Series comparison

-[Qemu-devel] [PULL 00/18] target-arm queue
+[Qemu-devel] [PULL 00/27] target-arm queue
-ARM queue: nothing particularly exciting, but 18 patches
+The following changes since commit 0d3e41d5efd638a0c5682f6813b26448c3c51624:
 is enough to send out.
-thanks
+  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-02-14 17:42:25 +0000)
 -- PMM
-The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190214
-are available in the git repository at:
+for you to fetch changes up to 497bc12b1b374ecd62903bf062229bd93f8924af:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914
+  gdbstub: Send a reply to the vKill packet. (2019-02-14 18:45:49 +0000)
 for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:
   mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v7M: various code cleanups
+ * gdbstub: Send a reply to the vKill packet
- * v7M: set correct BFSR bits on bus fault
+ * Improve codegen for neon min/max and saturating arithmetic
- * v7M: clear exclusive monitor on reset and exception entry/exit
+ * Fix a bug in clearing FPSCR exception status bits
- * v7M: don't apply priority mask to negative priorities
+ * hw/arm/armsse: Fix miswiring of expansion IRQs
- * zcu102: support 'secure' and 'virtualization' machine properties
+ * hw/intc/armv7m_nvic: Allow byte accesses to SHPR1
- * aarch64: fix ERET single stepping
+ * MAINTAINERS: Remove Peter Crosthwaite from various entries
- * gpex: implement PCI INTx routing
+ * arm: Allow system registers for KVM guests to be changed by QEMU code
- * mps2-an511: fix UART overflow interrupt line wiring
+ * linux-user: support HWCAP_CPUID which exposes ID registers to user code
  * Fix bug in 128-bit cmpxchg for BE Arm guests
  * Implement (no-op) HACR_EL2
  * Fix CRn to be 14 for PMEVTYPER/PMEVCNTR
 ----------------------------------------------------------------
-Alistair Francis (5):
+Aaron Lindsay OS (1):
-      xlnx-ep108: Rename to ZCU102
+      target/arm: Fix CRn to be 14 for PMEVTYPER/PMEVCNTR
       xlnx-zcu102: Manually create the machines
       xlnx-zcu102: Add a machine level secure property
       xlnx-zcu102: Add a machine level virtualization property
       xlnx-zcu102: Mark the EP108 machine as deprecated
-Jaroslaw Pelczar (1):
+Alex Bennée (5):
-      AArch64: Fix single stepping of ERET instruction
+      target/arm: relax permission checks for HWCAP_CPUID registers
       target/arm: expose CPUID registers to userspace
       target/arm: expose MPIDR_EL1 to userspace
       target/arm: expose remaining CPUID registers as RAZ
       linux-user/elfload: enable HWCAP_CPUID for AArch64
-Peter Maydell (8):
+Catherine Ho (1):
-      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+      target/arm: Fix int128_make128 lo, hi order in paired_cmpxchg64_be
       target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
       target/arm: Get PRECISERR and IBUSERR the right way round
       nvic: Don't apply group priority mask to negative priorities
       target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
       target/arm: Add and use defines for EXCRET constants
       target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
       mps2-an511: Fix wiring of UART overflow interrupt lines
-Pranavkumar Sawargaonkar (3):
+Peter Maydell (5):
-      hw/pci-host/gpex: Set INTx index/gsi mapping
+      target/arm: Implement HACR_EL2
-      hw/arm/virt: Set INTx/gsi mapping
+      arm: Allow system registers for KVM guests to be changed by QEMU code
-      hw/pci-host/gpex: Implement PCI INTx routing
+      MAINTAINERS: Remove Peter Crosthwaite from various entries
       hw/intc/armv7m_nvic: Allow byte accesses to SHPR1
       hw/arm/armsse: Fix miswiring of expansion IRQs
-Richard Henderson (1):
+Richard Henderson (14):
-      target/arm: Avoid an extra temporary for store_exclusive
+      target/arm: Force result size into dp after operation
       target/arm: Restructure disas_fp_int_conv
       target/arm: Rely on optimization within tcg_gen_gvec_or
       target/arm: Use vector minmax expanders for aarch64
       target/arm: Use vector minmax expanders for aarch32
       target/arm: Use tcg integer min/max primitives for neon
       target/arm: Remove neon min/max helpers
       target/arm: Fix vfp_gdb_get/set_reg vs FPSCR
       target/arm: Fix arm_cpu_dump_state vs FPSCR
       target/arm: Split out flags setting from vfp compares
       target/arm: Fix set of bits kept in xregs[ARM_VFP_FPSCR]
       target/arm: Split out FPSCR.QC to a vector field
       target/arm: Use vector operations for saturation
       target/arm: Add missing clear_tail calls
- hw/arm/Makefile.objs         |   2 +-
+Sandra Loosemore (1):
- include/hw/arm/xlnx-zynqmp.h |   2 +
+      gdbstub: Send a reply to the vKill packet.
  include/hw/pci-host/gpex.h   |   3 +
  target/arm/cpu.h             |  35 +++---
  target/arm/internals.h       |  20 ++++
  hw/arm/mps2.c                |   4 +-
  hw/arm/virt.c                |   1 +
  hw/arm/xlnx-ep108.c          | 139 -----------------------
  hw/arm/xlnx-zcu102.c         | 259 +++++++++++++++++++++++++++++++++++++++++++
  hw/arm/xlnx-zynqmp.c         |   3 +-
  hw/intc/armv7m_nvic.c        |  11 +-
  hw/pci-host/gpex.c           |  22 ++++
  target/arm/cpu.c             |   6 +
  target/arm/helper.c          |  43 ++++---
  target/arm/op_helper.c       |   2 +-
  target/arm/translate-a64.c   |  27 ++---
 files changed, 382 insertions(+), 197 deletions(-)
  delete mode 100644 hw/arm/xlnx-ep108.c
  create mode 100644 hw/arm/xlnx-zcu102.c
+ target/arm/cpu.h           |  50 ++++++++-
+ target/arm/helper.h        |  45 +++++---
+ target/arm/translate.h     |   4 +
+ gdbstub.c                  |   1 +
+ hw/arm/armsse.c            |   2 +-
+ hw/intc/armv7m_nvic.c      |   4 +-
+ linux-user/elfload.c       |   1 +
+ target/arm/helper-a64.c    |   4 +-
+ target/arm/helper.c        | 228 ++++++++++++++++++++++++++++++++--------
+ target/arm/kvm32.c         |  20 +---
+ target/arm/kvm64.c         |   2 +
+ target/arm/machine.c       |   2 +-
+ target/arm/neon_helper.c   |  14 +--
+ target/arm/translate-a64.c | 171 +++++++++++++++---------------
+ target/arm/translate-sve.c |   6 +-
+ target/arm/translate.c     | 251 ++++++++++++++++++++++++++++++++++-----------
+ target/arm/vec_helper.c    | 134 +++++++++++++++++++++++-
+ MAINTAINERS                |   4 -
+files changed, 687 insertions(+), 256 deletions(-)

-[Qemu-devel] [PULL 03/18] target/arm: Get PRECISERR and IBUSERR the right way round
+[Qemu-devel] [PULL 01/27] target/arm: Fix CRn to be 14 for PMEVTYPER/PMEVCNTR
-For a bus fault, the M profile BFSR bit PRECISERR means a bus
+From: Aaron Lindsay OS <aaron@os.amperecomputing.com>
 fault on a data access, and IBUSERR means a bus fault on an
 instruction access. We had these the wrong way around; fix this.
+This bug was introduced in:
+    commit 5ecdd3e47cadae83a62dc92b472f1fe163b56f59
+    target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER
+Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
+Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+Message-id: 20190205135129.19338-1-aaron@os.amperecomputing.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
 ---
  target/arm/helper.c | 8 ++++----
 file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         case 0x8: /* External Abort */
+             char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
-             switch (cs->exception_index) {
+             char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
-             case EXCP_PREFETCH_ABORT:
+             ARMCPRegInfo pmev_regs[] = {
--                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
+-                { .name = pmevcntr_name, .cp = 15, .crn = 15,
--                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
++                { .name = pmevcntr_name, .cp = 15, .crn = 14,
-+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                   .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
-+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
+                   .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
-                 break;
+                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-             case EXCP_DATA_ABORT:
+                   .accessfn = pmreg_access },
-                 env->v7m.cfsr[M_REG_NS] |=
+                 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
--                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+-                  .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 8 | (3 & (i >> 3)),
-+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
++                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
-                 env->v7m.bfar = env->exception.vaddress;
+                   .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
-                 qemu_log_mask(CPU_LOG_INT,
+                   .type = ARM_CP_IO,
--                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
-+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
+                   .raw_readfn = pmevcntr_rawread,
-                               env->v7m.bfar);
+                   .raw_writefn = pmevcntr_rawwrite },
-                 break;
+-                { .name = pmevtyper_name, .cp = 15, .crn = 15,
-             }
++                { .name = pmevtyper_name, .cp = 15, .crn = 14,
                    .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
                    .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
                    .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
                    .accessfn = pmreg_access },
                  { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
 -                  .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 12 | (3 & (i >> 3)),
 +                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
                    .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
                    .type = ARM_CP_IO,
                    .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 02/27] target/arm: Implement HACR_EL2
+HACR_EL2 is a register with IMPDEF behaviour, which allows
+implementation specific trapping to EL2. Implement it as RAZ/WI,
+since QEMU's implementation has no extra traps. This also
+matches what h/w implementations like Cortex-A53 and A57 do.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190205181218.8995-1-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 6 ++++++
+file changed, 6 insertions(+)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL2_RW,
+       .type = ARM_CP_CONST, .resetvalue = 0 },
++    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
++      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
+       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
+       .access = PL2_RW,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
+       .writefn = hcr_writelow },
++    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
++      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
+       .type = ARM_CP_ALIAS,
+       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
+--
+.20.1

-[Qemu-devel] [PULL 18/18] mps2-an511: Fix wiring of UART overflow interrupt lines
+[Qemu-devel] [PULL 03/27] target/arm: Fix int128_make128 lo, hi order in paired_cmpxchg64_be
-Fix an error that meant we were wiring every UART's overflow
+From: Catherine Ho <catherine.hecx@gmail.com>
 interrupts into the same inputs 0 and 1 of the OR gate,
 rather than giving each its own input.
-Cc: qemu-stable@nongnu.org
+The lo,hi order is different from the comments. And in commit
 ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128"), it changes
 the original code logic. So just restore the old code logic before this
 commit:
 do_paired_cmpxchg64_be():
     cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
     newv = int128_make128(new_hi, new_lo);
 This fixes a bug that would only be visible for big-endian
 AArch64 guest code.
 Fixes: 1ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128")
 Signed-off-by: Catherine Ho <catherine.hecx@gmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1548985244-24523-1-git-send-email-catherine.hecx@gmail.com
 [PMM: added note that bug only affects BE guests]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
 ---
- hw/arm/mps2.c | 4 ++--
+ target/arm/helper-a64.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
+--- a/target/arm/helper-a64.c
-+++ b/hw/arm/mps2.c
++++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(paired_cmpxchg64_be)(CPUARMState *env, uint64_t addr,
-             cmsdk_apb_uart_create(uartbase[i],
+      * High and low need to be switched here because this is not actually a
-                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
+      * 128bit store but two doublewords stored consecutively
-                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
+      */
--                                  qdev_get_gpio_in(orgate_dev, 0),
+-    Int128 cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
--                                  qdev_get_gpio_in(orgate_dev, 1),
+-    Int128 newv = int128_make128(new_lo, new_hi);
-+                                  qdev_get_gpio_in(orgate_dev, i * 2),
++    Int128 cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
-+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
++    Int128 newv = int128_make128(new_hi, new_lo);
-                                   NULL,
+     Int128 oldv;
-                                   uartchr, SYSCLK_FRQ);
+     uintptr_t ra = GETPC();
-         }
+     uint64_t o0, o1;
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 04/27] target/arm: Force result size into dp after operation
+From: Richard Henderson <richard.henderson@linaro.org>
+Rather than a complex set of cases testing for writeback,
+adjust DP after performing the operation.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190206052857.5077-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 32 ++++++++++++++++----------------
+file changed, 16 insertions(+), 16 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+                         tcg_gen_or_i32(tmp, tmp, tmp2);
+                         tcg_temp_free_i32(tmp2);
+                         gen_vfp_msr(tmp);
++                        dp = 0; /* always a single precision result */
+                         break;
+                     }
+                     case 7: /* vcvtt.f16.f32, vcvtt.f16.f64 */
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+                         tcg_gen_or_i32(tmp, tmp, tmp2);
+                         tcg_temp_free_i32(tmp2);
+                         gen_vfp_msr(tmp);
++                        dp = 0; /* always a single precision result */
+                         break;
+                     }
+                     case 8: /* cmp */
+                         gen_vfp_cmp(dp);
++                        dp = -1; /* no write back */
+                         break;
+                     case 9: /* cmpe */
+                         gen_vfp_cmpe(dp);
++                        dp = -1; /* no write back */
+                         break;
+                     case 10: /* cmpz */
+                         gen_vfp_cmp(dp);
++                        dp = -1; /* no write back */
+                         break;
+                     case 11: /* cmpez */
+                         gen_vfp_F1_ld0(dp);
+                         gen_vfp_cmpe(dp);
++                        dp = -1; /* no write back */
+                         break;
+                     case 12: /* vrintr */
+                     {
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+                         break;
+                     }
+                     case 15: /* single<->double conversion */
+-                        if (dp)
++                        if (dp) {
+                             gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
+-                        else
++                        } else {
+                             gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
++                        }
++                        dp = !dp; /* result size is opposite */
+                         break;
+                     case 16: /* fuito */
+                         gen_vfp_uito(dp, 0);
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+                         break;
+                     case 24: /* ftoui */
+                         gen_vfp_toui(dp, 0);
++                        dp = 0; /* always an integer result */
+                         break;
+                     case 25: /* ftouiz */
+                         gen_vfp_touiz(dp, 0);
++                        dp = 0; /* always an integer result */
+                         break;
+                     case 26: /* ftosi */
+                         gen_vfp_tosi(dp, 0);
++                        dp = 0; /* always an integer result */
+                         break;
+                     case 27: /* ftosiz */
+                         gen_vfp_tosiz(dp, 0);
++                        dp = 0; /* always an integer result */
+                         break;
+                     case 28: /* ftosh */
+                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+                     return 1;
+                 }
+-                /* Write back the result.  */
+-                if (op == 15 && (rn >= 8 && rn <= 11)) {
+-                    /* Comparison, do nothing.  */
+-                } else if (op == 15 && dp && ((rn & 0x1c) == 0x18 ||
+-                                              (rn & 0x1e) == 0x6)) {
+-                    /* VCVT double to int: always integer result.
+-                     * VCVT double to half precision is always a single
+-                     * precision result.
+-                     */
+-                    gen_mov_vreg_F0(0, rd);
+-                } else if (op == 15 && rn == 15) {
+-                    /* conversion */
+-                    gen_mov_vreg_F0(!dp, rd);
+-                } else {
++                /* Write back the result, if any.  */
++                if (dp >= 0) {
+                     gen_mov_vreg_F0(dp, rd);
+                 }
+--
+.20.1

