Series comparison

-[Qemu-devel] [PULL 00/18] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-ARM queue: nothing particularly exciting, but 18 patches
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
 is enough to send out.
-thanks
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
 -- PMM
-The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-are available in the git repository at:
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
 for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
   mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: various code cleanups
+ * Fix coverity nit in int_to_float code
- * v7M: set correct BFSR bits on bus fault
+ * Don't set Invalid for float-to-int(MAXINT)
- * v7M: clear exclusive monitor on reset and exception entry/exit
+ * Fix fp_status_f16 tininess before rounding
- * v7M: don't apply priority mask to negative priorities
+ * Add various missing insns from the v8.2-FP16 extension
- * zcu102: support 'secure' and 'virtualization' machine properties
+ * Fix sqrt_f16 exception raising
- * aarch64: fix ERET single stepping
+ * sdcard: Correct CRC16 offset in sd_function_switch()
- * gpex: implement PCI INTx routing
+ * tcg: Optionally log FPU state in TCG -d cpu logging
  * mps2-an511: fix UART overflow interrupt line wiring
 ----------------------------------------------------------------
-Alistair Francis (5):
+Alex Bennée (5):
-      xlnx-ep108: Rename to ZCU102
+      fpu/softfloat: int_to_float ensure r fully initialised
-      xlnx-zcu102: Manually create the machines
+      target/arm: Implement FCMP for fp16
-      xlnx-zcu102: Add a machine level secure property
+      target/arm: Implement FCSEL for fp16
-      xlnx-zcu102: Add a machine level virtualization property
+      target/arm: Implement FMOV (immediate) for fp16
-      xlnx-zcu102: Mark the EP108 machine as deprecated
+      target/arm: Fix sqrt_f16 exception raising
-Jaroslaw Pelczar (1):
+Peter Maydell (3):
-      AArch64: Fix single stepping of ERET instruction
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
       target/arm: Fix fp_status_f16 tininess before rounding
       tcg: Optionally log FPU state in TCG -d cpu logging
-Peter Maydell (8):
+Philippe Mathieu-Daudé (1):
-      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+      sdcard: Correct CRC16 offset in sd_function_switch()
       target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
       target/arm: Get PRECISERR and IBUSERR the right way round
       nvic: Don't apply group priority mask to negative priorities
       target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
       target/arm: Add and use defines for EXCRET constants
       target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
       mps2-an511: Fix wiring of UART overflow interrupt lines
-Pranavkumar Sawargaonkar (3):
+Richard Henderson (7):
-      hw/pci-host/gpex: Set INTx index/gsi mapping
+      target/arm: Implement FMOV (general) for fp16
-      hw/arm/virt: Set INTx/gsi mapping
+      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-      hw/pci-host/gpex: Implement PCI INTx routing
+      target/arm: Implement FCVT (scalar, integer) for fp16
       target/arm: Implement FCVT (scalar, fixed-point) for fp16
       target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
-Richard Henderson (1):
+ include/qemu/log.h         |   1 +
-      target/arm: Avoid an extra temporary for store_exclusive
+ target/arm/helper-a64.h    |   2 +
  target/arm/helper.h        |   6 +
  accel/tcg/cpu-exec.c       |   9 +-
  fpu/softfloat.c            |   6 +-
  hw/sd/sd.c                 |   2 +-
  target/arm/cpu.c           |   2 +
  target/arm/helper-a64.c    |  10 ++
  target/arm/helper.c        |  38 +++-
  target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
  util/log.c                 |   2 +
 files changed, 428 insertions(+), 71 deletions(-)
- hw/arm/Makefile.objs         |   2 +-
- include/hw/arm/xlnx-zynqmp.h |   2 +
- include/hw/pci-host/gpex.h   |   3 +
- target/arm/cpu.h             |  35 +++---
- target/arm/internals.h       |  20 ++++
- hw/arm/mps2.c                |   4 +-
- hw/arm/virt.c                |   1 +
- hw/arm/xlnx-ep108.c          | 139 -----------------------
- hw/arm/xlnx-zcu102.c         | 259 +++++++++++++++++++++++++++++++++++++++++++
- hw/arm/xlnx-zynqmp.c         |   3 +-
- hw/intc/armv7m_nvic.c        |  11 +-
- hw/pci-host/gpex.c           |  22 ++++
- target/arm/cpu.c             |   6 +
- target/arm/helper.c          |  43 ++++---
- target/arm/op_helper.c       |   2 +-
- target/arm/translate-a64.c   |  27 ++---
-files changed, 382 insertions(+), 197 deletions(-)
- delete mode 100644 hw/arm/xlnx-ep108.c
- create mode 100644 hw/arm/xlnx-zcu102.c

-[Qemu-devel] [PULL 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+Deleted patch
-Use a symbolic constant M_REG_NUM_BANKS for the array size for
-registers which are banked by M profile security state, rather
-than hardcoding lots of 2s.
-Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h | 35 +++++++++++++++++++----------------
-file changed, 19 insertions(+), 16 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
-  * accessed via env->registerfield[env->v7m.secure] (whether the security
-  * extension is implemented or not).
-  */
--#define M_REG_NS 0
--#define M_REG_S 1
-+enum {
-+    M_REG_NS = 0,
-+    M_REG_S = 1,
-+    M_REG_NUM_BANKS = 2,
-+};
- /* ARM-specific interrupt pending bits.  */
- #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t other_sp;
-         uint32_t other_ss_msp;
-         uint32_t other_ss_psp;
--        uint32_t vecbase[2];
--        uint32_t basepri[2];
--        uint32_t control[2];
--        uint32_t ccr[2]; /* Configuration and Control */
--        uint32_t cfsr[2]; /* Configurable Fault Status */
-+        uint32_t vecbase[M_REG_NUM_BANKS];
-+        uint32_t basepri[M_REG_NUM_BANKS];
-+        uint32_t control[M_REG_NUM_BANKS];
-+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
-+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
-         uint32_t hfsr; /* HardFault Status */
-         uint32_t dfsr; /* Debug Fault Status Register */
--        uint32_t mmfar[2]; /* MemManage Fault Address */
-+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
-         uint32_t bfar; /* BusFault Address */
--        unsigned mpu_ctrl[2]; /* MPU_CTRL */
-+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
-         int exception;
--        uint32_t primask[2];
--        uint32_t faultmask[2];
-+        uint32_t primask[M_REG_NUM_BANKS];
-+        uint32_t faultmask[M_REG_NUM_BANKS];
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
-     } v7m;
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t *drbar;
-         uint32_t *drsr;
-         uint32_t *dracr;
--        uint32_t rnr[2];
-+        uint32_t rnr[M_REG_NUM_BANKS];
-     } pmsav7;
-     /* PMSAv8 MPU */
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-          *  pmsav7.rnr (region number register)
-          *  pmsav7_dregion (number of configured regions)
-          */
--        uint32_t *rbar[2];
--        uint32_t *rlar[2];
--        uint32_t mair0[2];
--        uint32_t mair1[2];
-+        uint32_t *rbar[M_REG_NUM_BANKS];
-+        uint32_t *rlar[M_REG_NUM_BANKS];
-+        uint32_t mair0[M_REG_NUM_BANKS];
-+        uint32_t mair1[M_REG_NUM_BANKS];
-     } pmsav8;
-     void *nvic;
---
-.7.4

