONTROL_1                  0x0
+#define EXYNOS4210_RNG_STATUS                    0x10
+#define EXYNOS4210_RNG_SEED_IN                  0x140
+#define EXYNOS4210_RNG_SEED_IN_OFFSET(n)   (EXYNOS4210_RNG_SEED_IN + (n * 0x4))
+#define EXYNOS4210_RNG_PRNG                     0x160
+#define EXYNOS4210_RNG_PRNG_OFFSET(n)      (EXYNOS4210_RNG_PRNG + (n * 0x4))
+
+#define EXYNOS4210_RNG_PRNG_NUM                 5
+
+#define EXYNOS4210_RNG_REGS_MEM_SIZE            0x200
+
+typedef struct Exynos4210RngState {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+
+    int32_t randr_value[EXYNOS4210_RNG_PRNG_NUM];
+    /* bits from 0 to EXYNOS4210_RNG_PRNG_NUM if given seed register was set */
+    uint32_t seed_set;
+
+    /* Register values */
+    uint32_t reg_control;
+    uint32_t reg_status;
+} Exynos4210RngState;
+
+static bool exynos4210_rng_seed_ready(const Exynos4210RngState *s)
+{
+    uint32_t mask = MAKE_64BIT_MASK(0, EXYNOS4210_RNG_PRNG_NUM);
+
+    /* Return true if all the seed-set bits are set. */
+    return (s->seed_set & mask) == mask;
+}
+
+static void exynos4210_rng_set_seed(Exynos4210RngState *s, unsigned int i,
+                                    uint64_t val)
+{
+    /*
+     * We actually ignore the seed and always generate true random numbers.
+     * Theoretically this should not match the device as Exynos has
+     * a Pseudo Random Number Generator but testing shown that it always
+     * generates random numbers regardless of the seed value.
+     */
+    s->seed_set |= BIT(i);
+
+    /* If all seeds were written, update the status to reflect it */
+    if (exynos4210_rng_seed_ready(s)) {
+        s->reg_status |= EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    } else {
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE;
+    }
+}
+
+static void exynos4210_rng_run_engine(Exynos4210RngState *s)
+{
+    Error *err = NULL;
+    int ret;
+
+    /* Seed set? */
+    if ((s->reg_status & EXYNOS4210_RNG_STATUS_SEED_SETTING_DONE) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine chosen? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_PRNG) == 0) {
+        goto out;
+    }
+
+    /* PRNG engine started? */
+    if ((s->reg_control & EXYNOS4210_RNG_CONTROL_1_START_INIT) == 0) {
+        goto out;
+    }
+
+    /* Get randoms */
+    ret = qcrypto_random_bytes((uint8_t *)s->randr_value,
+                               sizeof(s->randr_value), &err);
+    if (!ret) {
+        /* Notify that PRNG is ready */
+        s->reg_status |= EXYNOS4210_RNG_STATUS_PRNG_DONE;
+    } else {
+        error_report_err(err);
+    }
+
+out:
+    /* Always clear start engine bit */
+    s->reg_control &= ~EXYNOS4210_RNG_CONTROL_1_START_INIT;
+}
+
+static uint64_t exynos4210_rng_read(void *opaque, hwaddr offset,
+                                    unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+    uint32_t val = 0;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        val = s->reg_control;
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        val = s->reg_status;
+        break;
+
+    case EXYNOS4210_RNG_PRNG_OFFSET(0):
+    case EXYNOS4210_RNG_PRNG_OFFSET(1):
+    case EXYNOS4210_RNG_PRNG_OFFSET(2):
+    case EXYNOS4210_RNG_PRNG_OFFSET(3):
+    case EXYNOS4210_RNG_PRNG_OFFSET(4):
+        val = s->randr_value[(offset - EXYNOS4210_RNG_PRNG_OFFSET(0)) / 4];
+        DPRINTF("returning random @0x%" HWADDR_PRIx ": 0x%" PRIx32 "\n",
+                offset, val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad read offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+
+    return val;
+}
+
+static void exynos4210_rng_write(void *opaque, hwaddr offset,
+                                 uint64_t val, unsigned size)
+{
+    Exynos4210RngState *s = (Exynos4210RngState *)opaque;
+
+    assert(size == 4);
+
+    switch (offset) {
+    case EXYNOS4210_RNG_CONTROL_1:
+        DPRINTF("RNG_CONTROL_1 = 0x%" PRIx64 "\n", val);
+        s->reg_control = val;
+        exynos4210_rng_run_engine(s);
+        break;
+
+    case EXYNOS4210_RNG_STATUS:
+        /* For clearing status fields */
+        s->reg_status &= ~EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        s->reg_status |= val & EXYNOS4210_RNG_STATUS_WRITE_MASK;
+        break;
+
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(0):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(1):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(2):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(3):
+    case EXYNOS4210_RNG_SEED_IN_OFFSET(4):
+        exynos4210_rng_set_seed(s,
+                                (offset - EXYNOS4210_RNG_SEED_IN_OFFSET(0)) / 4,
+                                val);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad write offset 0x%" HWADDR_PRIx "\n",
+                      __func__, offset);
+    }
+}
+
+static const MemoryRegionOps exynos4210_rng_ops = {
+    .read = exynos4210_rng_read,
+    .write = exynos4210_rng_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void exynos4210_rng_reset(DeviceState *dev)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(dev);
+
+    s->reg_control = 0;
+    s->reg_status = EXYNOS4210_RNG_STATUS_BUFFER_READY;
+    memset(s->randr_value, 0, sizeof(s->randr_value));
+    s->seed_set = 0;
+}
+
+static void exynos4210_rng_init(Object *obj)
+{
+    Exynos4210RngState *s = EXYNOS4210_RNG(obj);
+    SysBusDevice *dev = SYS_BUS_DEVICE(obj);
+
+    memory_region_init_io(&s->iomem, obj, &exynos4210_rng_ops, s,
+                          TYPE_EXYNOS4210_RNG, EXYNOS4210_RNG_REGS_MEM_SIZE);
+    sysbus_init_mmio(dev, &s->iomem);
+}
+
+static const VMStateDescription exynos4210_rng_vmstate = {
+    .name = TYPE_EXYNOS4210_RNG,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_INT32_ARRAY(randr_value, Exynos4210RngState,
+                            EXYNOS4210_RNG_PRNG_NUM),
+        VMSTATE_UINT32(seed_set, Exynos4210RngState),
+        VMSTATE_UINT32(reg_status, Exynos4210RngState),
+        VMSTATE_UINT32(reg_control, Exynos4210RngState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void exynos4210_rng_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = exynos4210_rng_reset;
+    dc->vmsd = &exynos4210_rng_vmstate;
+}
+
+static const TypeInfo exynos4210_rng_info = {
+    .name          = TYPE_EXYNOS4210_RNG,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210RngState),
+    .instance_init = exynos4210_rng_init,
+    .class_init    = exynos4210_rng_class_init,
+};
+
+static void exynos4210_rng_register(void)
+{
+    type_register_static(&exynos4210_rng_info);
+}
+
+type_init(exynos4210_rng_register)
-- 
2.7.4