-[Qemu-devel] [PULL 14/18] target/arm: Avoid an extra temporary for store_exclusive
+[Qemu-devel] [PULL 05/27] target/arm: Restructure disas_fp_int_conv
 From: Richard Henderson <richard.henderson@linaro.org>
-Instead of copying addr to a local temp, reuse the value (which we
+For opcodes 0-5, move some if conditions into the structure
-have just compared as equal) already saved in cpu_exclusive_addr.
+of a switch statement.  For opcodes 6 & 7, decode everything
 at once with a second switch.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20190206052857.5077-3-richard.henderson@linaro.org
-Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 26 +++++++++-----------------
+ target/arm/translate-a64.c | 94 ++++++++++++++++++++------------------
-file changed, 9 insertions(+), 17 deletions(-)
+file changed, 49 insertions(+), 45 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
      int type = extract32(insn, 22, 2);
      bool sbit = extract32(insn, 29, 1);
      bool sf = extract32(insn, 31, 1);
 +    bool itof = false;
      if (sbit) {
 -        unallocated_encoding(s);
 -        return;
 +        goto do_unallocated;
      }
 -    if (opcode > 5) {
 -        /* FMOV */
 -        bool itof = opcode & 1;
 -
 -        if (rmode >= 2) {
 -            unallocated_encoding(s);
 -            return;
 -        }
 -
 -        switch (sf << 3 | type << 1 | rmode) {
 -        case 0x0: /* 32 bit */
 -        case 0xa: /* 64 bit */
 -        case 0xd: /* 64 bit to top half of quad */
 -            break;
 -        case 0x6: /* 16-bit float, 32-bit int */
 -        case 0xe: /* 16-bit float, 64-bit int */
 -            if (dc_isar_feature(aa64_fp16, s)) {
 -                break;
 -            }
 -            /* fallthru */
 -        default:
 -            /* all other sf/type/rmode combinations are invalid */
 -            unallocated_encoding(s);
 -            return;
 -        }
 -
 -        if (!fp_access_check(s)) {
 -            return;
 -        }
 -        handle_fmov(s, rd, rn, type, itof);
 -    } else {
 -        /* actual FP conversions */
 -        bool itof = extract32(opcode, 1, 1);
 -
 -        if (rmode != 0 && opcode > 1) {
 -            unallocated_encoding(s);
 -            return;
 +    switch (opcode) {
 +    case 2: /* SCVTF */
 +    case 3: /* UCVTF */
 +        itof = true;
 +        /* fallthru */
 +    case 4: /* FCVTAS */
 +    case 5: /* FCVTAU */
 +        if (rmode != 0) {
 +            goto do_unallocated;
          }
 +        /* fallthru */
 +    case 0: /* FCVT[NPMZ]S */
 +    case 1: /* FCVT[NPMZ]U */
          switch (type) {
          case 0: /* float32 */
          case 1: /* float64 */
              break;
          case 3: /* float16 */
 -            if (dc_isar_feature(aa64_fp16, s)) {
 -                break;
 +            if (!dc_isar_feature(aa64_fp16, s)) {
 +                goto do_unallocated;
              }
 -            /* fallthru */
 +            break;
          default:
 -            unallocated_encoding(s);
 -            return;
 +            goto do_unallocated;
          }
 -
          if (!fp_access_check(s)) {
              return;
          }
          handle_fpfpcvt(s, rd, rn, opcode, itof, rmode, 64, sf, type);
 +        break;
 +
 +    default:
 +        switch (sf << 7 | type << 5 | rmode << 3 | opcode) {
 +        case 0b01100110: /* FMOV half <-> 32-bit int */
 +        case 0b01100111:
 +        case 0b11100110: /* FMOV half <-> 64-bit int */
 +        case 0b11100111:
 +            if (!dc_isar_feature(aa64_fp16, s)) {
 +                goto do_unallocated;
 +            }
 +            /* fallthru */
 +        case 0b00000110: /* FMOV 32-bit */
 +        case 0b00000111:
 +        case 0b10100110: /* FMOV 64-bit */
 +        case 0b10100111:
 +        case 0b11001110: /* FMOV top half of 128-bit */
 +        case 0b11001111:
 +            if (!fp_access_check(s)) {
 +                return;
 +            }
 +            itof = opcode & 1;
 +            handle_fmov(s, rd, rn, type, itof);
 +            break;
 +
 +        default:
 +        do_unallocated:
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        break;
      }
  }
- static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
--                                TCGv_i64 inaddr, int size, int is_pair)
-+                                TCGv_i64 addr, int size, int is_pair)
- {
-     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
-      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-      */
-     TCGLabel *fail_label = gen_new_label();
-     TCGLabel *done_label = gen_new_label();
--    TCGv_i64 addr = tcg_temp_local_new_i64();
-     TCGv_i64 tmp;
--    /* Copy input into a local temp so it is not trashed when the
--     * basic block ends at the branch insn.
--     */
--    tcg_gen_mov_i64(addr, inaddr);
-     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
-     tmp = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-             } else {
-                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
-             }
--            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
-+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
-+                                       cpu_exclusive_val, tmp,
-                                        get_mem_index(s),
-                                        MO_64 | MO_ALIGN | s->be_data);
-             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
-         } else if (s->be_data == MO_LE) {
--            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
--                                           cpu_reg(s, rt2));
-+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
-+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
-         } else {
--            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
--                                           cpu_reg(s, rt2));
-+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
-+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
-         }
-     } else {
--        TCGv_i64 val = cpu_reg(s, rt);
--        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
--                                   get_mem_index(s),
-+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
-+                                   cpu_reg(s, rt), get_mem_index(s),
-                                    size | MO_ALIGN | s->be_data);
-         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
-     }
--
--    tcg_temp_free_i64(addr);
--
-     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
-     tcg_temp_free_i64(tmp);
-     tcg_gen_br(done_label);
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 06/27] target/arm: relax permission checks for HWCAP_CPUID registers
+From: Alex Bennée <alex.bennee@linaro.org>
+Although technically not visible to userspace the kernel does make
+them visible via a trap and emulate ABI. We provide a new permission
+mask (PL0U_R) which maps to PL0_R for CONFIG_USER builds and adjust
+the minimum permission check accordingly.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190205190224.2198-2-alex.bennee@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    | 12 ++++++++++++
+ target/arm/helper.c |  6 +++++-
+files changed, 17 insertions(+), 1 deletion(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool cptype_valid(int cptype)
+ #define PL0_R (0x02 | PL1_R)
+ #define PL0_W (0x01 | PL1_W)
++/*
++ * For user-mode some registers are accessible to EL0 via a kernel
++ * trap-and-emulate ABI. In this case we define the read permissions
++ * as actually being PL0_R. However some bits of any given register
++ * may still be masked.
++ */
++#ifdef CONFIG_USER_ONLY
++#define PL0U_R PL0_R
++#else
++#define PL0U_R PL1_R
++#endif
++
+ #define PL3_RW (PL3_R | PL3_W)
+ #define PL2_RW (PL2_R | PL2_W)
+ #define PL1_RW (PL1_R | PL1_W)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
+     if (r->state != ARM_CP_STATE_AA32) {
+         int mask = 0;
+         switch (r->opc1) {
+-        case 0: case 1: case 2:
++        case 0:
++            /* min_EL EL1, but some accessible to EL0 via kernel ABI */
++            mask = PL0U_R | PL1_RW;
++            break;
++        case 1: case 2:
+             /* min_EL EL1 */
+             mask = PL1_RW;
+             break;
+--
+.20.1