-[Qemu-devel] [PULL 16/18] hw/arm/virt: Set INTx/gsi mapping
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
-needed for INTx/gsi routing.
+later on so we might as well mirror that.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Tested-by: Feng Kan <fkan@apm.com>
 Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 1 +
+ fpu/softfloat.c | 2 +-
-file changed, 1 insertion(+)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/fpu/softfloat.c
-+++ b/hw/arm/virt.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
-     for (i = 0; i < GPEX_NUM_IRQS; i++) {
+ static FloatParts int_to_float(int64_t a, float_status *status)
-         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+ {
-+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
+-    FloatParts r;
-     }
++    FloatParts r = {};
+     if (a == 0) {
-     pci = PCI_HOST_BRIDGE(dev);
+         r.cls = float_class_zero;
          r.sign = false;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-Fix an error that meant we were wiring every UART's overflow
+In float-to-integer conversion, if the floating point input
-interrupts into the same inputs 0 and 1 of the OR gate,
+converts exactly to the largest or smallest integer that
-rather than giving each its own input.
+fits in to the result type, this is not an overflow.
 In this situation we were producing the correct result value,
 but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
 Fix the boundary case to take the right half of the if()
 statements.
 This fixes a regression from 2.11 introduced by the softfloat
 refactoring.
 Cc: qemu-stable@nongnu.org
+Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
 Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 4 ++--
+ fpu/softfloat.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/fpu/softfloat.c
-+++ b/hw/arm/mps2.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
-             cmsdk_apb_uart_create(uartbase[i],
+             r = UINT64_MAX;
                                    qdev_get_gpio_in(txrx_orgate_dev, 0),
                                    qdev_get_gpio_in(txrx_orgate_dev, 1),
 -                                  qdev_get_gpio_in(orgate_dev, 0),
 -                                  qdev_get_gpio_in(orgate_dev, 1),
 +                                  qdev_get_gpio_in(orgate_dev, i * 2),
 +                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                    NULL,
                                    uartchr, SYSCLK_FRQ);
          }
+         if (p.sign) {
+-            if (r < -(uint64_t) min) {
++            if (r <= -(uint64_t) min) {
+                 return -r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
+                 return min;
+             }
+         } else {
+-            if (r < max) {
++            if (r <= max) {
+                 return r;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
-For M profile we must clear the exclusive monitor on reset, exception
+In commit d81ce0ef2c4f105 we added an extra float_status field
-entry and exception exit.  We weren't doing any of these things; fix
+fp_status_fp16 for Arm, but forgot to initialize it correctly
-this bug.
+by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
+Add the missing initialization.
+Fixes: d81ce0ef2c4f105
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/cpu.c | 2 ++
- target/arm/cpu.c       |  6 ++++++
+file changed, 2 insertions(+)
  target/arm/helper.c    |  2 ++
  target/arm/op_helper.c |  2 +-
 files changed, 19 insertions(+), 1 deletion(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
- #endif
- /**
-+ * arm_clear_exclusive: clear the exclusive monitor
-+ * @env: CPU env
-+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
-+ */
-+static inline void arm_clear_exclusive(CPUARMState *env)
-+{
-+    env->exclusive_addr = -1;
-+}
-+
-+/**
-  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
-  * @s2addr: Address that caused a fault at stage 2
-  * @stage2: True if we faulted at stage 2
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
 @@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-         env->regs[15] = 0xFFFF0000;
+                               &env->vfp.fp_status);
-     }
+     set_float_detect_tininess(float_tininess_before_rounding,
+                               &env->vfp.standard_fp_status);
-+    /* M profile requires that reset clears the exclusive monitor;
++    set_float_detect_tininess(float_tininess_before_rounding,
-+     * A profile does not, but clearing it makes more sense than having it
++                              &env->vfp.fp_status_f16);
-+     * set with an exclusive access on address zero.
+ #ifndef CONFIG_USER_ONLY
-+     */
+     if (kvm_enabled()) {
-+    arm_clear_exclusive(env);
+         kvm_arm_reset_vcpu(cpu);
 +
      env->vfp.xregs[ARM_VFP_FPEXC] = 0;
  #endif
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      armv7m_nvic_acknowledge_irq(env->nvic);
      switch_v7m_sp(env, 0);
 +    arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
      env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      }
      /* Otherwise, we have a successful exception exit. */
 +    arm_clear_exclusive(env);
      qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
  }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
      aarch64_save_sp(env, cur_el);
 -    env->exclusive_addr = -1;
 +    arm_clear_exclusive(env);
      /* We must squash the PSTATE.SS bit to zero unless both of the
       * following hold:
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 03/18] target/arm: Get PRECISERR and IBUSERR the right way round
+Deleted patch
-For a bus fault, the M profile BFSR bit PRECISERR means a bus
-fault on a data access, and IBUSERR means a bus fault on an
-instruction access. We had these the wrong way around; fix this.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         case 0x8: /* External Abort */
-             switch (cs->exception_index) {
-             case EXCP_PREFETCH_ABORT:
--                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
--                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
-+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
-                 break;
-             case EXCP_DATA_ABORT:
-                 env->v7m.cfsr[M_REG_NS] |=
--                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
-                 env->v7m.bfar = env->exception.vaddress;
-                 qemu_log_mask(CPU_LOG_INT,
--                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
-+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
-                               env->v7m.bfar);
-                 break;
-             }
---
-.7.4