From: Joel Stanley <joel@jms.id.au>

The ast2400 contains two and the ast2500 contains three watchdogs.
Add this information to the AspeedSoCInfo and realise the correct number
of watchdogs for that each SoC type.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Tested-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  4 +++-
 hw/arm/aspeed_soc.c         | 25 +++++++++++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/ftgmac100.h"
 
 #define ASPEED_SPIS_NUM  2
+#define ASPEED_WDTS_NUM  3
 
 typedef struct AspeedSoCState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSMCState fmc;
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     AspeedSDMCState sdmc;
-    AspeedWDTState wdt;
+    AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100;
 } AspeedSoCState;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     const hwaddr *spi_bases;
     const char *fmc_typename;
     const char **spi_typename;
+    int wdts_num;
 } AspeedSoCInfo;
 
 typedef struct AspeedSoCClass {
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400-a1",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2400",
         .cpu_model    = "arm926",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2400_spi_bases,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .wdts_num     = 2,
     }, {
         .name         = "ast2500-a1",
         .cpu_model    = "arm1176",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spi_bases    = aspeed_soc_ast2500_spi_bases,
         .fmc_typename = "aspeed.smc.ast2500-fmc",
         .spi_typename = aspeed_soc_ast2500_typenames,
+        .wdts_num     = 3,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_property_add_alias(obj, "ram-size", OBJECT(&s->sdmc),
                               "ram-size", &error_abort);
 