-[Qemu-devel] [PULL 15/18] hw/pci-host/gpex: Set INTx index/gsi mapping
+[Qemu-devel] [PULL 07/27] target/arm: expose CPUID registers to userspace
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-To implement INTx to gsi routing we need to pass the gpex host
+A number of CPUID registers are exposed to userspace by modern Linux
-bridge the gsi associated to each INTx index. Let's introduce
+kernels thanks to the "ARM64 CPU Feature Registers" ABI. For QEMU's
-irq_num array and gpex_set_irq_num setter function.
+user-mode emulation we don't need to emulate the kernels trap but just
 return the value the trap would have done. To avoid too much #ifdef
 hackery we process ARMCPRegInfo with a new helper (modify_arm_cp_regs)
 before defining the registers. The modify routine is driven by a
 simple data structure which describes which bits are exported and
 which are fixed.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+Message-id: 20190205190224.2198-3-alex.bennee@linaro.org
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Tested-by: Feng Kan <fkan@apm.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/pci-host/gpex.h |  3 +++
+ target/arm/cpu.h    | 21 ++++++++++++++++
- hw/pci-host/gpex.c         | 10 ++++++++++
+ target/arm/helper.c | 59 +++++++++++++++++++++++++++++++++++++++++++++
-files changed, 13 insertions(+)
+files changed, 80 insertions(+)
-diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci-host/gpex.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/pci-host/gpex.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
+@@ -XXX,XX +XXX,XX @@ static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
-     MemoryRegion io_ioport;
+ }
-     MemoryRegion io_mmio;
+ const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
-     qemu_irq irq[GPEX_NUM_IRQS];
-+    int irq_num[GPEX_NUM_IRQS];
++/*
- } GPEXHost;
++ * Definition of an ARM co-processor register as viewed from
++ * userspace. This is used for presenting sanitised versions of
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
++ * registers to userspace when emulating the Linux AArch64 CPU
 + * ID/feature ABI (advertised as HWCAP_CPUID).
 + */
 +typedef struct ARMCPRegUserSpaceInfo {
 +    /* Name of register */
 +    const char *name;
 +
- #endif /* HW_GPEX_H */
++    /* Only some bits are exported to user space */
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
++    uint64_t exported_bits;
 +
 +    /* Fixed bits are applied after the mask */
 +    uint64_t fixed_bits;
 +} ARMCPRegUserSpaceInfo;
 +
 +#define REGUSERINFO_SENTINEL { .name = NULL }
 +
 +void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
 +
  /* CPWriteFn that can be used to implement writes-ignored behaviour */
  void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
                           uint64_t value);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
+--- a/target/arm/helper.c
-+++ b/hw/pci-host/gpex.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-     qemu_set_irq(s->irq[irq_num], level);
+               .resetvalue = cpu->pmceid1 },
              REGINFO_SENTINEL
          };
 +#ifdef CONFIG_USER_ONLY
 +        ARMCPRegUserSpaceInfo v8_user_idregs[] = {
 +            { .name = "ID_AA64PFR0_EL1",
 +              .exported_bits = 0x000f000f00ff0000,
 +              .fixed_bits    = 0x0000000000000011 },
 +            { .name = "ID_AA64PFR1_EL1",
 +              .exported_bits = 0x00000000000000f0 },
 +            { .name = "ID_AA64ZFR0_EL1"           },
 +            { .name = "ID_AA64MMFR0_EL1",
 +              .fixed_bits    = 0x00000000ff000000 },
 +            { .name = "ID_AA64MMFR1_EL1"          },
 +            { .name = "ID_AA64DFR0_EL1",
 +              .fixed_bits    = 0x0000000000000006 },
 +            { .name = "ID_AA64DFR1_EL1"           },
 +            { .name = "ID_AA64AFR0_EL1"           },
 +            { .name = "ID_AA64AFR1_EL1"           },
 +            { .name = "ID_AA64ISAR0_EL1",
 +              .exported_bits = 0x00fffffff0fffff0 },
 +            { .name = "ID_AA64ISAR1_EL1",
 +              .exported_bits = 0x000000f0ffffffff },
 +            REGUSERINFO_SENTINEL
 +        };
 +        modify_arm_cp_regs(v8_idregs, v8_user_idregs);
 +#endif
          /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
          if (!arm_feature(env, ARM_FEATURE_EL3) &&
              !arm_feature(env, ARM_FEATURE_EL2)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
              .type = ARM_CP_NOP | ARM_CP_OVERRIDE
          };
 +#ifdef CONFIG_USER_ONLY
 +        ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
 +            { .name = "MIDR_EL1",
 +              .exported_bits = 0x00000000ffffffff },
 +            { .name = "REVIDR_EL1"                },
 +            REGUSERINFO_SENTINEL
 +        };
 +        modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
 +#endif
          if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
              arm_feature(env, ARM_FEATURE_STRONGARM)) {
              ARMCPRegInfo *r;
@@ -XXX,XX +XXX,XX @@ void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
      }
  }
-+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
++/*
 + * Modify ARMCPRegInfo for access from userspace.
 + *
 + * This is a data driven modification directed by
 + * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
 + * user-space cannot alter any values and dynamic values pertaining to
 + * execution state are hidden from user space view anyway.
 + */
 +void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
 +{
-+    if (index >= GPEX_NUM_IRQS) {
++    const ARMCPRegUserSpaceInfo *m;
-+        return -EINVAL;
++    ARMCPRegInfo *r;
 +
 +    for (m = mods; m->name; m++) {
 +        for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
 +            if (strcmp(r->name, m->name) == 0) {
 +                r->type = ARM_CP_CONST;
 +                r->access = PL0U_R;
 +                r->resetvalue &= m->exported_bits;
 +                r->resetvalue |= m->fixed_bits;
 +                break;
 +            }
 +        }
 +    }
-+
-+    s->irq_num[index] = gsi;
-+    return 0;
 +}
 +
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+ const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
  {
-     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+     return g_hash_table_lookup(cpregs, &encoded_cp);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 07/18] target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
+[Qemu-devel] [PULL 08/27] target/arm: expose MPIDR_EL1 to userspace
-In the v7M and v8M ARM ARM, the magic exception return values are
+From: Alex Bennée <alex.bennee@linaro.org>
 referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
 constants to define bits within them. Rename the 'type' variable
 which holds the exception return value in do_v7m_exception_exit()
 to excret, making it clearer that it does hold an EXC_RETURN value.
+As this is a single register we could expose it with a simple ifdef
+but we use the existing modify_arm_cp_regs mechanism for consistency.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190205190224.2198-4-alex.bennee@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 23 ++++++++++++-----------
+ target/arm/helper.c | 21 ++++++++++++++-------
-file changed, 12 insertions(+), 11 deletions(-)
+file changed, 14 insertions(+), 7 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
- static void do_v7m_exception_exit(ARMCPU *cpu)
+     return mpidr_read_val(env);
- {
+ }
-     CPUARMState *env = &cpu->env;
--    uint32_t type;
+-static const ARMCPRegInfo mpidr_cp_reginfo[] = {
-+    uint32_t excret;
+-    { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
-     uint32_t xpsr;
+-      .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
-     bool ufault = false;
+-      .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
-     bool return_to_sp_process = false;
+-    REGINFO_SENTINEL
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+-};
-      * the target value up between env->regs[15] and env->thumb in
+-
-      * gen_bx(). Reconstitute it.
+ static const ARMCPRegInfo lpae_cp_reginfo[] = {
-      */
+     /* NOP AMAIR0/1 */
--    type = env->regs[15];
+     { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
-+    excret = env->regs[15];
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (env->thumb) {
 -        type |= 1;
 +        excret |= 1;
      }
-     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
+     if (arm_feature(env, ARM_FEATURE_MPIDR)) {
-                   " previous exception %d\n",
++        ARMCPRegInfo mpidr_cp_reginfo[] = {
--                  type, env->v7m.exception);
++            { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
-+                  excret, env->v7m.exception);
++              .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
++              .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
--    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++            REGINFO_SENTINEL
-+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++        };
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
++#ifdef CONFIG_USER_ONLY
--                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
++        ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
-+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
++            { .name = "MPIDR_EL1",
-+                      excret);
++              .fixed_bits = 0x0000000080000000 },
 +            REGUSERINFO_SENTINEL
 +        };
 +        modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
 +#endif
          define_arm_cp_regs(cpu, mpidr_cp_reginfo);
      }
-     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
-          */
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
--            int es = type & R_V7M_EXCRET_ES_MASK;
-+            int es = excret & R_V7M_EXCRET_ES_MASK;
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
-                 env->v7m.faultmask[es] = 0;
-             }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         g_assert_not_reached();
-     }
--    switch (type & 0xf) {
-+    switch (excret & 0xf) {
-     case 1: /* Return to Handler */
-         return_to_handler = true;
-         break;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-          */
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
--        v7m_exception_taken(cpu, type);
-+        v7m_exception_taken(cpu, excret);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-                       "stackframe: failed exception return integrity check\n");
-         return;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-     /* The restored xPSR exception field will be zero if we're
-      * resuming in Thread mode. If that doesn't match what the
--     * exception return type specified then this is a UsageFault.
-+     * exception return excret specified then this is a UsageFault.
-      */
-     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
-         /* Take an INVPC UsageFault by pushing the stack again. */
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         v7m_push_stack(cpu);
--        v7m_exception_taken(cpu, type);
-+        v7m_exception_taken(cpu, excret);
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
-                       "failed exception return integrity check\n");
-         return;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 01/18] target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
+[Qemu-devel] [PULL 09/27] target/arm: expose remaining CPUID registers as RAZ
-Use a symbolic constant M_REG_NUM_BANKS for the array size for
+From: Alex Bennée <alex.bennee@linaro.org>
 registers which are banked by M profile security state, rather
 than hardcoding lots of 2s.
-Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+There are a whole bunch more registers in the CPUID space which are
 currently not used but are exposed as RAZ. To avoid too much
 duplication we expand ARMCPRegUserSpaceInfo to understand glob
 patterns so we only need one entry to tweak whole ranges of registers.
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190205190224.2198-5-alex.bennee@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 35 +++++++++++++++++++----------------
+ target/arm/cpu.h    |  3 +++
-file changed, 19 insertions(+), 16 deletions(-)
+ target/arm/helper.c | 26 +++++++++++++++++++++++---
 files changed, 26 insertions(+), 3 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPRegUserSpaceInfo {
-  * accessed via env->registerfield[env->v7m.secure] (whether the security
+     /* Name of register */
-  * extension is implemented or not).
+     const char *name;
-  */
--#define M_REG_NS 0
++    /* Is the name actually a glob pattern */
--#define M_REG_S 1
++    bool is_glob;
-+enum {
++
-+    M_REG_NS = 0,
+     /* Only some bits are exported to user space */
-+    M_REG_S = 1,
+     uint64_t exported_bits;
-+    M_REG_NUM_BANKS = 2,
-+};
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
- /* ARM-specific interrupt pending bits.  */
+--- a/target/arm/helper.c
- #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         uint32_t other_sp;
+               .fixed_bits    = 0x0000000000000011 },
-         uint32_t other_ss_msp;
+             { .name = "ID_AA64PFR1_EL1",
-         uint32_t other_ss_psp;
+               .exported_bits = 0x00000000000000f0 },
--        uint32_t vecbase[2];
++            { .name = "ID_AA64PFR*_EL1_RESERVED",
--        uint32_t basepri[2];
++              .is_glob = true                     },
--        uint32_t control[2];
+             { .name = "ID_AA64ZFR0_EL1"           },
--        uint32_t ccr[2]; /* Configuration and Control */
+             { .name = "ID_AA64MMFR0_EL1",
--        uint32_t cfsr[2]; /* Configurable Fault Status */
+               .fixed_bits    = 0x00000000ff000000 },
-+        uint32_t vecbase[M_REG_NUM_BANKS];
+             { .name = "ID_AA64MMFR1_EL1"          },
-+        uint32_t basepri[M_REG_NUM_BANKS];
++            { .name = "ID_AA64MMFR*_EL1_RESERVED",
-+        uint32_t control[M_REG_NUM_BANKS];
++              .is_glob = true                     },
-+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+             { .name = "ID_AA64DFR0_EL1",
-+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
+               .fixed_bits    = 0x0000000000000006 },
-         uint32_t hfsr; /* HardFault Status */
+             { .name = "ID_AA64DFR1_EL1"           },
-         uint32_t dfsr; /* Debug Fault Status Register */
+-            { .name = "ID_AA64AFR0_EL1"           },
--        uint32_t mmfar[2]; /* MemManage Fault Address */
+-            { .name = "ID_AA64AFR1_EL1"           },
-+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
++            { .name = "ID_AA64DFR*_EL1_RESERVED",
-         uint32_t bfar; /* BusFault Address */
++              .is_glob = true                     },
--        unsigned mpu_ctrl[2]; /* MPU_CTRL */
++            { .name = "ID_AA64AFR*",
-+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
++              .is_glob = true                     },
-         int exception;
+             { .name = "ID_AA64ISAR0_EL1",
--        uint32_t primask[2];
+               .exported_bits = 0x00fffffff0fffff0 },
--        uint32_t faultmask[2];
+             { .name = "ID_AA64ISAR1_EL1",
-+        uint32_t primask[M_REG_NUM_BANKS];
+               .exported_bits = 0x000000f0ffffffff },
-+        uint32_t faultmask[M_REG_NUM_BANKS];
++            { .name = "ID_AA64ISAR*_EL1_RESERVED",
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
++              .is_glob = true                     },
-     } v7m;
+             REGUSERINFO_SENTINEL
+         };
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+         modify_arm_cp_regs(v8_idregs, v8_user_idregs);
-         uint32_t *drbar;
+@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
-         uint32_t *drsr;
+     ARMCPRegInfo *r;
-         uint32_t *dracr;
--        uint32_t rnr[2];
+     for (m = mods; m->name; m++) {
-+        uint32_t rnr[M_REG_NUM_BANKS];
++        GPatternSpec *pat = NULL;
-     } pmsav7;
++        if (m->is_glob) {
++            pat = g_pattern_spec_new(m->name);
-     /* PMSAv8 MPU */
++        }
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+         for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
-          *  pmsav7.rnr (region number register)
+-            if (strcmp(r->name, m->name) == 0) {
-          *  pmsav7_dregion (number of configured regions)
++            if (pat && g_pattern_match_string(pat, r->name)) {
-          */
++                r->type = ARM_CP_CONST;
--        uint32_t *rbar[2];
++                r->access = PL0U_R;
--        uint32_t *rlar[2];
++                r->resetvalue = 0;
--        uint32_t mair0[2];
++                /* continue */
--        uint32_t mair1[2];
++            } else if (strcmp(r->name, m->name) == 0) {
-+        uint32_t *rbar[M_REG_NUM_BANKS];
+                 r->type = ARM_CP_CONST;
-+        uint32_t *rlar[M_REG_NUM_BANKS];
+                 r->access = PL0U_R;
-+        uint32_t mair0[M_REG_NUM_BANKS];
+                 r->resetvalue &= m->exported_bits;
-+        uint32_t mair1[M_REG_NUM_BANKS];
+@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
-     } pmsav8;
+                 break;
+             }
-     void *nvic;
+         }
 +        if (pat) {
 +            g_pattern_spec_free(pat);
 +        }
      }
  }
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 10/27] linux-user/elfload: enable HWCAP_CPUID for AArch64
+From: Alex Bennée <alex.bennee@linaro.org>
+Userspace programs should (in theory) query the ELF HWCAP before
+probing these registers. Now we have implemented them all make it
+public.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190205190224.2198-6-alex.bennee@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ linux-user/elfload.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
+     hwcaps |= ARM_HWCAP_A64_FP;
+     hwcaps |= ARM_HWCAP_A64_ASIMD;
++    hwcaps |= ARM_HWCAP_A64_CPUID;
+     /* probe for the extra features */
+ #define GET_FEATURE_ID(feat, hwcap) \
+--
+.20.1