-[Qemu-devel] [PULL 14/18] target/arm: Avoid an extra temporary for store_exclusive
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
 From: Richard Henderson <richard.henderson@linaro.org>
-Instead of copying addr to a local temp, reuse the value (which we
+Adding the fp16 moves to/from general registers.
 have just compared as equal) already saved in cpu_exclusive_addr.
+Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
+Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 26 +++++++++-----------------
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 9 insertions(+), 17 deletions(-)
+file changed, 21 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
- }
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+             clear_vec_high(s, true, rd);
- static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
+             break;
--                                TCGv_i64 inaddr, int size, int is_pair)
++        case 3:
-+                                TCGv_i64 addr, int size, int is_pair)
++            /* 16 bit */
- {
++            tmp = tcg_temp_new_i64();
-     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
-      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
++            write_fp_dreg(s, rd, tmp);
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
++            tcg_temp_free_i64(tmp);
-      */
++            break;
-     TCGLabel *fail_label = gen_new_label();
++        default:
-     TCGLabel *done_label = gen_new_label();
++            g_assert_not_reached();
 -    TCGv_i64 addr = tcg_temp_local_new_i64();
      TCGv_i64 tmp;
 -    /* Copy input into a local temp so it is not trashed when the
 -     * basic block ends at the branch insn.
 -     */
 -    tcg_gen_mov_i64(addr, inaddr);
      tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
      tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
              } else {
                  tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
              }
 -            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
 +            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
 +                                       cpu_exclusive_val, tmp,
                                         get_mem_index(s),
                                         MO_64 | MO_ALIGN | s->be_data);
              tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
          } else if (s->be_data == MO_LE) {
 -            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          } else {
 -            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
 -                                           cpu_reg(s, rt2));
 +            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
 +                                           cpu_reg(s, rt), cpu_reg(s, rt2));
          }
      } else {
--        TCGv_i64 val = cpu_reg(s, rt);
+         TCGv_i64 tcg_rd = cpu_reg(s, rd);
--        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
--                                   get_mem_index(s),
+             /* 64 bits from top half */
-+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
-+                                   cpu_reg(s, rt), get_mem_index(s),
+             break;
-                                    size | MO_ALIGN | s->be_data);
++        case 3:
-         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
++            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
--
+ }
--    tcg_temp_free_i64(addr);
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
--
+         case 0xa: /* 64 bit */
-     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
+         case 0xd: /* 64 bit to top half of quad */
-     tcg_temp_free_i64(tmp);
+             break;
-     tcg_gen_br(done_label);
++        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The EP108 is the same as the ZCU102, mark it as deprecated as we don't
+No sense in emitting code after the exception.
 need two machines.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 2 +-
+ target/arm/translate-a64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
- {
+         default:
-     MachineClass *mc = MACHINE_CLASS(oc);
+             /* all other sf/type/rmode combinations are invalid */
+             unallocated_encoding(s);
--    mc->desc = "Xilinx ZynqMP EP108 board";
+-            break;
-+    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
++            return;
-     mc->init = xlnx_ep108_init;
+         }
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
+         if (!fp_access_check(s)) {
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
-In the v7M and v8M ARM ARM, the magic exception return values are
+From: Richard Henderson <richard.henderson@linaro.org>
-referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
-constants to define bits within them. Rename the 'type' variable
+Cc: qemu-stable@nongnu.org
-which holds the exception return value in do_v7m_exception_exit()
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-to excret, making it clearer that it does hold an EXC_RETURN value.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 23 ++++++++++++-----------
+ target/arm/helper.h        |  6 +++
-file changed, 12 insertions(+), 11 deletions(-)
+ target/arm/helper.c        | 38 ++++++++++++++-
+ target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 files changed, 122 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
 +DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
  DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
 +DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
 +DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
  DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
- static void do_v7m_exception_exit(ARMCPU *cpu)
+ #undef VFP_CONV_FIX_A64
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
-     CPUARMState *env = &cpu->env;
+     if (unlikely(float16_is_any_nan(f))) {
--    uint32_t type;
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
-+    uint32_t excret;
+     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
-     uint32_t xpsr;
+ }
-     bool ufault = false;
-     bool return_to_sp_process = false;
++uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++{
-      * the target value up between env->regs[15] and env->thumb in
++    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
-      * gen_bx(). Reconstitute it.
++}
-      */
++
--    type = env->regs[15];
++uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
-+    excret = env->regs[15];
++{
-     if (env->thumb) {
++    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
--        type |= 1;
++}
-+        excret |= 1;
++
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
-     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
+     tcg_temp_free_ptr(tcg_fpstatus);
-                   " previous exception %d\n",
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
--                  type, env->v7m.exception);
+         /* actual FP conversions */
-+                  excret, env->v7m.exception);
+         bool itof = extract32(opcode, 1, 1);
--    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+-        if (type > 1 || (rmode != 0 && opcode > 1)) {
-+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++        if (rmode != 0 && opcode > 1) {
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
++            unallocated_encoding(s);
--                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
++            return;
-+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
++        }
-+                      excret);
++        switch (type) {
-     }
++        case 0: /* float32 */
++        case 1: /* float64 */
-     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
++            break;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++        case 3: /* float16 */
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
++            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-          */
++                break;
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++            }
--            int es = type & R_V7M_EXCRET_ES_MASK;
++            /* fallthru */
-+            int es = excret & R_V7M_EXCRET_ES_MASK;
++        default:
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
+             unallocated_encoding(s);
-                 env->v7m.faultmask[es] = 0;
+             return;
-             }
+         }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          g_assert_not_reached();
      }
 -    switch (type & 0xf) {
 +    switch (excret & 0xf) {
      case 1: /* Return to Handler */
          return_to_handler = true;
          break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
           */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
 -        v7m_exception_taken(cpu, type);
 +        v7m_exception_taken(cpu, excret);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                        "stackframe: failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      /* The restored xPSR exception field will be zero if we're
       * resuming in Thread mode. If that doesn't match what the
 -     * exception return type specified then this is a UsageFault.
 +     * exception return excret specified then this is a UsageFault.
       */
      if (return_to_handler != arm_v7m_is_handler_mode(env)) {
          /* Take an INVPC UsageFault by pushing the stack again. */
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          v7m_push_stack(cpu);
 -        v7m_exception_taken(cpu, type);
 +        v7m_exception_taken(cpu, excret);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                        "failed exception return integrity check\n");
          return;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 04/18] nvic: Don't apply group priority mask to negative priorities
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
-In several places we were unconditionally applying the
+From: Richard Henderson <richard.henderson@linaro.org>
 nvic_gprio_mask() to a priority value. This is incorrect
 if the priority is one of the fixed negative priority
 values (for NMI and HardFault), so don't do it.
-This bug would have caused both NMI and HardFault to be
+Cc: qemu-stable@nongnu.org
-considered as the same priority and so NMI wouldn't
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-correctly preempt HardFault.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 17 +++++++++++++++--
 file changed, 15 insertions(+), 2 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
 ---
  hw/intc/armv7m_nvic.c | 11 +++++++++--
 file changed, 9 insertions(+), 2 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
-         }
+     bool sf = extract32(insn, 31, 1);
-     }
+     bool itof;
-+    if (active_prio > 0) {
+-    if (sbit || (type > 1)
-+        active_prio &= nvic_gprio_mask(s);
+-        || (!sf && scale < 32)) {