-    object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
-    object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
-    qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_initialize(&s->wdt[i], sizeof(s->wdt[i]), TYPE_ASPEED_WDT);
+        object_property_add_child(obj, "wdt[*]", OBJECT(&s->wdt[i]), NULL);
+        qdev_set_parent_bus(DEVICE(&s->wdt[i]), sysbus_get_default());
+    }
 
     object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
     object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sdmc), 0, ASPEED_SOC_SDMC_BASE);
 
     /* Watch dog */
-    object_property_set_bool(OBJECT(&s->wdt), true, "realized", &err);
-    if (err) {
-        error_propagate(errp, err);
-        return;
+    for (i = 0; i < sc->info->wdts_num; i++) {
+        object_property_set_bool(OBJECT(&s->wdt[i]), true, "realized", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt[i]), 0,
+                        ASPEED_SOC_WDT_BASE + i * 0x20);
     }
-    sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
 
     /* Net */
     qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
-- 
2.7.4

From: Alexander Graf <agraf@suse.de>

When running with KVM enabled, you can choose between emulating the
gic in kernel or user space. If the kernel supports in-kernel virtualization
of the interrupt controller, it will default to that. If not, if will
default to user space emulation.

Unfortunately when running in user mode gic emulation, we miss out on
interrupt events which are only available from kernel space, such as the timer.
This patch leverages the new kernel/user space pending line synchronization for
timer events. It does not handle PMU events yet.

Signed-off-by: Alexander Graf <agraf@suse.de>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1498577737-130264-1-git-send-email-agraf@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/kvm.h   | 11 +++++++++++
 target/arm/cpu.h       |  3 +++
 accel/kvm/kvm-all.c    |  5 +++++
 accel/stubs/kvm-stub.c |  5 +++++
 hw/intc/arm_gic.c      |  7 +++++++
 target/arm/kvm.c       | 51 ++++++++++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 82 insertions(+)

diff --git a/include/sysemu/kvm.h b/include/sysemu/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/kvm.h
+++ b/include/sysemu/kvm.h
@@ -XXX,XX +XXX,XX @@ int kvm_init_vcpu(CPUState *cpu);
 int kvm_cpu_exec(CPUState *cpu);
 int kvm_destroy_vcpu(CPUState *cpu);
 
+/**
+ * kvm_arm_supports_user_irq
+ *
+ * Not all KVM implementations support notifications for kernel generated
+ * interrupt events to user space. This function indicates whether the current
+ * KVM implementation does support them.
+ *
+ * Returns: true if KVM supports using kernel generated IRQs from user space
+ */
+bool kvm_arm_supports_user_irq(void);
+
 #ifdef NEED_CPU_H
 #include "cpu.h"
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     void *el_change_hook_opaque;
 
     int32_t node_id; /* NUMA node this CPU belongs to */
+
+    /* Used to synchronize KVM and QEMU in-kernel device levels */
+    uint8_t device_irq_level;
 };
 
 static inline ARMCPU *arm_env_get_cpu(CPUARMState *env)
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -XXX,XX +XXX,XX @@ int kvm_has_intx_set_mask(void)
     return kvm_state->intx_set_mask;
 }
 
+bool kvm_arm_supports_user_irq(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_ARM_USER_IRQ);
+}
+
 #ifdef KVM_CAP_SET_GUEST_DEBUG
 struct kvm_sw_breakpoint *kvm_find_sw_breakpoint(CPUState *cpu,
                                                  target_ulong pc)
diff --git a/accel/stubs/kvm-stub.c b/accel/stubs/kvm-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/stubs/kvm-stub.c
+++ b/accel/stubs/kvm-stub.c
@@ -XXX,XX +XXX,XX @@ void kvm_init_cpu_signals(CPUState *cpu)
 {
     abort();
 }
+
+bool kvm_arm_supports_user_irq(void)
+{
+    return false;
+}
 #endif
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@
 #include "qom/cpu.h"
 #include "qemu/log.h"
 #include "trace.h"
+#include "sysemu/kvm.h"
 