-[Qemu-devel] [PULL 06/18] target/arm: Add and use defines for EXCRET constants
+[Qemu-devel] [PULL 11/27] arm: Allow system registers for KVM guests to be changed by QEMU code
-The exception-return magic values get some new bits in v8M, which
+At the moment the Arm implementations of kvm_arch_{get,put}_registers()
-makes some bit definitions for them worthwhile.
+don't support having QEMU change the values of system registers
 (aka coprocessor registers for AArch32). This is because although
 kvm_arch_get_registers() calls write_list_to_cpustate() to
 update the CPU state struct fields (so QEMU code can read the
 values in the usual way), kvm_arch_put_registers() does not
 call write_cpustate_to_list(), meaning that any changes to
 the CPU state struct fields will not be passed back to KVM.
-We don't use the bit definitions for the switch on the low bits
+The rationale for this design is documented in a comment in the
-which checks the return type for v7M, because this is defined
+AArch32 kvm_arch_put_registers() -- writing the values in the
-in the v7M ARM ARM as a set of valid values rather than via
+cpregs list into the CPU state struct is "lossy" because the
-per-bit checks.
+write of a register might not succeed, and so if we blindly
 copy the CPU state values back again we will incorrectly
 change register values for the guest. The assumption was that
 no QEMU code would need to write to the registers.
 However, when we implemented debug support for KVM guests, we
 broke that assumption: the code to handle "set the guest up
 to take a breakpoint exception" does so by updating various
 guest registers including ESR_EL1.
 Support this by making kvm_arch_put_registers() synchronize
 CPU state back into the list. We sync only those registers
 where the initial write succeeds, which should be sufficient.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Dongjiu Geng <gengdongjiu@huawei.com>
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/cpu.h     |  9 ++++++++-
- target/arm/helper.c    | 14 +++++++++-----
+ target/arm/helper.c  | 27 +++++++++++++++++++++++++--
-files changed, 19 insertions(+), 5 deletions(-)
+ target/arm/kvm32.c   | 20 ++------------------
  target/arm/kvm64.c   |  2 ++
  target/arm/machine.c |  2 +-
 files changed, 38 insertions(+), 22 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/cpu.h
-+++ b/target/arm/internals.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
+@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
- FIELD(V7M_CONTROL, SPSEL, 1, 1)
+ /**
- FIELD(V7M_CONTROL, FPCA, 2, 1)
+  * write_cpustate_to_list:
+  * @cpu: ARMCPU
-+/* Bit definitions for v7M exception return payload */
++ * @kvm_sync: true if this is for syncing back to KVM
-+FIELD(V7M_EXCRET, ES, 0, 1)
+  *
-+FIELD(V7M_EXCRET, RES0, 1, 1)
+  * For each register listed in the ARMCPU cpreg_indexes list, write
-+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+  * its value from the ARMCPUState structure into the cpreg_values list.
-+FIELD(V7M_EXCRET, MODE, 3, 1)
+  * This is used to copy info from TCG's working data structures into
-+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+  * KVM or for outbound migration.
-+FIELD(V7M_EXCRET, DCRS, 5, 1)
+  *
-+FIELD(V7M_EXCRET, S, 6, 1)
++ * @kvm_sync is true if we are doing this in order to sync the
-+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
++ * register state back to KVM. In this case we will only update
-+
++ * values in the list if the previous list->cpustate sync actually
- /*
++ * successfully wrote the CPU state. Otherwise we will keep the value
-  * For AArch64, map a given EL to an index in the banked_spsr array.
++ * that is in the list.
-  * Note that this mapping and the AArch32 mapping defined in bank_number()
++ *
   * Returns: true if all register values were read correctly,
   * false if some register was unknown or could not be read.
   * Note that we do not stop early on failure -- we will attempt
   * reading all registers in the list.
   */
 -bool write_cpustate_to_list(ARMCPU *cpu);
 +bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  #define ARM_CPUID_TI915T      0x54029152
  #define ARM_CPUID_TI925T      0x54029252
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
-                   " previous exception %d\n",
+     return true;
-                   type, env->v7m.exception);
+ }
--    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+-bool write_cpustate_to_list(ARMCPU *cpu)
-+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
++bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
+ {
-                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+     /* Write the coprocessor state from cpu->env to the (index,value) list. */
      int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
      for (i = 0; i < cpu->cpreg_array_len; i++) {
          uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
          const ARMCPRegInfo *ri;
 +        uint64_t newval;
          ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
          if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
          if (ri->type & ARM_CP_NO_RAW) {
              continue;
          }
 -        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
 +
 +        newval = read_raw_cp_reg(&cpu->env, ri);
 +        if (kvm_sync) {
 +            /*
 +             * Only sync if the previous list->cpustate sync succeeded.
 +             * Rather than tracking the success/failure state for every
 +             * item in the list, we just recheck "does the raw write we must
 +             * have made in write_list_to_cpustate() read back OK" here.
 +             */
 +            uint64_t oldval = cpu->cpreg_values[i];
 +
 +            if (oldval == newval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, oldval);
 +            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, newval);
 +        }
 +        cpu->cpreg_values[i] = newval;
      }
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+     return ok;
-          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
+ }
-          */
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+index XXXXXXX..XXXXXXX 100644
--            int es = type & 1;
+--- a/target/arm/kvm32.c
-+            int es = type & R_V7M_EXCRET_ES_MASK;
++++ b/target/arm/kvm32.c
-             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-                 env->v7m.faultmask[es] = 0;
+         return ret;
              }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          return; /* Never happens.  Keep compiler happy.  */
      }
--    lr = 0xfffffff1;
+-    /* Note that we do not call write_cpustate_to_list()
-+    lr = R_V7M_EXCRET_RES1_MASK |
+-     * here, so we are only writing the tuple list back to
-+        R_V7M_EXCRET_S_MASK |
+-     * KVM. This is safe because nothing can change the
-+        R_V7M_EXCRET_DCRS_MASK |
+-     * CPUARMState cp15 fields (in particular gdb accesses cannot)
-+        R_V7M_EXCRET_FTYPE_MASK |
+-     * and so there are no changes to sync. In fact syncing would
-+        R_V7M_EXCRET_ES_MASK;
+-     * be wrong at this point: for a constant register where TCG and
-     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
+-     * KVM disagree about its value, the preceding write_list_to_cpustate()
--        lr |= 4;
+-     * would not have had any effect on the CPUARMState value (since the
-+        lr |= R_V7M_EXCRET_SPSEL_MASK;
+-     * register is read-only), and a write_cpustate_to_list() here would
 -     * then try to write the TCG value back into KVM -- this would either
 -     * fail or incorrectly change the value the guest sees.
 -     *
 -     * If we ever want to allow the user to modify cp15 registers via
 -     * the gdb stub, we would need to be more clever here (for instance
 -     * tracking the set of registers kvm_arch_get_registers() successfully
 -     * managed to update the CPUARMState with, and only allowing those
 -     * to be written back up into the kernel).
 -     */
 +    write_cpustate_to_list(cpu, true);
 +
      if (!write_list_to_kvmstate(cpu, level)) {
          return EINVAL;
      }
-     if (!arm_v7m_is_handler_mode(env)) {
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
--        lr |= 8;
+index XXXXXXX..XXXXXXX 100644
-+        lr |= R_V7M_EXCRET_MODE_MASK;
+--- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          return ret;
      }
-     v7m_push_stack(cpu);
++    write_cpustate_to_list(cpu, true);
 +
      if (!write_list_to_kvmstate(cpu, level)) {
          return EINVAL;
      }
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
              abort();
          }
      } else {
 -        if (!write_cpustate_to_list(cpu)) {
 +        if (!write_cpustate_to_list(cpu, false)) {
              /* This should never fail. */
              abort();
          }
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 12/27] MAINTAINERS: Remove Peter Crosthwaite from various entries
+Peter Crosthwaite hasn't had the bandwidth to do code review or
+other QEMU work for some time now -- remove his email address
+from MAINTAINERS file entries so we don't bombard him with
+patch emails.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190207181422.4907-1-peter.maydell@linaro.org
+---
+ MAINTAINERS | 4 ----
+file changed, 4 deletions(-)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ Guest CPU cores (TCG):
+ ----------------------
+ Overall
+ L: qemu-devel@nongnu.org
+-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+ M: Richard Henderson <rth@twiddle.net>
+ R: Paolo Bonzini <pbonzini@redhat.com>
+ S: Maintained
+@@ -XXX,XX +XXX,XX @@ F: tests/virtio-scsi-test.c
+ T: git https://github.com/bonzini/qemu.git scsi-next
+ SSI
+-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+ M: Alistair Francis <alistair@alistair23.me>
+ S: Maintained
+ F: hw/ssi/*
+@@ -XXX,XX +XXX,XX @@ F: tests/m25p80-test.c
+ Xilinx SPI
+ M: Alistair Francis <alistair@alistair23.me>
+-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+ S: Maintained
+ F: hw/ssi/xilinx_*
+@@ -XXX,XX +XXX,XX @@ F: qom/cpu.c
+ F: include/qom/cpu.h
+ Device Tree
+-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
+ M: Alexander Graf <agraf@suse.de>
+ S: Maintained
+ F: device_tree.c
+--
+.20.1

-[Qemu-devel] [PULL 04/18] nvic: Don't apply group priority mask to negative priorities
+[Qemu-devel] [PULL 13/27] hw/intc/armv7m_nvic: Allow byte accesses to SHPR1
-In several places we were unconditionally applying the
+The code for handling the NVIC SHPR1 register intends to permit
-nvic_gprio_mask() to a priority value. This is incorrect
+byte and halfword accesses (as the architecture requires). However
-if the priority is one of the fixed negative priority
+the 'case' line for it only lists the base address of the
-values (for NMI and HardFault), so don't do it.
+register, so attempts to access bytes other than the first one
 end up in the "bad write" default logic. This bug was added
 accidentally when we split out the SHPR1 logic from SHPR2 and
 SHPR3 to support v6M.
-This bug would have caused both NMI and HardFault to be
+Fixes: 7c9140afd594 ("nvic: Handle ARMv6-M SCS reserved registers")
 considered as the same priority and so NMI wouldn't
 correctly preempt HardFault.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 11 +++++++++--
+The Zephyr RTOS happens to access SHPR1 byte at a time,
-file changed, 9 insertions(+), 2 deletions(-)
+which is how I spotted this.
 ---
  hw/intc/armv7m_nvic.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
+@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
              }
          }
-     }
+         break;
+-    case 0xd18: /* System Handler Priority (SHPR1) */
-+    if (active_prio > 0) {
++    case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
-+        active_prio &= nvic_gprio_mask(s);
+         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
-+    }
+             val = 0;
-+
+             break;
-     s->vectpending = pend_irq;
+@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
--    s->exception_prio = active_prio & nvic_gprio_mask(s);
+         }
-+    s->exception_prio = active_prio;
+         nvic_irq_update(s);
+         return MEMTX_OK;
-     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
+-    case 0xd18: /* System Handler Priority (SHPR1) */
- }
++    case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
-     assert(vec->enabled);
+             return MEMTX_OK;
-     assert(vec->pending);
+         }
 -    pendgroupprio = vec->prio & nvic_gprio_mask(s);
 +    pendgroupprio = vec->prio;
 +    if (pendgroupprio > 0) {
 +        pendgroupprio &= nvic_gprio_mask(s);
 +    }
      assert(pendgroupprio < running);
      trace_nvic_acknowledge_irq(pending, vec->prio);
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 14/27] hw/arm/armsse: Fix miswiring of expansion IRQs
+In commit 91c1e9fcbd7548db368 where we added dual-CPU support to
+the ARMSSE, we set up the wiring of the expansion IRQs via nested
+loops: the outer loop on 'i' loops for each CPU, and the inner loop
+on 'j' loops for each interrupt. Fix a typo which meant we were
+wiring every expansion IRQ line to external IRQ 0 on CPU 0 and
+to external IRQ 1 on CPU 1.
+Fixes: 91c1e9fcbd7548db368 ("hw/arm/armsse: Support dual-CPU configuration")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+---
+ hw/arm/armsse.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+         /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */
+         s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq);
+         for (j = 0; j < s->exp_numirq; j++) {
+-            s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, i + 32);
++            s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + 32);
+         }
+         if (i == 0) {
+             gpioname = g_strdup("EXP_IRQ");
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 15/27] target/arm: Rely on optimization within tcg_gen_gvec_or
+From: Richard Henderson <richard.henderson@linaro.org>
+Since we're now handling a == b generically, we no longer need
+to do it by hand within target/arm/.
+Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c |  6 +-----
+ target/arm/translate-sve.c |  6 +-----
+ target/arm/translate.c     | 12 +++---------
+files changed, 5 insertions(+), 19 deletions(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_logic(DisasContext *s, uint32_t insn)
+         gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_andc, 0);
+         return;
+     case 2: /* ORR */
+-        if (rn == rm) { /* MOV */
+-            gen_gvec_fn2(s, is_q, rd, rn, tcg_gen_gvec_mov, 0);
+-        } else {
+-            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_or, 0);
+-        }
++        gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_or, 0);
+         return;
+     case 3: /* ORN */
+         gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_orc, 0);
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-sve.c
++++ b/target/arm/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_AND_zzz(DisasContext *s, arg_rrr_esz *a)
+ static bool trans_ORR_zzz(DisasContext *s, arg_rrr_esz *a)
+ {
+-    if (a->rn == a->rm) { /* MOV */
+-        return do_mov_z(s, a->rd, a->rn);
+-    } else {
+-        return do_vector3_z(s, tcg_gen_gvec_or, 0, a->rd, a->rn, a->rm);
+-    }
++    return do_vector3_z(s, tcg_gen_gvec_or, 0, a->rd, a->rn, a->rm);
+ }
+ static bool trans_EOR_zzz(DisasContext *s, arg_rrr_esz *a)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                 tcg_gen_gvec_andc(0, rd_ofs, rn_ofs, rm_ofs,
+                                   vec_size, vec_size);
+                 break;
+-            case 2:
+-                if (rn == rm) {
+-                    /* VMOV */
+-                    tcg_gen_gvec_mov(0, rd_ofs, rn_ofs, vec_size, vec_size);
+-                } else {
+-                    /* VORR */
+-                    tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
+-                                    vec_size, vec_size);
+-                }
++            case 2: /* VORR */
++                tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
++                                vec_size, vec_size);
+                 break;
+             case 3: /* VORN */
+                 tcg_gen_gvec_orc(0, rd_ofs, rn_ofs, rm_ofs,
+--
+.20.1