 +    if (sbit || (!sf && scale < 32)) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-     s->vectpending = pend_irq;
++    switch (type) {
--    s->exception_prio = active_prio & nvic_gprio_mask(s);
++    case 0: /* float32 */
-+    s->exception_prio = active_prio;
++    case 1: /* float64 */
++        break;
-     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
++    case 3: /* float16 */
- }
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
++            break;
-     assert(vec->enabled);
++        }
-     assert(vec->pending);
++        /* fallthru */
++    default:
--    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+         unallocated_encoding(s);
-+    pendgroupprio = vec->prio;
+         return;
-+    if (pendgroupprio > 0) {
+     }
 +        pendgroupprio &= nvic_gprio_mask(s);
 +    }
      assert(pendgroupprio < running);
      trace_nvic_acknowledge_irq(pending, vec->prio);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 11/18] xlnx-zcu102: Add a machine level virtualization property
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a machine level virtualization property. This defaults to false and can be
+Cc: qemu-stable@nongnu.org
-set to true using this machine command line argument:
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-    -machine xlnx-zcu102,virtualization=on
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-This follows what the ARM virt machine does.
+Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 This property only applies to the ZCU102 machine. The EP108 machine does
 not have this property.
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-zynqmp.h |  2 ++
+ target/arm/translate-a64.c | 30 ++++++++++++++----------------
- hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
+file changed, 14 insertions(+), 16 deletions(-)
  hw/arm/xlnx-zynqmp.c         |  3 ++-
 files changed, 33 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/xlnx-zynqmp.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+     return v;
      /* Has the ARM Security extensions?  */
      bool secure;
 +    /* Has the ARM Virtualization extensions?  */
 +    bool virt;
      /* Has the RPU subsystem?  */
      bool has_rpu;
  }  XlnxZynqMPState;
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
      MemoryRegion ddr_ram;
      bool secure;
 +    bool virt;
  } XlnxZCU102;
  #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
      s->secure = value;
  }
-+static bool zcu102_get_virt(Object *obj, Error **errp)
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    TCGv_i32 v = tcg_temp_new_i32();
 +
-+    return s->virt;
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
 +    return v;
 +}
 +
-+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
-+{
+  * If SVE is not enabled, then there are only 128 bits in the vector.
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+  */
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+    s->virt = value;
+ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 +}
 +
  static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
  {
-     int i;
+     TCGv_ptr fpst = NULL;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
-                          "ddr-ram", &error_abort);
++    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+     TCGv_i32 tcg_res = tcg_temp_new_i32();
-                              &error_fatal);
-+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-+                             &error_fatal);
+-
+     switch (opcode) {
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+     case 0x0: /* FMOV */
+         tcg_gen_mov_i32(tcg_res, tcg_op);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
- {
+         tcg_temp_free_i64(tcg_op2);
-     XlnxZCU102 *s = EP108_MACHINE(obj);
+         tcg_temp_free_i64(tcg_res);
+     } else {
--    /* EP108, we don't support setting secure */
+-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-+    /* EP108, we don't support setting secure or virt */
+-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
-     s->secure = false;
++        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
-+    s->virt = false;
++        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
- }
+         TCGv_i64 tcg_res = tcg_temp_new_i64();
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
+-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-                                     "Set on/off to enable/disable the ARM "
+-
-                                     "Security Extensions (TrustZone)",
+         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
-                                     NULL);
+         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
-+
-+    /* Default to virt (EL2) being disabled */
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
-+    s->virt = false;
-+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+     fpst = get_fpstatus_ptr(true);
-+                             zcu102_set_virt, NULL);
-+    object_property_set_description(obj, "virtualization",
+-    tcg_op1 = tcg_temp_new_i32();
-+                                    "Set on/off to enable/disable emulating a "
+-    tcg_op2 = tcg_temp_new_i32();
-+                                    "guest CPU which implements the ARM "
++    tcg_op1 = read_fp_hreg(s, rn);
-+                                    "Virtualization Extensions",
++    tcg_op2 = read_fp_hreg(s, rm);
-+                                    NULL);
+     tcg_res = tcg_temp_new_i32();
- }
+-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
+-
-index XXXXXXX..XXXXXXX 100644
+     switch (fpopcode) {
---- a/hw/arm/xlnx-zynqmp.c
+     case 0x03: /* FMULX */
-+++ b/hw/arm/xlnx-zynqmp.c
+         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
+     }
-                                  s->secure, "has_el3", NULL);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
+     if (is_scalar) {
--                                 false, "has_el2", NULL);
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
-+                                 s->virt, "has_el2", NULL);
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
-                                 "reset-cbar", &error_abort);
-         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
+-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
+-
- static Property xlnx_zynqmp_props[] = {
+         switch (fpop) {
-     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
+         case 0x1a: /* FCVTNS */
-     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+         case 0x1b: /* FCVTMS */
 +    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
      DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
      DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                       MemoryRegion *),
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 17/18] hw/pci-host/gpex: Implement PCI INTx routing
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Now we are able to retrieve the gsi from the INTx pin, let's
+We missed all of the scalar fp16 binary operations.
 enable intx_to_irq routing. From that point on, irqfd becomes
 usable along with INTx when assigning a PCIe device.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Cc: qemu-stable@nongnu.org
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Feng Kan <fkan@apm.com>
+Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/pci-host/gpex.c | 12 ++++++++++++
+ target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
-file changed, 12 insertions(+)
+file changed, 65 insertions(+)
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/pci-host/gpex.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
-     return 0;
+     tcg_temp_free_i64(tcg_res);
  }
-+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
++/* Floating-point data-processing (2 source) - half precision */
 +static void handle_fp_2src_half(DisasContext *s, int opcode,
 +                                int rd, int rn, int rm)
 +{
-+    PCIINTxRoute route;
++    TCGv_i32 tcg_op1;
-+    GPEXHost *s = opaque;
++    TCGv_i32 tcg_op2;
 +    TCGv_i32 tcg_res;
 +    TCGv_ptr fpst;
 +
-+    route.mode = PCI_INTX_ENABLED;
++    tcg_res = tcg_temp_new_i32();
-+    route.irq = s->irq_num[pin];
++    fpst = get_fpstatus_ptr(true);
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
 +
-+    return route;
++    switch (opcode) {
 +    case 0x0: /* FMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x1: /* FDIV */
 +        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+ /* Floating point data-processing (2 source)
- {
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
-@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
-                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
+         }
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
-     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+         break;
-+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
++    case 3:
-     qdev_init_nofail(DEVICE(&s->gpex_root));
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- }
++            unallocated_encoding(s);
++            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-To implement INTx to gsi routing we need to pass the gpex host
+We missed all of the scalar fp16 fma operations.
 bridge the gsi associated to each INTx index. Let's introduce
 irq_num array and gpex_set_irq_num setter function.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Cc: qemu-stable@nongnu.org
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Feng Kan <fkan@apm.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/pci-host/gpex.h |  3 +++
+ target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
- hw/pci-host/gpex.c         | 10 ++++++++++
+file changed, 48 insertions(+)
 files changed, 13 insertions(+)
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci-host/gpex.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/pci-host/gpex.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
-     MemoryRegion io_ioport;
+     tcg_temp_free_i64(tcg_res);
-     MemoryRegion io_mmio;
+ }
-     qemu_irq irq[GPEX_NUM_IRQS];
-+    int irq_num[GPEX_NUM_IRQS];
++/* Floating-point data-processing (3 source) - half precision */
- } GPEXHost;
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
++                                int rd, int rn, int rm, int ra)
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
++{
 +    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
 +    TCGv_i32 tcg_res = tcg_temp_new_i32();
 +    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +
- #endif /* HW_GPEX_H */
++    tcg_op1 = read_fp_hreg(s, rn);
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
++    tcg_op2 = read_fp_hreg(s, rm);
-index XXXXXXX..XXXXXXX 100644
++    tcg_op3 = read_fp_hreg(s, ra);
---- a/hw/pci-host/gpex.c
++
-+++ b/hw/pci-host/gpex.c
++    /* These are fused multiply-add, and must be done as one