 /* #define DEBUG_GIC */
 
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (kvm_enabled() && !kvm_arm_supports_user_irq()) {
+        error_setg(errp, "KVM with user space irqchip only works when the "
+                         "host kernel supports KVM_CAP_ARM_USER_IRQ");
+        return;
+    }
+
     /* This creates distributor and main CPU interface (s->cpuiomem[0]) */
     gic_init_irqs_and_mmio(s, gic_set_irq, gic_ops);
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init(MachineState *ms, KVMState *s)
      */
     kvm_async_interrupts_allowed = true;
 
+    /*
+     * PSCI wakes up secondary cores, so we always need to
+     * have vCPUs waiting in kernel space
+     */
+    kvm_halt_in_kernel_allowed = true;
+
     cap_has_mp_state = kvm_check_extension(s, KVM_CAP_MP_STATE);
 
     type_register_static(&host_arm_cpu_type_info);
@@ -XXX,XX +XXX,XX @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
 
 MemTxAttrs kvm_arch_post_run(CPUState *cs, struct kvm_run *run)
 {
+    ARMCPU *cpu;
+    uint32_t switched_level;
+
+    if (kvm_irqchip_in_kernel()) {
+        /*
+         * We only need to sync timer states with user-space interrupt
+         * controllers, so return early and save cycles if we don't.
+         */
+        return MEMTXATTRS_UNSPECIFIED;
+    }
+
+    cpu = ARM_CPU(cs);
+
+    /* Synchronize our shadowed in-kernel device irq lines with the kvm ones */
+    if (run->s.regs.device_irq_level != cpu->device_irq_level) {
+        switched_level = cpu->device_irq_level ^ run->s.regs.device_irq_level;
+
+        qemu_mutex_lock_iothread();
+
+        if (switched_level & KVM_ARM_DEV_EL1_VTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_VIRT],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_VTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_VTIMER;
+        }
+
+        if (switched_level & KVM_ARM_DEV_EL1_PTIMER) {
+            qemu_set_irq(cpu->gt_timer_outputs[GTIMER_PHYS],
+                         !!(run->s.regs.device_irq_level &
+                            KVM_ARM_DEV_EL1_PTIMER));
+            switched_level &= ~KVM_ARM_DEV_EL1_PTIMER;
+        }
+
+        /* XXX PMU IRQ is missing */
+
+        if (switched_level) {
+            qemu_log_mask(LOG_UNIMP, "%s: unhandled in-kernel device IRQ %x\n",
+                          __func__, switched_level);
+        }
+
+        /* We also mark unknown levels as processed to not waste cycles */
+        cpu->device_irq_level = run->s.regs.device_irq_level;
+        qemu_mutex_unlock_iothread();
+    }
+
     return MEMTXATTRS_UNSPECIFIED;
 }
 
-- 
2.7.4

For v7M, writes to the CONTROL register are only permitted for
privileged code. However even if the code is privileged, the
write must not affect the SPSEL bit in the CONTROL register
if the CPU is in Thread mode (as documented in the pseudocode
for the MSR instruction). Implement this, instead of permitting
SPSEL to be written in all cases.

This was causing mbed applications not to run, because the
RTX RTOS they use relies on this behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1498820791-8130-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         }
         break;
     case 20: /* CONTROL */
-        switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
-        env->v7m.control = val & (R_V7M_CONTROL_SPSEL_MASK |
-                                  R_V7M_CONTROL_NPRIV_MASK);
+        /* Writing to the SPSEL bit only has an effect if we are in
+         * thread mode; other bits can be updated by any privileged code.
+         * switch_v7m_sp() deals with updating the SPSEL bit in
+         * env->v7m.control, so we only need update the others.
+         */
+        if (env->v7m.exception == 0) {
+            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+        }
+        env->v7m.control &= ~R_V7M_CONTROL_NPRIV_MASK;
+        env->v7m.control |= val & R_V7M_CONTROL_NPRIV_MASK;
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
-- 
2.7.4

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0