-[Qemu-devel] [PULL 13/18] AArch64: Fix single stepping of ERET instruction
+[Qemu-devel] [PULL 16/27] target/arm: Use vector minmax expanders for aarch64
-From: Jaroslaw Pelczar <j.pelczar@samsung.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Previously when single stepping through ERET instruction via GDB
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-would result in debugger entering the "next" PC after ERET instruction.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-When debugging in kernel mode, this will also cause unintended behavior,
+Message-id: 20190209033847.9014-3-richard.henderson@linaro.org
 because debugger will try to access memory from EL0 point of view.
 Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
 Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 1 +
+ target/arm/translate-a64.c | 35 ++++++++++++++---------------------
-file changed, 1 insertion(+)
+file changed, 14 insertions(+), 21 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
-         default:
+     }
-             gen_a64_set_pc_im(dc->pc);
-             /* fall through */
+     switch (opcode) {
-+        case DISAS_EXIT:
++    case 0x0c: /* SMAX, UMAX */
-         case DISAS_JUMP:
++        if (u) {
-             if (dc->base.singlestep_enabled) {
++            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umax, size);
-                 gen_exception_internal(EXCP_DEBUG);
++        } else {
 +            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_smax, size);
 +        }
 +        return;
 +    case 0x0d: /* SMIN, UMIN */
 +        if (u) {
 +            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umin, size);
 +        } else {
 +            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_smin, size);
 +        }
 +        return;
      case 0x10: /* ADD, SUB */
          if (u) {
              gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_sub, size);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                  genenvfn = fns[size][u];
                  break;
              }
 -            case 0xc: /* SMAX, UMAX */
 -            {
 -                static NeonGenTwoOpFn * const fns[3][2] = {
 -                    { gen_helper_neon_max_s8, gen_helper_neon_max_u8 },
 -                    { gen_helper_neon_max_s16, gen_helper_neon_max_u16 },
 -                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
 -                };
 -                genfn = fns[size][u];
 -                break;
 -            }
 -
 -            case 0xd: /* SMIN, UMIN */
 -            {
 -                static NeonGenTwoOpFn * const fns[3][2] = {
 -                    { gen_helper_neon_min_s8, gen_helper_neon_min_u8 },
 -                    { gen_helper_neon_min_s16, gen_helper_neon_min_u16 },
 -                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
 -                };
 -                genfn = fns[size][u];
 -                break;
 -            }
              case 0xe: /* SABD, UABD */
              case 0xf: /* SABA, UABA */
              {
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 17/27] target/arm: Use vector minmax expanders for aarch32
+From: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 25 +++++++++++++++++++------
+file changed, 19 insertions(+), 6 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+             tcg_gen_gvec_cmp(u ? TCG_COND_GEU : TCG_COND_GE, size,
+                              rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
+             return 0;
++
++        case NEON_3R_VMAX:
++            if (u) {
++                tcg_gen_gvec_umax(size, rd_ofs, rn_ofs, rm_ofs,
++                                  vec_size, vec_size);
++            } else {
++                tcg_gen_gvec_smax(size, rd_ofs, rn_ofs, rm_ofs,
++                                  vec_size, vec_size);
++            }
++            return 0;
++        case NEON_3R_VMIN:
++            if (u) {
++                tcg_gen_gvec_umin(size, rd_ofs, rn_ofs, rm_ofs,
++                                  vec_size, vec_size);
++            } else {
++                tcg_gen_gvec_smin(size, rd_ofs, rn_ofs, rm_ofs,
++                                  vec_size, vec_size);
++            }
++            return 0;
+         }
+         if (size == 3) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+         case NEON_3R_VQRSHL:
+             GEN_NEON_INTEGER_OP_ENV(qrshl);
+             break;
+-        case NEON_3R_VMAX:
+-            GEN_NEON_INTEGER_OP(max);
+-            break;
+-        case NEON_3R_VMIN:
+-            GEN_NEON_INTEGER_OP(min);
+-            break;
+         case NEON_3R_VABD:
+             GEN_NEON_INTEGER_OP(abd);
+             break;
+--
+.20.1

-[Qemu-devel] [PULL 17/18] hw/pci-host/gpex: Implement PCI INTx routing
+[Qemu-devel] [PULL 18/27] target/arm: Use tcg integer min/max primitives for neon
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Now we are able to retrieve the gsi from the INTx pin, let's
+The 32-bit PMIN/PMAX has been decomposed to scalars,
-enable intx_to_irq routing. From that point on, irqfd becomes
+and so can be trivially expanded inline.
 usable along with INTx when assigning a PCIe device.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
+Message-id: 20190209033847.9014-5-richard.henderson@linaro.org
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Tested-by: Feng Kan <fkan@apm.com>
 Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/pci-host/gpex.c | 12 ++++++++++++
+ target/arm/translate.c | 8 ++++----
-file changed, 12 insertions(+)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/pci-host/gpex.c
+--- a/target/arm/translate.c
-+++ b/hw/pci-host/gpex.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+@@ -XXX,XX +XXX,XX @@ static inline void gen_neon_rsb(int size, TCGv_i32 t0, TCGv_i32 t1)
      return 0;
  }
-+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+ /* 32-bit pairwise ops end up the same as the elementwise versions.  */
-+{
+-#define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
-+    PCIINTxRoute route;
+-#define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
-+    GPEXHost *s = opaque;
+-#define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
-+
+-#define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
-+    route.mode = PCI_INTX_ENABLED;
++#define gen_helper_neon_pmax_s32  tcg_gen_smax_i32
-+    route.irq = s->irq_num[pin];
++#define gen_helper_neon_pmax_u32  tcg_gen_umax_i32
-+
++#define gen_helper_neon_pmin_s32  tcg_gen_smin_i32
-+    return route;
++#define gen_helper_neon_pmin_u32  tcg_gen_umin_i32
-+}
-+
+ #define GEN_NEON_INTEGER_OP_ENV(name) do { \
- static void gpex_host_realize(DeviceState *dev, Error **errp)
+     switch ((size << 1) | u) { \
  {
      PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                  &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
      qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
 +    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
      qdev_init_nofail(DEVICE(&s->gpex_root));
  }
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 19/27] target/arm: Remove neon min/max helpers
+From: Richard Henderson <richard.henderson@linaro.org>
+These are now unused.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-6-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.h      | 12 ------------
+ target/arm/neon_helper.c | 12 ------------
+files changed, 24 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(neon_cge_s16, i32, i32, i32)
+ DEF_HELPER_2(neon_cge_u32, i32, i32, i32)
+ DEF_HELPER_2(neon_cge_s32, i32, i32, i32)
+-DEF_HELPER_2(neon_min_u8, i32, i32, i32)
+-DEF_HELPER_2(neon_min_s8, i32, i32, i32)
+-DEF_HELPER_2(neon_min_u16, i32, i32, i32)
+-DEF_HELPER_2(neon_min_s16, i32, i32, i32)
+-DEF_HELPER_2(neon_min_u32, i32, i32, i32)
+-DEF_HELPER_2(neon_min_s32, i32, i32, i32)
+-DEF_HELPER_2(neon_max_u8, i32, i32, i32)
+-DEF_HELPER_2(neon_max_s8, i32, i32, i32)
+-DEF_HELPER_2(neon_max_u16, i32, i32, i32)
+-DEF_HELPER_2(neon_max_s16, i32, i32, i32)
+-DEF_HELPER_2(neon_max_u32, i32, i32, i32)
+-DEF_HELPER_2(neon_max_s32, i32, i32, i32)
+ DEF_HELPER_2(neon_pmin_u8, i32, i32, i32)
+ DEF_HELPER_2(neon_pmin_s8, i32, i32, i32)
+ DEF_HELPER_2(neon_pmin_u16, i32, i32, i32)
+diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon_helper.c
++++ b/target/arm/neon_helper.c
+@@ -XXX,XX +XXX,XX @@ NEON_VOP(cge_u32, neon_u32, 1)
+ #undef NEON_FN
+ #define NEON_FN(dest, src1, src2) dest = (src1 < src2) ? src1 : src2
+-NEON_VOP(min_s8, neon_s8, 4)
+-NEON_VOP(min_u8, neon_u8, 4)
+-NEON_VOP(min_s16, neon_s16, 2)
+-NEON_VOP(min_u16, neon_u16, 2)
+-NEON_VOP(min_s32, neon_s32, 1)
+-NEON_VOP(min_u32, neon_u32, 1)
+ NEON_POP(pmin_s8, neon_s8, 4)
+ NEON_POP(pmin_u8, neon_u8, 4)
+ NEON_POP(pmin_s16, neon_s16, 2)
+@@ -XXX,XX +XXX,XX @@ NEON_POP(pmin_u16, neon_u16, 2)
+ #undef NEON_FN
+ #define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? src1 : src2
+-NEON_VOP(max_s8, neon_s8, 4)
+-NEON_VOP(max_u8, neon_u8, 4)
+-NEON_VOP(max_s16, neon_s16, 2)
+-NEON_VOP(max_u16, neon_u16, 2)
+-NEON_VOP(max_s32, neon_s32, 1)
+-NEON_VOP(max_u32, neon_u32, 1)
+ NEON_POP(pmax_s8, neon_s8, 4)
+ NEON_POP(pmax_u8, neon_u8, 4)
+ NEON_POP(pmax_s16, neon_s16, 2)
+--
+.20.1