-@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
++     * floating point operation with no rounding between the
-     qemu_set_irq(s->irq[irq_num], level);
++     * multiplication and addition steps.
- }
++     * NB that doing the negations here as separate steps is
++     * correct : an input NaN should come out with its sign bit
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
++     * flipped if it is a negated-input.
-+{
++     */
-+    if (index >= GPEX_NUM_IRQS) {
++    if (o1 == true) {
-+        return -EINVAL;
++        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
-+    s->irq_num[index] = gsi;
++    if (o0 != o1) {
-+    return 0;
++        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +    }
 +
 +    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+ /* Floating point data-processing (3 source)
- {
+  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
          }
          handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 10/18] xlnx-zcu102: Add a machine level secure property
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Add a machine level secure property. This defaults to false and can be
+These where missed out from the rest of the half-precision work.
-set to true using this machine command line argument:
-    -machine xlnx-zcu102,secure=on
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-This follows what the ARM virt machine does.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-This property only applies to the ZCU102 machine. The EP108 machine does
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-not have this property.
+Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
+[rth: Diagnose lack of FP16 before fp_access_check]
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
+ target/arm/helper-a64.h    |  2 +
-file changed, 32 insertions(+)
+ target/arm/helper-a64.c    | 10 +++++
+ target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+files changed, 83 insertions(+), 17 deletions(-)
 diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/helper-a64.h
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/helper-a64.h
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+@@ -XXX,XX +XXX,XX @@
+ DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-     XlnxZynqMPState soc;
+ DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-     MemoryRegion ddr_ram;
+ DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
-+
++DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
-+    bool secure;
++DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
- } XlnxZCU102;
+ DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+ DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
- #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+ DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
- static struct arm_boot_info xlnx_zcu102_binfo;
+--- a/target/arm/helper-a64.c
++++ b/target/arm/helper-a64.c
-+static bool zcu102_get_secure(Object *obj, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
      return flags;
  }
 +uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
 +
 +    return s->secure;
 +}
 +
-+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
++uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +
 +    s->secure = value;
 +}
 +
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+ uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
-     int i;
+     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
-     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
+--- a/target/arm/translate-a64.c
-                          "ddr-ram", &error_abort);
++++ b/target/arm/translate-a64.c
-+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
-+                             &error_fatal);
+     }
+ }
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+-static void handle_fp_compare(DisasContext *s, bool is_double,
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
++static void handle_fp_compare(DisasContext *s, int size,
+                               unsigned int rn, unsigned int rm,
- static void xlnx_ep108_machine_instance_init(Object *obj)
+                               bool cmp_with_zero, bool signal_all_nans)
  {
-+    XlnxZCU102 *s = EP108_MACHINE(obj);
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-+
+-    TCGv_ptr fpst = get_fpstatus_ptr(false);
-+    /* EP108, we don't support setting secure */
++    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
-+    s->secure = false;
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+ /* Floating point conditional compare
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
+     unsigned int mos, type, rm, cond, rn, op, nzcv;
- static void xlnx_zcu102_machine_instance_init(Object *obj)
+     TCGv_i64 tcg_flags;
- {
+     TCGLabel *label_continue = NULL;
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    int size;
-+
-+    /* Default to secure mode being disabled */
+     mos = extract32(insn, 29, 3);
-+    s->secure = false;
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+    object_property_add_bool(obj, "secure", zcu102_get_secure,
++    type = extract32(insn, 22, 2);
-+                             zcu102_set_secure, NULL);
+     rm = extract32(insn, 16, 5);
-+    object_property_set_description(obj, "secure",
+     cond = extract32(insn, 12, 4);
-+                                    "Set on/off to enable/disable the ARM "
+     rn = extract32(insn, 5, 5);
-+                                    "Security Extensions (TrustZone)",
+     op = extract32(insn, 4, 1);
-+                                    NULL);
+     nzcv = extract32(insn, 0, 4);
- }
+-    if (mos || type > 1) {
- static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
++    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 06/18] target/arm: Add and use defines for EXCRET constants
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-The exception-return magic values get some new bits in v8M, which
+From: Alex Bennée <alex.bennee@linaro.org>
 makes some bit definitions for them worthwhile.
-We don't use the bit definitions for the switch on the low bits
+These were missed out from the rest of the half-precision work.
 which checks the return type for v7M, because this is defined
 in the v7M ARM ARM as a set of valid values rather than via
 per-bit checks.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
+[rth: Fix erroneous check vs type]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
- target/arm/helper.c    | 14 +++++++++-----
+file changed, 25 insertions(+), 6 deletions(-)
 files changed, 19 insertions(+), 5 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/internals.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
- FIELD(V7M_CONTROL, SPSEL, 1, 1)
+     unsigned int mos, type, rm, cond, rn, rd;
- FIELD(V7M_CONTROL, FPCA, 2, 1)
+     TCGv_i64 t_true, t_false, t_zero;
+     DisasCompare64 c;
-+/* Bit definitions for v7M exception return payload */
++    TCGMemOp sz;
-+FIELD(V7M_EXCRET, ES, 0, 1)
-+FIELD(V7M_EXCRET, RES0, 1, 1)
+     mos = extract32(insn, 29, 3);
-+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+FIELD(V7M_EXCRET, MODE, 3, 1)
++    type = extract32(insn, 22, 2);
-+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+     rm = extract32(insn, 16, 5);
-+FIELD(V7M_EXCRET, DCRS, 5, 1)
+     cond = extract32(insn, 12, 4);
-+FIELD(V7M_EXCRET, S, 6, 1)
+     rn = extract32(insn, 5, 5);
-+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+     rd = extract32(insn, 0, 5);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
- /*
++    switch (type) {
-  * For AArch64, map a given EL to an index in the banked_spsr array.
++    case 0:
-  * Note that this mapping and the AArch32 mapping defined in bank_number()
++        sz = MO_32;
-diff --git a/target/arm/helper.c b/target/arm/helper.c
++        break;
-index XXXXXXX..XXXXXXX 100644
++    case 1:
---- a/target/arm/helper.c
++        sz = MO_64;
-+++ b/target/arm/helper.c
++        break;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
++    case 3:
-                   " previous exception %d\n",
++        sz = MO_16;
-                   type, env->v7m.exception);
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++            break;
--    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
++        }
-+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++        /* fallthru */
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
++    default:
-                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+         unallocated_encoding(s);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
+         return;
           */
          if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 -            int es = type & 1;
 +            int es = type & R_V7M_EXCRET_ES_MASK;
              if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                  env->v7m.faultmask[es] = 0;
              }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          return; /* Never happens.  Keep compiler happy.  */
      }
--    lr = 0xfffffff1;
+-    /* Zero extend sreg inputs to 64 bits now.  */
-+    lr = R_V7M_EXCRET_RES1_MASK |
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-+        R_V7M_EXCRET_S_MASK |
+     t_true = tcg_temp_new_i64();
-+        R_V7M_EXCRET_DCRS_MASK |
+     t_false = tcg_temp_new_i64();
-+        R_V7M_EXCRET_FTYPE_MASK |
+-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-+        R_V7M_EXCRET_ES_MASK;
+-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
++    read_vec_element(s, t_true, rn, 0, sz);
--        lr |= 4;
++    read_vec_element(s, t_false, rm, 0, sz);
-+        lr |= R_V7M_EXCRET_SPSEL_MASK;
-     }
+     a64_test_cc(&c, cond);
-     if (!arm_v7m_is_handler_mode(env)) {
+     t_zero = tcg_const_i64(0);
--        lr |= 8;
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+        lr |= R_V7M_EXCRET_MODE_MASK;
+     tcg_temp_free_i64(t_false);
-     }
+     a64_free_cc(&c);
-     v7m_push_stack(cpu);
+-    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 08/18] xlnx-ep108: Rename to ZCU102
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-The EP108 is a early access development board. Now that silicon is in
+All the hard work is already done by vfp_expand_imm, we just need to
-production people have access to the ZCU102. Let's rename the internal
+make sure we pick up the correct size.
 QEMU files and variables to use the ZCU102.
-There is no functional change here as the EP108 is still a valid board
+Cc: qemu-stable@nongnu.org
-option.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                   |  2 +-
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
- hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
+file changed, 17 insertions(+), 3 deletions(-)
 files changed, 16 insertions(+), 16 deletions(-)
  rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/Makefile.objs
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
  obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
  obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
  obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
 -obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
 +obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
  obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
  obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
  obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
 diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
 similarity index 85%
 rename from hw/arm/xlnx-ep108.c
 rename to hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-ep108.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
  /*
 - * Xilinx ZynqMP EP108 board
 + * Xilinx ZynqMP ZCU102 board
   *
   * Copyright (C) 2015 Xilinx Inc
   * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/log.h"
 -typedef struct XlnxEP108 {
 +typedef struct XlnxZCU102 {
      XlnxZynqMPState soc;
      MemoryRegion ddr_ram;
 -} XlnxEP108;
 +} XlnxZCU102;
 -static struct arm_boot_info xlnx_ep108_binfo;
 +static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_ep108_init(MachineState *machine)
 +static void xlnx_zcu102_init(MachineState *machine)
  {
--    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+     int rd = extract32(insn, 0, 5);
-+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
+     int imm8 = extract32(insn, 13, 8);
-     int i;
+-    int is_double = extract32(insn, 22, 2);
-     uint64_t ram_size = machine->ram_size;
++    int type = extract32(insn, 22, 2);
+     uint64_t imm;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+     TCGv_i64 tcg_res;
 +    TCGMemOp sz;
 -    if (is_double > 1) {
 +    switch (type) {
 +    case 0:
 +        sz = MO_32;
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-     if (ram_size < 0x08000000) {
+         return;
 -        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
 +        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                   ram_size);
      }
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
++    imm = vfp_expand_imm(sz, imm8);
-     /* TODO create and connect IDE devices for ide_drive_get() */
+     tcg_res = tcg_const_i64(imm);
--    xlnx_ep108_binfo.ram_size = ram_size;
+     write_fp_dreg(s, rd, tcg_res);
 -    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
 -    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
 -    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
 -    xlnx_ep108_binfo.loader_start = 0;
 -    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
 +    xlnx_zcu102_binfo.ram_size = ram_size;
 +    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
 +    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
 +    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
 +    xlnx_zcu102_binfo.loader_start = 0;
 +    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
  }
  static void xlnx_ep108_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP EP108 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
  static void xlnx_zcu102_machine_init(MachineClass *mc)
  {
      mc->desc = "Xilinx ZynqMP ZCU102 board";
 -    mc->init = xlnx_ep108_init;
 +    mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 13/18] AArch64: Fix single stepping of ERET instruction
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
-From: Jaroslaw Pelczar <j.pelczar@samsung.com>
+From: Alex Bennée <alex.bennee@linaro.org>
-Previously when single stepping through ERET instruction via GDB
+We are meant to explicitly pass fpst, not cpu_env.
 would result in debugger entering the "next" PC after ERET instruction.
 When debugging in kernel mode, this will also cause unintended behavior,
 because debugger will try to access memory from EL0 point of view.
-Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
+Cc: qemu-stable@nongnu.org
-Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 1 +
+ target/arm/translate-a64.c | 3 ++-
-file changed, 1 insertion(+)
+file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
-         default:
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-             gen_a64_set_pc_im(dc->pc);
+         break;
-             /* fall through */
+     case 0x3: /* FSQRT */
-+        case DISAS_EXIT:
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
-         case DISAS_JUMP:
++        fpst = get_fpstatus_ptr(true);
-             if (dc->base.singlestep_enabled) {
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
-                 gen_exception_internal(EXCP_DEBUG);
+         break;
      case 0x8: /* FRINTN */
      case 0x9: /* FRINTP */
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 09/18] xlnx-zcu102: Manually create the machines
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-In preperation for future work let's manually create the Xilnx machines.
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
 This will allow us to set properties for the machines in the future.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+  The block length is predefined to 512 bits
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 and "4.10.2 SD Status":
   The SD Status contains status bits that are related to the SD Memory Card
   proprietary features and may be used for future application-specific usage.
   The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ hw/sd/sd.c | 2 +-
-file changed, 67 insertions(+), 7 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/hw/sd/sd.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
- #include "qemu/log.h"
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+     }
- typedef struct XlnxZCU102 {
+     memset(&sd->data[17], 0, 47);
-+    MachineState parent_obj;
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-+
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
      XlnxZynqMPState soc;
      MemoryRegion ddr_ram;
  } XlnxZCU102;
 +#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
 +#define ZCU102_MACHINE(obj) \
 +    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
 +
 +#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
 +#define EP108_MACHINE(obj) \
 +    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
 +
  static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_zcu102_init(MachineState *machine)
 +static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
  {
 -    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
      int i;
      uint64_t ram_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
      arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
  }
--static void xlnx_ep108_machine_init(MachineClass *mc)
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 +static void xlnx_ep108_init(MachineState *machine)
 +{
 +    XlnxZCU102 *s = EP108_MACHINE(machine);
 +
 +    xlnx_zynqmp_init(s, machine);
 +}
 +
 +static void xlnx_ep108_machine_instance_init(Object *obj)
  {
 +}
 +
 +static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
      mc->desc = "Xilinx ZynqMP EP108 board";
 -    mc->init = xlnx_zcu102_init;
 +    mc->init = xlnx_ep108_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
  }
 -DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 +static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
 +    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
 +    .parent     = TYPE_MACHINE,
 +    .class_init = xlnx_ep108_machine_class_init,
 +    .instance_init = xlnx_ep108_machine_instance_init,
 +    .instance_size = sizeof(XlnxZCU102),
 +};
 -static void xlnx_zcu102_machine_init(MachineClass *mc)
 +static void xlnx_ep108_machine_init_register_types(void)
  {
 +    type_register_static(&xlnx_ep108_machine_init_typeinfo);
 +}
 +
 +static void xlnx_zcu102_init(MachineState *machine)
 +{
 +    XlnxZCU102 *s = ZCU102_MACHINE(machine);
 +
 +    xlnx_zynqmp_init(s, machine);
 +}
 +
 +static void xlnx_zcu102_machine_instance_init(Object *obj)
 +{
 +}
 +
 +static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
      mc->desc = "Xilinx ZynqMP ZCU102 board";
      mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
      mc->ignore_memory_transaction_failures = true;
  }
 -DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
 +static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
 +    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
 +    .parent     = TYPE_MACHINE,
 +    .class_init = xlnx_zcu102_machine_class_init,
 +    .instance_init = xlnx_zcu102_machine_instance_init,
 +    .instance_size = sizeof(XlnxZCU102),
 +};
 +
 +static void xlnx_zcu102_machine_init_register_types(void)
 +{
 +    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
 +}
 +
 +type_init(xlnx_zcu102_machine_init_register_types)
 +type_init(xlnx_ep108_machine_init_register_types)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-In do_v7m_exception_exit(), there's no need to force the high 4
+Usually the logging of the CPU state produced by -d cpu is sufficient
-bits of 'type' to 1 when calling v7m_exception_taken(), because
+to diagnose problems, but sometimes you want to see the state of
-we know that they're always 1 or we could not have got to this
+the floating point registers as well. We don't want to enable that
-"handle return to magic exception return address" code. Remove
+by default as it adds a lot of extra data to the log; instead,
-the unnecessary ORs.
+allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 4 ++--
+ include/qemu/log.h   | 1 +
-file changed, 2 insertions(+), 2 deletions(-)
+ accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/qemu/log.h
-+++ b/target/arm/helper.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
-          */
+ #define CPU_LOG_PAGE       (1 << 14)
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
--        v7m_exception_taken(cpu, type | 0xf0000000);
++#define CPU_LOG_TB_FPU     (1 << 17)
-+        v7m_exception_taken(cpu, type);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+ /* Lock output for a series of related logs.  Since this is not needed
-                       "stackframe: failed exception return integrity check\n");
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-         return;
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+index XXXXXXX..XXXXXXX 100644
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+--- a/accel/tcg/cpu-exec.c
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
++++ b/accel/tcg/cpu-exec.c
-         v7m_push_stack(cpu);
+@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
--        v7m_exception_taken(cpu, type | 0xf0000000);
+     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-+        v7m_exception_taken(cpu, type);
+         && qemu_log_in_addr_range(itb->pc)) {
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
+         qemu_log_lock();
-                       "failed exception return integrity check\n");
++        int flags = 0;
-         return;
++        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.7.4
+.17.0