-[Qemu-devel] [PULL 05/18] target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
+[Qemu-devel] [PULL 20/27] target/arm: Fix vfp_gdb_get/set_reg vs FPSCR
-In do_v7m_exception_exit(), there's no need to force the high 4
+From: Richard Henderson <richard.henderson@linaro.org>
 bits of 'type' to 1 when calling v7m_exception_taken(), because
 we know that they're always 1 or we could not have got to this
 "handle return to magic exception return address" code. Remove
 the unnecessary ORs.
+The components of this register is stored in several
+different locations.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-7-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
 ---
  target/arm/helper.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
-          */
+     }
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+     switch (reg - nregs) {
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
--        v7m_exception_taken(cpu, type | 0xf0000000);
+-    case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
-+        v7m_exception_taken(cpu, type);
++    case 1: stl_p(buf, vfp_get_fpscr(env)); return 4;
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
-                       "stackframe: failed exception return integrity check\n");
+     }
-         return;
+     return 0;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
+     }
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+     switch (reg - nregs) {
-         v7m_push_stack(cpu);
+     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
--        v7m_exception_taken(cpu, type | 0xf0000000);
+-    case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
-+        v7m_exception_taken(cpu, type);
++    case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4;
-         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
+     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
-                       "failed exception return integrity check\n");
+     }
-         return;
+     return 0;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 12/18] xlnx-zcu102: Mark the EP108 machine as deprecated
+[Qemu-devel] [PULL 21/27] target/arm: Fix arm_cpu_dump_state vs FPSCR
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The EP108 is the same as the ZCU102, mark it as deprecated as we don't
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-need two machines.
+Message-id: 20190209033847.9014-8-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 2 +-
+ target/arm/translate.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
- {
+                         i * 2 + 1, (uint32_t)(v >> 32),
-     MachineClass *mc = MACHINE_CLASS(oc);
+                         i, v);
+         }
--    mc->desc = "Xilinx ZynqMP EP108 board";
+-        cpu_fprintf(f, "FPSCR: %08x\n", (int)env->vfp.xregs[ARM_VFP_FPSCR]);
-+    mc->desc = "Xilinx ZynqMP EP108 board (Deprecated, please use xlnx-zcu102)";
++        cpu_fprintf(f, "FPSCR: %08x\n", vfp_get_fpscr(env));
-     mc->init = xlnx_ep108_init;
+     }
-     mc->block_default_type = IF_IDE;
+ }
-     mc->units_per_default_bus = 1;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/18] xlnx-zcu102: Add a machine level virtualization property
+[Qemu-devel] [PULL 22/27] target/arm: Split out flags setting from vfp compares
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a machine level virtualization property. This defaults to false and can be
+Minimize the code within a macro by splitting out a helper function.
-set to true using this machine command line argument:
+Use deposit32 instead of manual bit manipulation.
     -machine xlnx-zcu102,virtualization=on
-This follows what the ARM virt machine does.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-9-richard.henderson@linaro.org
-This property only applies to the ZCU102 machine. The EP108 machine does
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 not have this property.
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-zynqmp.h |  2 ++
+ target/arm/helper.c | 45 +++++++++++++++++++++++++++------------------
- hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
+file changed, 27 insertions(+), 18 deletions(-)
  hw/arm/xlnx-zynqmp.c         |  3 ++-
 files changed, 33 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-zynqmp.h
+--- a/target/arm/helper.c
-+++ b/include/hw/arm/xlnx-zynqmp.h
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
+@@ -XXX,XX +XXX,XX @@ float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
+     return float64_sqrt(a, &env->vfp.fp_status);
      /* Has the ARM Security extensions?  */
      bool secure;
 +    /* Has the ARM Virtualization extensions?  */
 +    bool virt;
      /* Has the RPU subsystem?  */
      bool has_rpu;
  }  XlnxZynqMPState;
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
      MemoryRegion ddr_ram;
      bool secure;
 +    bool virt;
  } XlnxZCU102;
  #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
      s->secure = value;
  }
-+static bool zcu102_get_virt(Object *obj, Error **errp)
++static void softfloat_to_vfp_compare(CPUARMState *env, int cmp)
 +{
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
++    uint32_t flags;
-+
++    switch (cmp) {
-+    return s->virt;
++    case float_relation_equal:
 +        flags = 0x6;
 +        break;
 +    case float_relation_less:
 +        flags = 0x8;
 +        break;
 +    case float_relation_greater:
 +        flags = 0x2;
 +        break;
 +    case float_relation_unordered:
 +        flags = 0x3;
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    env->vfp.xregs[ARM_VFP_FPSCR] =
 +        deposit32(env->vfp.xregs[ARM_VFP_FPSCR], 28, 4, flags);
 +}
 +
-+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+ /* XXX: check quiet/signaling case */
-+{
+ #define DO_VFP_cmp(p, type) \
-+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+ void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env)  \
-+
+ { \
-+    s->virt = value;
+-    uint32_t flags; \
-+}
+-    switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
-+
+-    case 0: flags = 0x6; break; \
- static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-    case -1: flags = 0x8; break; \
- {
+-    case 1: flags = 0x2; break; \
-     int i;
+-    default: case 2: flags = 0x3; break; \
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-    } \
-                          "ddr-ram", &error_abort);
+-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
-     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
-                              &error_fatal);
++    softfloat_to_vfp_compare(env, \
-+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
++        type ## _compare_quiet(a, b, &env->vfp.fp_status)); \
-+                             &error_fatal);
+ } \
+ void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+ { \
+-    uint32_t flags; \
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
+-    switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
- {
+-    case 0: flags = 0x6; break; \
-     XlnxZCU102 *s = EP108_MACHINE(obj);
+-    case -1: flags = 0x8; break; \
+-    case 1: flags = 0x2; break; \
--    /* EP108, we don't support setting secure */
+-    default: case 2: flags = 0x3; break; \
-+    /* EP108, we don't support setting secure or virt */
+-    } \
-     s->secure = false;
+-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
-+    s->virt = false;
+-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
 +    softfloat_to_vfp_compare(env, \
 +        type ## _compare(a, b, &env->vfp.fp_status)); \
  }
+ DO_VFP_cmp(s, float32)
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+ DO_VFP_cmp(d, float64)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                      "Set on/off to enable/disable the ARM "
                                      "Security Extensions (TrustZone)",
                                      NULL);
 +
 +    /* Default to virt (EL2) being disabled */
 +    s->virt = false;
 +    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
 +                             zcu102_set_virt, NULL);
 +    object_property_set_description(obj, "virtualization",
 +                                    "Set on/off to enable/disable emulating a "
 +                                    "guest CPU which implements the ARM "
 +                                    "Virtualization Extensions",
 +                                    NULL);
  }
  static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                   s->secure, "has_el3", NULL);
          object_property_set_bool(OBJECT(&s->apu_cpu[i]),
 -                                 false, "has_el2", NULL);
 +                                 s->virt, "has_el2", NULL);
          object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                  "reset-cbar", &error_abort);
          object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
  static Property xlnx_zynqmp_props[] = {
      DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
      DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
 +    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
      DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
      DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                       MemoryRegion *),
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 10/18] xlnx-zcu102: Add a machine level secure property
+[Qemu-devel] [PULL 23/27] target/arm: Fix set of bits kept in xregs[ARM_VFP_FPSCR]
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a machine level secure property. This defaults to false and can be
+Given that we mask bits properly on set, there is no reason
-set to true using this machine command line argument:
+to mask them again on get.  We failed to clear the exception
-    -machine xlnx-zcu102,secure=on
+status bits, 0x9f, which means that the wrong value would be
 returned on get.  Except in the (probably normal) case in which
 the set clears all of the bits.
-This follows what the ARM virt machine does.
+Simplify the code in set to also clear the RES0 bits.
-This property only applies to the ZCU102 machine. The EP108 machine does
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-not have this property.
+Message-id: 20190209033847.9014-10-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 32 ++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 15 ++++++++-------
-file changed, 32 insertions(+)
+file changed, 8 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
+     int i;
-     XlnxZynqMPState soc;
+     uint32_t fpscr;
-     MemoryRegion ddr_ram;
-+
+-    fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
-+    bool secure;
++    fpscr = env->vfp.xregs[ARM_VFP_FPSCR]
- } XlnxZCU102;
+             | (env->vfp.vec_len << 16)
+             | (env->vfp.vec_stride << 20);
- #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
+@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_to_host(int target_bits)
+ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
  static struct arm_boot_info xlnx_zcu102_binfo;
 +static bool zcu102_get_secure(Object *obj, Error **errp)
 +{
 +    XlnxZCU102 *s = ZCU102_MACHINE(obj);
 +
 +    return s->secure;
 +}
 +
 +static void zcu102_set_secure(Object *obj, bool value, Error **errp)
 +{
 +    XlnxZCU102 *s = ZCU102_MACHINE(obj);
 +
 +    s->secure = value;
 +}
 +
  static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
  {
      int i;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
+-    uint32_t changed;
++    uint32_t changed = env->vfp.xregs[ARM_VFP_FPSCR];
-     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
-                          "ddr-ram", &error_abort);
+     /* When ARMv8.2-FP16 is not supported, FZ16 is RES0.  */
-+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+     if (!cpu_isar_feature(aa64_fp16, arm_env_get_cpu(env))) {
-+                             &error_fatal);
+@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
+     /*
+      * We don't implement trapped exception handling, so the
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+-     * trap enable bits are all RAZ/WI (not RES0!)
++     * trap enable bits, IDE|IXE|UFE|OFE|DZE|IOE are all RAZ/WI (not RES0!)
- static void xlnx_ep108_machine_instance_init(Object *obj)
++     *
- {
++     * If we exclude the exception flags, IOC|DZC|OFC|UFC|IXC|IDC
-+    XlnxZCU102 *s = EP108_MACHINE(obj);
++     * (which are stored in fp_status), and the other RES0 bits
-+
++     * in between, then we clear all of the low 16 bits.
-+    /* EP108, we don't support setting secure */
+      */
-+    s->secure = false;
+-    val &= ~(FPCR_IDE | FPCR_IXE | FPCR_UFE | FPCR_OFE | FPCR_DZE | FPCR_IOE);
- }
+-
+-    changed = env->vfp.xregs[ARM_VFP_FPSCR];
- static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+-    env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
++    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xffc80000;
+     env->vfp.vec_len = (val >> 16) & 7;
- static void xlnx_zcu102_machine_instance_init(Object *obj)
+     env->vfp.vec_stride = (val >> 20) & 3;
- {
 +    XlnxZCU102 *s = ZCU102_MACHINE(obj);
 +
 +    /* Default to secure mode being disabled */
 +    s->secure = false;
 +    object_property_add_bool(obj, "secure", zcu102_get_secure,
 +                             zcu102_set_secure, NULL);
 +    object_property_set_description(obj, "secure",
 +                                    "Set on/off to enable/disable the ARM "
 +                                    "Security Extensions (TrustZone)",
 +                                    NULL);
  }
  static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/18] target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
+[Qemu-devel] [PULL 24/27] target/arm: Split out FPSCR.QC to a vector field
-For M profile we must clear the exclusive monitor on reset, exception
+From: Richard Henderson <richard.henderson@linaro.org>
 entry and exception exit.  We weren't doing any of these things; fix
 this bug.
+Change the representation of this field such that it is easy
+to set from vector code.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190209033847.9014-11-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 10 ++++++++++
+ target/arm/cpu.h         |  5 ++++-
- target/arm/cpu.c       |  6 ++++++
+ target/arm/helper.c      | 19 +++++++++++++++----
- target/arm/helper.c    |  2 ++
+ target/arm/neon_helper.c |  2 +-
- target/arm/op_helper.c |  2 +-
+ target/arm/vec_helper.c  |  2 +-
-files changed, 19 insertions(+), 1 deletion(-)
+files changed, 21 insertions(+), 7 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/cpu.h
-+++ b/target/arm/internals.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          ARMPredicateReg preg_tmp;
  #endif
- /**
+-        uint32_t xregs[16];
-+ * arm_clear_exclusive: clear the exclusive monitor
+         /* We store these fpcsr fields separately for convenience.  */
-+ * @env: CPU env
++        uint32_t qc[4] QEMU_ALIGNED(16);
-+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+         int vec_len;
-+ */
+         int vec_stride;
-+static inline void arm_clear_exclusive(CPUARMState *env)
-+{
++        uint32_t xregs[16];
 +    env->exclusive_addr = -1;
 +}
 +
-+/**
+         /* Scratch space for aa32 neon expansion.  */
-  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
+         uint32_t scratch[8];
-  * @s2addr: Address that caused a fault at stage 2
-  * @stage2: True if we faulted at stage 2
+@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+ #define FPCR_FZ16   (1 << 19)   /* ARMv8.2+, FP16 flush-to-zero */
-index XXXXXXX..XXXXXXX 100644
+ #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
---- a/target/arm/cpu.c
+ #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
-+++ b/target/arm/cpu.c
++#define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-         env->regs[15] = 0xFFFF0000;
+ static inline uint32_t vfp_get_fpsr(CPUARMState *env)
-     }
+ {
 +    /* M profile requires that reset clears the exclusive monitor;
 +     * A profile does not, but clearing it makes more sense than having it
 +     * set with an exclusive access on address zero.
 +     */
 +    arm_clear_exclusive(env);
 +
      env->vfp.xregs[ARM_VFP_FPEXC] = 0;
  #endif
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
+@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
-     armv7m_nvic_acknowledge_irq(env->nvic);
+ uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
-     switch_v7m_sp(env, 0);
+ {
-+    arm_clear_exclusive(env);
+-    int i;
-     /* Clear IT bits */
+-    uint32_t fpscr;
-     env->condexec_bits = 0;
++    uint32_t i, fpscr;
-     env->regs[14] = lr;
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+     fpscr = env->vfp.xregs[ARM_VFP_FPSCR]
-     }
+             | (env->vfp.vec_len << 16)
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
-     /* Otherwise, we have a successful exception exit. */
+     /* FZ16 does not generate an input denormal exception.  */
-+    arm_clear_exclusive(env);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
-     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
+           & ~float_flag_input_denormal);
 -
      fpscr |= vfp_exceptbits_from_host(i);
 +
 +    i = env->vfp.qc[0] | env->vfp.qc[1] | env->vfp.qc[2] | env->vfp.qc[3];
 +    fpscr |= i ? FPCR_QC : 0;
 +
      return fpscr;
  }
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
       * (which are stored in fp_status), and the other RES0 bits
       * in between, then we clear all of the low 16 bits.
       */
 -    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xffc80000;
 +    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xf7c80000;
      env->vfp.vec_len = (val >> 16) & 7;
      env->vfp.vec_stride = (val >> 20) & 3;
 +    /*
 +     * The bit we set within fpscr_q is arbitrary; the register as a
 +     * whole being zero/non-zero is what counts.
 +     */
 +    env->vfp.qc[0] = val & FPCR_QC;
 +    env->vfp.qc[1] = 0;
 +    env->vfp.qc[2] = 0;
 +    env->vfp.qc[3] = 0;
 +
      changed ^= val;
      if (changed & (3 << 22)) {
          i = (val >> 22) & 3;
 diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
+--- a/target/arm/neon_helper.c
-+++ b/target/arm/op_helper.c
++++ b/target/arm/neon_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@
+ #define SIGNBIT (uint32_t)0x80000000
-     aarch64_save_sp(env, cur_el);
+ #define SIGNBIT64 ((uint64_t)1 << 63)
--    env->exclusive_addr = -1;
+-#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
-+    arm_clear_exclusive(env);
++#define SET_QC() env->vfp.qc[0] = 1
-     /* We must squash the PSTATE.SS bit to zero unless both of the
+ #define NEON_TYPE1(name, type) \
-      * following hold:
+ typedef struct \
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vec_helper.c
 +++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
  #define H4(x)  (x)
  #endif
 -#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
 +#define SET_QC() env->vfp.qc[0] = 1
  static void clear_tail(void *vd, uintptr_t opr_sz, uintptr_t max_sz)
  {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/18] xlnx-ep108: Rename to ZCU102
+[Qemu-devel] [PULL 25/27] target/arm: Use vector operations for saturation
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The EP108 is a early access development board. Now that silicon is in
+For same-sign saturation, we have tcg vector operations.  We can
-production people have access to the ZCU102. Let's rename the internal
+compute the QC bit by comparing the saturated value against the
-QEMU files and variables to use the ZCU102.
+unsaturated value.
-There is no functional change here as the EP108 is still a valid board
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-option.
+Message-id: 20190209033847.9014-12-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                   |  2 +-
+ target/arm/helper.h        |  33 +++++++
- hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
+ target/arm/translate.h     |   4 +
-files changed, 16 insertions(+), 16 deletions(-)
+ target/arm/translate-a64.c |  36 ++++----
- rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)
+ target/arm/translate.c     | 172 +++++++++++++++++++++++++++++++------
  target/arm/vec_helper.c    | 130 ++++++++++++++++++++++++++++
 files changed, 331 insertions(+), 44 deletions(-)
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/target/arm/helper.h
-+++ b/hw/arm/Makefile.objs
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
- obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
+ DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
- obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
+                    void, ptr, ptr, ptr, ptr, ptr, i32)
- obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
--obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
++DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
-+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
++                   void, ptr, ptr, ptr, ptr, i32)
- obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
++DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
- obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
++                   void, ptr, ptr, ptr, ptr, i32)
- obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
++DEF_HELPER_FLAGS_5(gvec_uqadd_s, TCG_CALL_NO_RWG,
-diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
++                   void, ptr, ptr, ptr, ptr, i32)
-similarity index 85%
++DEF_HELPER_FLAGS_5(gvec_uqadd_d, TCG_CALL_NO_RWG,
-rename from hw/arm/xlnx-ep108.c
++                   void, ptr, ptr, ptr, ptr, i32)
-rename to hw/arm/xlnx-zcu102.c
++DEF_HELPER_FLAGS_5(gvec_sqadd_b, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqadd_h, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqadd_s, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqadd_d, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_uqsub_b, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_uqsub_h, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_uqsub_s, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_uqsub_d, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqsub_b, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqsub_h, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, i32)
 +
  #ifdef TARGET_AARCH64
  #include "helper-a64.h"
  #include "helper-sve.h"
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-ep108.c
+--- a/target/arm/translate.h
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ extern const GVecGen2i ssra_op[4];
  extern const GVecGen2i usra_op[4];
  extern const GVecGen2i sri_op[4];
  extern const GVecGen2i sli_op[4];
 +extern const GVecGen4 uqadd_op[4];
 +extern const GVecGen4 sqadd_op[4];
 +extern const GVecGen4 uqsub_op[4];
 +extern const GVecGen4 sqsub_op[4];
  void gen_cmtst_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b);
  /*
-- * Xilinx ZynqMP EP108 board
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-+ * Xilinx ZynqMP ZCU102 board
+index XXXXXXX..XXXXXXX 100644
-  *
+--- a/target/arm/translate-a64.c
-  * Copyright (C) 2015 Xilinx Inc
++++ b/target/arm/translate-a64.c
-  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
@@ -XXX,XX +XXX,XX @@
  #include "exec/address-spaces.h"
  #include "qemu/log.h"
 -typedef struct XlnxEP108 {
 +typedef struct XlnxZCU102 {
      XlnxZynqMPState soc;
      MemoryRegion ddr_ram;