ARM queue: nothing particularly exciting, but 18 patches
is enough to send out.

thanks
-- PMM

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

----------------------------------------------------------------
Alistair Francis (5):
      xlnx-ep108: Rename to ZCU102
      xlnx-zcu102: Manually create the machines
      xlnx-zcu102: Add a machine level secure property
      xlnx-zcu102: Add a machine level virtualization property
      xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):
      AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):
      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
      target/arm: Get PRECISERR and IBUSERR the right way round
      nvic: Don't apply group priority mask to negative priorities
      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
      target/arm: Add and use defines for EXCRET constants
      target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
      mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):
      hw/pci-host/gpex: Set INTx index/gsi mapping
      hw/arm/virt: Set INTx/gsi mapping
      hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):
      target/arm: Avoid an extra temporary for store_exclusive

Use a symbolic constant M_REG_NUM_BANKS for the array size for
registers which are banked by M profile security state, rather
than hardcoding lots of 2s.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
  * accessed via env->registerfield[env->v7m.secure] (whether the security
  * extension is implemented or not).
  */
-#define M_REG_NS 0
-#define M_REG_S 1
+enum {
+    M_REG_NS = 0,
+    M_REG_S = 1,
+    M_REG_NUM_BANKS = 2,
+};
 
 /* ARM-specific interrupt pending bits.  */
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t other_sp;
         uint32_t other_ss_msp;
         uint32_t other_ss_psp;
-        uint32_t vecbase[2];
-        uint32_t basepri[2];
-        uint32_t control[2];
-        uint32_t ccr[2]; /* Configuration and Control */
-        uint32_t cfsr[2]; /* Configurable Fault Status */
+        uint32_t vecbase[M_REG_NUM_BANKS];
+        uint32_t basepri[M_REG_NUM_BANKS];
+        uint32_t control[M_REG_NUM_BANKS];
+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
-        uint32_t mmfar[2]; /* MemManage Fault Address */
+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
-        unsigned mpu_ctrl[2]; /* MPU_CTRL */
+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
-        uint32_t primask[2];
-        uint32_t faultmask[2];
+        uint32_t primask[M_REG_NUM_BANKS];
+        uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
-        uint32_t rnr[2];
+        uint32_t rnr[M_REG_NUM_BANKS];
     } pmsav7;
 
     /* PMSAv8 MPU */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          *  pmsav7.rnr (region number register)
          *  pmsav7_dregion (number of configured regions)
          */
-        uint32_t *rbar[2];
-        uint32_t *rlar[2];
-        uint32_t mair0[2];
-        uint32_t mair1[2];
+        uint32_t *rbar[M_REG_NUM_BANKS];
+        uint32_t *rlar[M_REG_NUM_BANKS];
+        uint32_t mair0[M_REG_NUM_BANKS];
+        uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
     void *nvic;
-- 
2.7.4

For M profile we must clear the exclusive monitor on reset, exception
entry and exception exit.  We weren't doing any of these things; fix
this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/cpu.c       |  6 ++++++
 target/arm/helper.c    |  2 ++
 target/arm/op_helper.c |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
 #endif
 
 /**
+ * arm_clear_exclusive: clear the exclusive monitor
+ * @env: CPU env
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+ */
+static inline void arm_clear_exclusive(CPUARMState *env)
+{
+    env->exclusive_addr = -1;
+}
+
+/**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->regs[15] = 0xFFFF0000;
     }
 
+    /* M profile requires that reset clears the exclusive monitor;
+     * A profile does not, but clearing it makes more sense than having it
+     * set with an exclusive access on address zero.
+     */
+    arm_clear_exclusive(env);
+
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 
     armv7m_nvic_acknowledge_irq(env->nvic);
     switch_v7m_sp(env, 0);
+    arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     }
 
     /* Otherwise, we have a successful exception exit. */
+    arm_clear_exclusive(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
 
     aarch64_save_sp(env, cur_el);
 
-    env->exclusive_addr = -1;
+    arm_clear_exclusive(env);
 
     /* We must squash the PSTATE.SS bit to zero unless both of the
      * following hold:
-- 
2.7.4

For a bus fault, the M profile BFSR bit PRECISERR means a bus
fault on a data access, and IBUSERR means a bus fault on an
instruction access. We had these the wrong way around; fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
-                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
-                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
                 break;
             case EXCP_DATA_ABORT:
                 env->v7m.cfsr[M_REG_NS] |=
-                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
                 env->v7m.bfar = env->exception.vaddress;
                 qemu_log_mask(CPU_LOG_INT,
-                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
                               env->v7m.bfar);
                 break;
             }
-- 
2.7.4

In several places we were unconditionally applying the
nvic_gprio_mask() to a priority value. This is incorrect
if the priority is one of the fixed negative priority
values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be
considered as the same priority and so NMI wouldn't
correctly preempt HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
         }
     }
 
+    if (active_prio > 0) {
+        active_prio &= nvic_gprio_mask(s);
+    }
+
     s->vectpending = pend_irq;
-    s->exception_prio = active_prio & nvic_gprio_mask(s);
+    s->exception_prio = active_prio;
 
     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
 }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     assert(vec->enabled);
     assert(vec->pending);
 
-    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    pendgroupprio = vec->prio;
+    if (pendgroupprio > 0) {
+        pendgroupprio &= nvic_gprio_mask(s);
+    }
     assert(pendgroupprio < running);
 
     trace_nvic_acknowledge_irq(pending, vec->prio);
-- 
2.7.4

In do_v7m_exception_exit(), there's no need to force the high 4
bits of 'type' to 1 when calling v7m_exception_taken(), because
we know that they're always 1 or we could not have got to this
"handle return to magic exception return address" code. Remove
the unnecessary ORs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

The exception-return magic values get some new bits in v8M, which
makes some bit definitions for them worthwhile.

We don't use the bit definitions for the switch on the low bits
which checks the return type for v7M, because this is defined
in the v7M ARM ARM as a set of valid values rather than via
per-bit checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 14 +++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
 
+/* Bit definitions for v7M exception return payload */
+FIELD(V7M_EXCRET, ES, 0, 1)
+FIELD(V7M_EXCRET, RES0, 1, 1)
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+FIELD(V7M_EXCRET, MODE, 3, 1)
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+FIELD(V7M_EXCRET, DCRS, 5, 1)
+FIELD(V7M_EXCRET, S, 6, 1)
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                   " previous exception %d\n",
                   type, env->v7m.exception);
 
-    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
     }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & 1;
+            int es = type & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = 0xfffffff1;
+    lr = R_V7M_EXCRET_RES1_MASK |
+        R_V7M_EXCRET_S_MASK |
+        R_V7M_EXCRET_DCRS_MASK |
+        R_V7M_EXCRET_FTYPE_MASK |
+        R_V7M_EXCRET_ES_MASK;
     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= 4;
+        lr |= R_V7M_EXCRET_SPSEL_MASK;
     }
     if (!arm_v7m_is_handler_mode(env)) {
-        lr |= 8;
+        lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-- 
2.7.4

In the v7M and v8M ARM ARM, the magic exception return values are
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
constants to define bits within them. Rename the 'type' variable
which holds the exception return value in do_v7m_exception_exit()
to excret, making it clearer that it does hold an EXC_RETURN value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t type;
+    uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
     bool return_to_sp_process = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * the target value up between env->regs[15] and env->thumb in
      * gen_bx(). Reconstitute it.
      */
-    type = env->regs[15];
+    excret = env->regs[15];
     if (env->thumb) {
-        type |= 1;
+        excret |= 1;
     }
 
     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
                   " previous exception %d\n",
-                  type, env->v7m.exception);
+                  excret, env->v7m.exception);
 
-    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
+                      excret);
     }
 
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & R_V7M_EXCRET_ES_MASK;
+            int es = excret & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
-    switch (type & 0xf) {
+    switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
         break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-     * exception return type specified then this is a UsageFault.
+     * exception return excret specified then this is a UsageFault.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
         /* Take an INVPC UsageFault by pushing the stack again. */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is a early access development board. Now that silicon is in
production people have access to the ZCU102. Let's rename the internal
QEMU files and variables to use the ZCU102.