 -} XlnxEP108;
 +} XlnxZCU102;
 -static struct arm_boot_info xlnx_ep108_binfo;
 +static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_ep108_init(MachineState *machine)
 +static void xlnx_zcu102_init(MachineState *machine)
  {
 -    XlnxEP108 *s = g_new0(XlnxEP108, 1);
 +    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
      int i;
      uint64_t ram_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
      }
-     if (ram_size < 0x08000000) {
+     switch (opcode) {
--        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
++    case 0x01: /* SQADD, UQADD */
-+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
++        tcg_gen_gvec_4(vec_full_reg_offset(s, rd),
-                  ram_size);
++                       offsetof(CPUARMState, vfp.qc),
-     }
++                       vec_full_reg_offset(s, rn),
++                       vec_full_reg_offset(s, rm),
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
++                       is_q ? 16 : 8, vec_full_reg_size(s),
++                       (u ? uqadd_op : sqadd_op) + size);
-     /* TODO create and connect IDE devices for ide_drive_get() */
++        return;
++    case 0x05: /* SQSUB, UQSUB */
--    xlnx_ep108_binfo.ram_size = ram_size;
++        tcg_gen_gvec_4(vec_full_reg_offset(s, rd),
--    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
++                       offsetof(CPUARMState, vfp.qc),
--    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
++                       vec_full_reg_offset(s, rn),
--    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
++                       vec_full_reg_offset(s, rm),
--    xlnx_ep108_binfo.loader_start = 0;
++                       is_q ? 16 : 8, vec_full_reg_size(s),
--    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
++                       (u ? uqsub_op : sqsub_op) + size);
-+    xlnx_zcu102_binfo.ram_size = ram_size;
++        return;
-+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+     case 0x0c: /* SMAX, UMAX */
-+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+         if (u) {
-+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+             gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umax, size);
-+    xlnx_zcu102_binfo.loader_start = 0;
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
-+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
+                 genfn = fns[size][u];
- }
+                 break;
+             }
- static void xlnx_ep108_machine_init(MachineClass *mc)
+-            case 0x1: /* SQADD, UQADD */
- {
+-            {
-     mc->desc = "Xilinx ZynqMP EP108 board";
+-                static NeonGenTwoOpEnvFn * const fns[3][2] = {
--    mc->init = xlnx_ep108_init;
+-                    { gen_helper_neon_qadd_s8, gen_helper_neon_qadd_u8 },
-+    mc->init = xlnx_zcu102_init;
+-                    { gen_helper_neon_qadd_s16, gen_helper_neon_qadd_u16 },
-     mc->block_default_type = IF_IDE;
+-                    { gen_helper_neon_qadd_s32, gen_helper_neon_qadd_u32 },
-     mc->units_per_default_bus = 1;
+-                };
-     mc->ignore_memory_transaction_failures = true;
+-                genenvfn = fns[size][u];
-@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+-                break;
- static void xlnx_zcu102_machine_init(MachineClass *mc)
+-            }
- {
+             case 0x2: /* SRHADD, URHADD */
-     mc->desc = "Xilinx ZynqMP ZCU102 board";
+             {
--    mc->init = xlnx_ep108_init;
+                 static NeonGenTwoOpFn * const fns[3][2] = {
-+    mc->init = xlnx_zcu102_init;
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
-     mc->block_default_type = IF_IDE;
+                 genfn = fns[size][u];
-     mc->units_per_default_bus = 1;
+                 break;
-     mc->ignore_memory_transaction_failures = true;
+             }
 -            case 0x5: /* SQSUB, UQSUB */
 -            {
 -                static NeonGenTwoOpEnvFn * const fns[3][2] = {
 -                    { gen_helper_neon_qsub_s8, gen_helper_neon_qsub_u8 },
 -                    { gen_helper_neon_qsub_s16, gen_helper_neon_qsub_u16 },
 -                    { gen_helper_neon_qsub_s32, gen_helper_neon_qsub_u32 },
 -                };
 -                genenvfn = fns[size][u];
 -                break;
 -            }
              case 0x8: /* SSHL, USHL */
              {
                  static NeonGenTwoOpFn * const fns[3][2] = {
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ const GVecGen3 cmtst_op[4] = {
        .vece = MO_64 },
  };
 +static void gen_uqadd_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
 +                          TCGv_vec a, TCGv_vec b)
 +{
 +    TCGv_vec x = tcg_temp_new_vec_matching(t);
 +    tcg_gen_add_vec(vece, x, a, b);
 +    tcg_gen_usadd_vec(vece, t, a, b);
 +    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
 +    tcg_gen_or_vec(vece, sat, sat, x);
 +    tcg_temp_free_vec(x);
 +}
 +
 +const GVecGen4 uqadd_op[4] = {
 +    { .fniv = gen_uqadd_vec,
 +      .fno = gen_helper_gvec_uqadd_b,
 +      .opc = INDEX_op_usadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_8 },
 +    { .fniv = gen_uqadd_vec,
 +      .fno = gen_helper_gvec_uqadd_h,
 +      .opc = INDEX_op_usadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_16 },
 +    { .fniv = gen_uqadd_vec,
 +      .fno = gen_helper_gvec_uqadd_s,
 +      .opc = INDEX_op_usadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_32 },
 +    { .fniv = gen_uqadd_vec,
 +      .fno = gen_helper_gvec_uqadd_d,
 +      .opc = INDEX_op_usadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_64 },
 +};
 +
 +static void gen_sqadd_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
 +                          TCGv_vec a, TCGv_vec b)
 +{
 +    TCGv_vec x = tcg_temp_new_vec_matching(t);
 +    tcg_gen_add_vec(vece, x, a, b);
 +    tcg_gen_ssadd_vec(vece, t, a, b);
 +    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
 +    tcg_gen_or_vec(vece, sat, sat, x);
 +    tcg_temp_free_vec(x);
 +}
 +
 +const GVecGen4 sqadd_op[4] = {
 +    { .fniv = gen_sqadd_vec,
 +      .fno = gen_helper_gvec_sqadd_b,
 +      .opc = INDEX_op_ssadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_8 },
 +    { .fniv = gen_sqadd_vec,
 +      .fno = gen_helper_gvec_sqadd_h,
 +      .opc = INDEX_op_ssadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_16 },
 +    { .fniv = gen_sqadd_vec,
 +      .fno = gen_helper_gvec_sqadd_s,
 +      .opc = INDEX_op_ssadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_32 },
 +    { .fniv = gen_sqadd_vec,
 +      .fno = gen_helper_gvec_sqadd_d,
 +      .opc = INDEX_op_ssadd_vec,
 +      .write_aofs = true,
 +      .vece = MO_64 },
 +};
 +
 +static void gen_uqsub_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
 +                          TCGv_vec a, TCGv_vec b)
 +{
 +    TCGv_vec x = tcg_temp_new_vec_matching(t);
 +    tcg_gen_sub_vec(vece, x, a, b);
 +    tcg_gen_ussub_vec(vece, t, a, b);
 +    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
 +    tcg_gen_or_vec(vece, sat, sat, x);
 +    tcg_temp_free_vec(x);
 +}
 +
 +const GVecGen4 uqsub_op[4] = {
 +    { .fniv = gen_uqsub_vec,
 +      .fno = gen_helper_gvec_uqsub_b,
 +      .opc = INDEX_op_ussub_vec,
 +      .write_aofs = true,
 +      .vece = MO_8 },
 +    { .fniv = gen_uqsub_vec,
 +      .fno = gen_helper_gvec_uqsub_h,
 +      .opc = INDEX_op_ussub_vec,
 +      .write_aofs = true,
 +      .vece = MO_16 },
 +    { .fniv = gen_uqsub_vec,
 +      .fno = gen_helper_gvec_uqsub_s,
 +      .opc = INDEX_op_ussub_vec,
 +      .write_aofs = true,
 +      .vece = MO_32 },
 +    { .fniv = gen_uqsub_vec,
 +      .fno = gen_helper_gvec_uqsub_d,
 +      .opc = INDEX_op_ussub_vec,
 +      .write_aofs = true,
 +      .vece = MO_64 },
 +};
 +
 +static void gen_sqsub_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
 +                          TCGv_vec a, TCGv_vec b)
 +{
 +    TCGv_vec x = tcg_temp_new_vec_matching(t);
 +    tcg_gen_sub_vec(vece, x, a, b);
 +    tcg_gen_sssub_vec(vece, t, a, b);
 +    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
 +    tcg_gen_or_vec(vece, sat, sat, x);
 +    tcg_temp_free_vec(x);
 +}
 +
 +const GVecGen4 sqsub_op[4] = {
 +    { .fniv = gen_sqsub_vec,
 +      .fno = gen_helper_gvec_sqsub_b,
 +      .opc = INDEX_op_sssub_vec,
 +      .write_aofs = true,
 +      .vece = MO_8 },
 +    { .fniv = gen_sqsub_vec,
 +      .fno = gen_helper_gvec_sqsub_h,
 +      .opc = INDEX_op_sssub_vec,
 +      .write_aofs = true,
 +      .vece = MO_16 },
 +    { .fniv = gen_sqsub_vec,
 +      .fno = gen_helper_gvec_sqsub_s,
 +      .opc = INDEX_op_sssub_vec,
 +      .write_aofs = true,
 +      .vece = MO_32 },
 +    { .fniv = gen_sqsub_vec,
 +      .fno = gen_helper_gvec_sqsub_d,
 +      .opc = INDEX_op_sssub_vec,
 +      .write_aofs = true,
 +      .vece = MO_64 },
 +};
 +
  /* Translate a NEON data processing instruction.  Return nonzero if the
     instruction is invalid.
     We process data in a mixture of 32-bit and 64-bit chunks.
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
              }
              return 0;
 +        case NEON_3R_VQADD:
 +            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
 +                           rn_ofs, rm_ofs, vec_size, vec_size,
 +                           (u ? uqadd_op : sqadd_op) + size);
 +            break;
 +
 +        case NEON_3R_VQSUB:
 +            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
 +                           rn_ofs, rm_ofs, vec_size, vec_size,
 +                           (u ? uqsub_op : sqsub_op) + size);
 +            break;
 +
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
                  /* Polynomial case allows only P8 and is handled below.  */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                  neon_load_reg64(cpu_V0, rn + pass);
                  neon_load_reg64(cpu_V1, rm + pass);
                  switch (op) {
 -                case NEON_3R_VQADD:
 -                    if (u) {
 -                        gen_helper_neon_qadd_u64(cpu_V0, cpu_env,
 -                                                 cpu_V0, cpu_V1);
 -                    } else {
 -                        gen_helper_neon_qadd_s64(cpu_V0, cpu_env,
 -                                                 cpu_V0, cpu_V1);
 -                    }
 -                    break;
 -                case NEON_3R_VQSUB:
 -                    if (u) {
 -                        gen_helper_neon_qsub_u64(cpu_V0, cpu_env,
 -                                                 cpu_V0, cpu_V1);
 -                    } else {
 -                        gen_helper_neon_qsub_s64(cpu_V0, cpu_env,
 -                                                 cpu_V0, cpu_V1);
 -                    }
 -                    break;
                  case NEON_3R_VSHL:
                      if (u) {
                          gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
          case NEON_3R_VHADD:
              GEN_NEON_INTEGER_OP(hadd);
              break;
 -        case NEON_3R_VQADD:
 -            GEN_NEON_INTEGER_OP_ENV(qadd);
 -            break;
          case NEON_3R_VRHADD:
              GEN_NEON_INTEGER_OP(rhadd);
              break;
          case NEON_3R_VHSUB:
              GEN_NEON_INTEGER_OP(hsub);
              break;
 -        case NEON_3R_VQSUB:
 -            GEN_NEON_INTEGER_OP_ENV(qsub);
 -            break;
          case NEON_3R_VSHL:
              GEN_NEON_INTEGER_OP(shl);
              break;
 diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vec_helper.c
 +++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4)
  DO_FMLA_IDX(gvec_fmla_idx_d, float64, )
  #undef DO_FMLA_IDX
 +
 +#define DO_SAT(NAME, WTYPE, TYPEN, TYPEM, OP, MIN, MAX) \
 +void HELPER(NAME)(void *vd, void *vq, void *vn, void *vm, uint32_t desc)   \
 +{                                                                          \
 +    intptr_t i, oprsz = simd_oprsz(desc);                                  \
 +    TYPEN *d = vd, *n = vn; TYPEM *m = vm;                                 \
 +    bool q = false;                                                        \
 +    for (i = 0; i < oprsz / sizeof(TYPEN); i++) {                          \
 +        WTYPE dd = (WTYPE)n[i] OP m[i];                                    \
 +        if (dd < MIN) {                                                    \
 +            dd = MIN;                                                      \
 +            q = true;                                                      \
 +        } else if (dd > MAX) {                                             \
 +            dd = MAX;                                                      \
 +            q = true;                                                      \
 +        }                                                                  \
 +        d[i] = dd;                                                         \
 +    }                                                                      \
 +    if (q) {                                                               \
 +        uint32_t *qc = vq;                                                 \
 +        qc[0] = 1;                                                         \
 +    }                                                                      \
 +    clear_tail(d, oprsz, simd_maxsz(desc));                                \
 +}
 +
 +DO_SAT(gvec_uqadd_b, int, uint8_t, uint8_t, +, 0, UINT8_MAX)
 +DO_SAT(gvec_uqadd_h, int, uint16_t, uint16_t, +, 0, UINT16_MAX)
 +DO_SAT(gvec_uqadd_s, int64_t, uint32_t, uint32_t, +, 0, UINT32_MAX)
 +
 +DO_SAT(gvec_sqadd_b, int, int8_t, int8_t, +, INT8_MIN, INT8_MAX)
 +DO_SAT(gvec_sqadd_h, int, int16_t, int16_t, +, INT16_MIN, INT16_MAX)
 +DO_SAT(gvec_sqadd_s, int64_t, int32_t, int32_t, +, INT32_MIN, INT32_MAX)
 +
 +DO_SAT(gvec_uqsub_b, int, uint8_t, uint8_t, -, 0, UINT8_MAX)
 +DO_SAT(gvec_uqsub_h, int, uint16_t, uint16_t, -, 0, UINT16_MAX)
 +DO_SAT(gvec_uqsub_s, int64_t, uint32_t, uint32_t, -, 0, UINT32_MAX)
 +
 +DO_SAT(gvec_sqsub_b, int, int8_t, int8_t, -, INT8_MIN, INT8_MAX)
 +DO_SAT(gvec_sqsub_h, int, int16_t, int16_t, -, INT16_MIN, INT16_MAX)
 +DO_SAT(gvec_sqsub_s, int64_t, int32_t, int32_t, -, INT32_MIN, INT32_MAX)
 +
 +#undef DO_SAT
 +
 +void HELPER(gvec_uqadd_d)(void *vd, void *vq, void *vn,
 +                          void *vm, uint32_t desc)
 +{
 +    intptr_t i, oprsz = simd_oprsz(desc);
 +    uint64_t *d = vd, *n = vn, *m = vm;
 +    bool q = false;
 +
 +    for (i = 0; i < oprsz / 8; i++) {
 +        uint64_t nn = n[i], mm = m[i], dd = nn + mm;
 +        if (dd < nn) {
 +            dd = UINT64_MAX;
 +            q = true;
 +        }
 +        d[i] = dd;
 +    }
 +    if (q) {
 +        uint32_t *qc = vq;
 +        qc[0] = 1;
 +    }
 +    clear_tail(d, oprsz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_uqsub_d)(void *vd, void *vq, void *vn,
 +                          void *vm, uint32_t desc)
 +{
 +    intptr_t i, oprsz = simd_oprsz(desc);
 +    uint64_t *d = vd, *n = vn, *m = vm;
 +    bool q = false;
 +
 +    for (i = 0; i < oprsz / 8; i++) {
 +        uint64_t nn = n[i], mm = m[i], dd = nn - mm;
 +        if (nn < mm) {
 +            dd = 0;
 +            q = true;
 +        }
 +        d[i] = dd;
 +    }
 +    if (q) {
 +        uint32_t *qc = vq;
 +        qc[0] = 1;
 +    }
 +    clear_tail(d, oprsz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_sqadd_d)(void *vd, void *vq, void *vn,
 +                          void *vm, uint32_t desc)
 +{
 +    intptr_t i, oprsz = simd_oprsz(desc);
 +    int64_t *d = vd, *n = vn, *m = vm;
 +    bool q = false;
 +
 +    for (i = 0; i < oprsz / 8; i++) {
 +        int64_t nn = n[i], mm = m[i], dd = nn + mm;
 +        if (((dd ^ nn) & ~(nn ^ mm)) & INT64_MIN) {
 +            dd = (nn >> 63) ^ ~INT64_MIN;
 +            q = true;
 +        }
 +        d[i] = dd;
 +    }
 +    if (q) {
 +        uint32_t *qc = vq;
 +        qc[0] = 1;
 +    }
 +    clear_tail(d, oprsz, simd_maxsz(desc));
 +}
 +
 +void HELPER(gvec_sqsub_d)(void *vd, void *vq, void *vn,
 +                          void *vm, uint32_t desc)
 +{
 +    intptr_t i, oprsz = simd_oprsz(desc);
 +    int64_t *d = vd, *n = vn, *m = vm;
 +    bool q = false;
 +
 +    for (i = 0; i < oprsz / 8; i++) {
 +        int64_t nn = n[i], mm = m[i], dd = nn - mm;
 +        if (((dd ^ nn) & (nn ^ mm)) & INT64_MIN) {
 +            dd = (nn >> 63) ^ ~INT64_MIN;
 +            q = true;
 +        }
 +        d[i] = dd;
 +    }
 +    if (q) {
 +        uint32_t *qc = vq;
 +        qc[0] = 1;
 +    }
 +    clear_tail(d, oprsz, simd_maxsz(desc));
 +}
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 09/18] xlnx-zcu102: Manually create the machines
+[Qemu-devel] [PULL 26/27] target/arm: Add missing clear_tail calls
-From: Alistair Francis <alistair.francis@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-In preperation for future work let's manually create the Xilnx machines.
+Fortunately, the functions affected are so far only called from SVE,
-This will allow us to set properties for the machines in the future.
+so there is no tail to be cleared.  But as we convert more of AdvSIMD
 to gvec, this will matter.
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20190209033847.9014-13-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
+ target/arm/vec_helper.c | 2 ++
-file changed, 67 insertions(+), 7 deletions(-)
+file changed, 2 insertions(+)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/vec_helper.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/vec_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *stat, uint32_t desc)  \
- #include "qemu/log.h"
+     for (i = 0; i < oprsz / sizeof(TYPE); i++) {                  \
+         d[i] = FUNC(n[i], stat);                                  \
- typedef struct XlnxZCU102 {
+     }                                                             \
-+    MachineState parent_obj;
++    clear_tail(d, oprsz, simd_maxsz(desc));                       \
 +
      XlnxZynqMPState soc;
      MemoryRegion ddr_ram;
  } XlnxZCU102;
 +#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
 +#define ZCU102_MACHINE(obj) \
 +    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
 +
 +#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
 +#define EP108_MACHINE(obj) \
 +    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
 +
  static struct arm_boot_info xlnx_zcu102_binfo;
 -static void xlnx_zcu102_init(MachineState *machine)
 +static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
  {
 -    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
      int i;
      uint64_t ram_size = machine->ram_size;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
      arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
  }
--static void xlnx_ep108_machine_init(MachineClass *mc)
+ DO_2OP(gvec_frecpe_h, helper_recpe_f16, float16)
-+static void xlnx_ep108_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *stat, uint32_t desc) \
-+{
+     for (i = 0; i < oprsz / sizeof(TYPE); i++) {                           \
-+    XlnxZCU102 *s = EP108_MACHINE(machine);
+         d[i] = FUNC(n[i], m[i], stat);                                     \
-+
+     }                                                                      \
-+    xlnx_zynqmp_init(s, machine);
++    clear_tail(d, oprsz, simd_maxsz(desc));                                \
 +}
 +
 +static void xlnx_ep108_machine_instance_init(Object *obj)
  {
 +}
 +
 +static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
      mc->desc = "Xilinx ZynqMP EP108 board";
 -    mc->init = xlnx_zcu102_init;
 +    mc->init = xlnx_ep108_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
  }
--DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+ DO_3OP(gvec_fadd_h, float16_add, float16)
 +static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
 +    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
 +    .parent     = TYPE_MACHINE,
 +    .class_init = xlnx_ep108_machine_class_init,
 +    .instance_init = xlnx_ep108_machine_instance_init,
 +    .instance_size = sizeof(XlnxZCU102),
 +};
 -static void xlnx_zcu102_machine_init(MachineClass *mc)
 +static void xlnx_ep108_machine_init_register_types(void)
  {
 +    type_register_static(&xlnx_ep108_machine_init_typeinfo);
 +}
 +
 +static void xlnx_zcu102_init(MachineState *machine)
 +{
 +    XlnxZCU102 *s = ZCU102_MACHINE(machine);
 +
 +    xlnx_zynqmp_init(s, machine);
 +}
 +
 +static void xlnx_zcu102_machine_instance_init(Object *obj)
 +{
 +}
 +
 +static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 +{
 +    MachineClass *mc = MACHINE_CLASS(oc);
 +
      mc->desc = "Xilinx ZynqMP ZCU102 board";
      mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
      mc->ignore_memory_transaction_failures = true;
  }
 -DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
 +static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
 +    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
 +    .parent     = TYPE_MACHINE,
 +    .class_init = xlnx_zcu102_machine_class_init,
 +    .instance_init = xlnx_zcu102_machine_instance_init,
 +    .instance_size = sizeof(XlnxZCU102),
 +};
 +
 +static void xlnx_zcu102_machine_init_register_types(void)
 +{
 +    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
 +}
 +
 +type_init(xlnx_zcu102_machine_init_register_types)
 +type_init(xlnx_ep108_machine_init_register_types)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 16/18] hw/arm/virt: Set INTx/gsi mapping
+[Qemu-devel] [PULL 27/27] gdbstub: Send a reply to the vKill packet.
-From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+From: Sandra Loosemore <sandra@codesourcery.com>
-Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
+Per the GDB remote protocol documentation
 needed for INTx/gsi routing.
-Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
+https://sourceware.org/gdb/current/onlinedocs/gdb/Packets.html#index-vKill-packet
-Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+the debug stub is expected to send a reply to the 'vKill' packet.  At
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+least some versions of GDB crash if the gdb stub simply exits without
-Tested-by: Feng Kan <fkan@apm.com>
+sending a reply.  This patch fixes QEMU's gdb stub to conform to the
-Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
+expected behavior.
 Note that QEMU's existing handling of the legacy 'k' packet is
 correct: in that case GDB does not expect a reply, and QEMU does not
 send one.
 Signed-off-by: Sandra Loosemore <sandra@codesourcery.com>
 Message-id: 1550008033-26540-1-git-send-email-sandra@codesourcery.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 1 +
+ gdbstub.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/gdbstub.c b/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/gdbstub.c
-+++ b/hw/arm/virt.c
++++ b/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
+             break;
-     for (i = 0; i < GPEX_NUM_IRQS; i++) {
+         } else if (strncmp(p, "Kill;", 5) == 0) {
-         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+             /* Kill the target */
-+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
++            put_packet(s, "OK");
-     }
+             error_report("QEMU: Terminated via GDBstub");
+             exit(0);
-     pci = PCI_HOST_BRIDGE(dev);
+         } else {
 --
-.7.4
+.20.1