There is no functional change here as the EP108 is still a valid board
option.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                   |  2 +-
 hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
similarity index 85%
rename from hw/arm/xlnx-ep108.c
rename to hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-ep108.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 /*
- * Xilinx ZynqMP EP108 board
+ * Xilinx ZynqMP ZCU102 board
  *
  * Copyright (C) 2015 Xilinx Inc
  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 
-typedef struct XlnxEP108 {
+typedef struct XlnxZCU102 {
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
-} XlnxEP108;
+} XlnxZCU102;
 
-static struct arm_boot_info xlnx_ep108_binfo;
+static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_ep108_init(MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
-    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
     }
 
     if (ram_size < 0x08000000) {
-        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                  ram_size);
     }
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
     /* TODO create and connect IDE devices for ide_drive_get() */
 
-    xlnx_ep108_binfo.ram_size = ram_size;
-    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
-    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
-    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
-    xlnx_ep108_binfo.loader_start = 0;
-    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
+    xlnx_zcu102_binfo.ram_size = ram_size;
+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+    xlnx_zcu102_binfo.loader_start = 0;
+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
 static void xlnx_ep108_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 static void xlnx_zcu102_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP ZCU102 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

In preperation for future work let's manually create the Xilnx machines.
This will allow us to set properties for the machines in the future.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 typedef struct XlnxZCU102 {
+    MachineState parent_obj;
+
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
 } XlnxZCU102;
 
+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+#define ZCU102_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+
+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+#define EP108_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+
 static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_zcu102_init(MachineState *machine)
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
-    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_machine_init(MachineClass *mc)
+static void xlnx_ep108_init(MachineState *machine)
+{
+    XlnxZCU102 *s = EP108_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+}
+
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_zcu102_init;
+    mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_ep108_machine_class_init,
+    .instance_init = xlnx_ep108_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
 
-static void xlnx_zcu102_machine_init(MachineClass *mc)
+static void xlnx_ep108_machine_init_register_types(void)
 {
+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+}
+
+static void xlnx_zcu102_init(MachineState *machine)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_zcu102_machine_instance_init(Object *obj)
+{
+}
+
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP ZCU102 board";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_zcu102_machine_class_init,
+    .instance_init = xlnx_zcu102_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
+
+static void xlnx_zcu102_machine_init_register_types(void)
+{
+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
+}
+
+type_init(xlnx_zcu102_machine_init_register_types)
+type_init(xlnx_ep108_machine_init_register_types)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level secure property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,secure=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
+
+    bool secure;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
 static struct arm_boot_info xlnx_zcu102_binfo;
 
+static bool zcu102_get_secure(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->secure;
+}
+
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->secure = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 
     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
                          "ddr-ram", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
 static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = EP108_MACHINE(obj);
+
+    /* EP108, we don't support setting secure */
+    s->secure = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
 
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    /* Default to secure mode being disabled */
+    s->secure = false;
+    object_property_add_bool(obj, "secure", zcu102_get_secure,
+                             zcu102_set_secure, NULL);
+    object_property_set_description(obj, "secure",
+                                    "Set on/off to enable/disable the ARM "
+                                    "Security Extensions (TrustZone)",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level virtualization property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,virtualization=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
 hw/arm/xlnx-zynqmp.c         |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
 
     /* Has the ARM Security extensions?  */
     bool secure;
+    /* Has the ARM Virtualization extensions?  */
+    bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
 }  XlnxZynqMPState;
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
     MemoryRegion ddr_ram;
 
     bool secure;
+    bool virt;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
     s->secure = value;
 }
 
+static bool zcu102_get_virt(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->virt;
+}
+
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->virt = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
                          "ddr-ram", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
                              &error_fatal);
+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = EP108_MACHINE(obj);
 
-    /* EP108, we don't support setting secure */
+    /* EP108, we don't support setting secure or virt */
     s->secure = false;
+    s->virt = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                     "Set on/off to enable/disable the ARM "
                                     "Security Extensions (TrustZone)",
                                     NULL);
+
+    /* Default to virt (EL2) being disabled */
+    s->virt = false;
+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+                             zcu102_set_virt, NULL);
+    object_property_set_description(obj, "virtualization",
+                                    "Set on/off to enable/disable emulating a "
+                                    "guest CPU which implements the ARM "
+                                    "Virtualization Extensions",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                  s->secure, "has_el3", NULL);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                 false, "has_el2", NULL);
+                                 s->virt, "has_el2", NULL);
         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-- 
2.7.4

From: Jaroslaw Pelczar <j.pelczar@samsung.com>

Previously when single stepping through ERET instruction via GDB
would result in debugger entering the "next" PC after ERET instruction.
When debugging in kernel mode, this will also cause unintended behavior,
because debugger will try to access memory from EL0 point of view.

Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         default:
             gen_a64_set_pc_im(dc->pc);
             /* fall through */
+        case DISAS_EXIT:
         case DISAS_JUMP:
             if (dc->base.singlestep_enabled) {
                 gen_exception_internal(EXCP_DEBUG);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
 }
 
 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-                                TCGv_i64 inaddr, int size, int is_pair)
+                                TCGv_i64 addr, int size, int is_pair)
 {
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      */
     TCGLabel *fail_label = gen_new_label();
     TCGLabel *done_label = gen_new_label();
-    TCGv_i64 addr = tcg_temp_local_new_i64();
     TCGv_i64 tmp;
 
-    /* Copy input into a local temp so it is not trashed when the
-     * basic block ends at the branch insn.
-     */
-    tcg_gen_mov_i64(addr, inaddr);
     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
             } else {
                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
             }
-            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
+                                       cpu_exclusive_val, tmp,
                                        get_mem_index(s),
                                        MO_64 | MO_ALIGN | s->be_data);
             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
         } else if (s->be_data == MO_LE) {
-            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         } else {
-            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         }
     } else {
-        TCGv_i64 val = cpu_reg(s, rt);
-        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
-                                   get_mem_index(s),
+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+                                   cpu_reg(s, rt), get_mem_index(s),
                                    size | MO_ALIGN | s->be_data);
         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
     }
-
-    tcg_temp_free_i64(addr);
-
     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
     tcg_temp_free_i64(tmp);
     tcg_gen_br(done_label);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/pci-host/gpex.h |  3 +++
 hw/pci-host/gpex.c         | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
     MemoryRegion io_ioport;
     MemoryRegion io_mmio;
     qemu_irq irq[GPEX_NUM_IRQS];
+    int irq_num[GPEX_NUM_IRQS];
 } GPEXHost;
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(s->irq[irq_num], level);
 }
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+    if (index >= GPEX_NUM_IRQS) {
+        return -EINVAL;
+    }
+
+    s->irq_num[index] = gsi;
+    return 0;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
     }
 
     pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/gpex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
     return 0;
 }
 
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+    PCIINTxRoute route;
+    GPEXHost *s = opaque;
+
+    route.mode = PCI_INTX_ENABLED;
+    route.irq = s->irq_num[pin];
+
+    return route;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
 
     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
     qdev_init_nofail(DEVICE(&s->gpex_root));
 }
 
-- 
2.7.4

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
             cmsdk_apb_uart_create(uartbase[i],
                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, 0),
-                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, i * 2),
+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                   NULL,
                                   uartchr, SYSCLK_FRQ);
         }
-- 
2.7.4

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0