ARM queue: nothing particularly exciting, but 18 patches
is enough to send out.

thanks
-- PMM

The following changes since commit 3dabde1128b671f36ac6cb36b97b273139964420:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-hmp-20170914' into staging (2017-09-14 16:33:02 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20170914

for you to fetch changes up to ce3bc112cdb1d462e2d52eaa17a7314e7f3af504:

mps2-an511: Fix wiring of UART overflow interrupt lines (2017-09-14 18:43:19 +0100)

----------------------------------------------------------------
target-arm queue:
 * v7M: various code cleanups
 * v7M: set correct BFSR bits on bus fault
 * v7M: clear exclusive monitor on reset and exception entry/exit
 * v7M: don't apply priority mask to negative priorities
 * zcu102: support 'secure' and 'virtualization' machine properties
 * aarch64: fix ERET single stepping
 * gpex: implement PCI INTx routing
 * mps2-an511: fix UART overflow interrupt line wiring

----------------------------------------------------------------
Alistair Francis (5):
      xlnx-ep108: Rename to ZCU102
      xlnx-zcu102: Manually create the machines
      xlnx-zcu102: Add a machine level secure property
      xlnx-zcu102: Add a machine level virtualization property
      xlnx-zcu102: Mark the EP108 machine as deprecated

Jaroslaw Pelczar (1):
      AArch64: Fix single stepping of ERET instruction

Peter Maydell (8):
      target/arm: Use M_REG_NUM_BANKS rather than hardcoding 2
      target/arm: Clear exclusive monitor on v7M reset, exception entry/exit
      target/arm: Get PRECISERR and IBUSERR the right way round
      nvic: Don't apply group priority mask to negative priorities
      target/arm: Remove unnecessary '| 0xf0000000' from do_v7m_exception_exit()
      target/arm: Add and use defines for EXCRET constants
      target/arm: Rename 'type' to 'excret' in do_v7m_exception_exit()
      mps2-an511: Fix wiring of UART overflow interrupt lines

Pranavkumar Sawargaonkar (3):
      hw/pci-host/gpex: Set INTx index/gsi mapping
      hw/arm/virt: Set INTx/gsi mapping
      hw/pci-host/gpex: Implement PCI INTx routing

Richard Henderson (1):
      target/arm: Avoid an extra temporary for store_exclusive

Use a symbolic constant M_REG_NUM_BANKS for the array size for
registers which are banked by M profile security state, rather
than hardcoding lots of 2s.

Suggested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-2-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
  * accessed via env->registerfield[env->v7m.secure] (whether the security
  * extension is implemented or not).
  */
-#define M_REG_NS 0
-#define M_REG_S 1
+enum {
+    M_REG_NS = 0,
+    M_REG_S = 1,
+    M_REG_NUM_BANKS = 2,
+};
 
 /* ARM-specific interrupt pending bits.  */
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t other_sp;
         uint32_t other_ss_msp;
         uint32_t other_ss_psp;
-        uint32_t vecbase[2];
-        uint32_t basepri[2];
-        uint32_t control[2];
-        uint32_t ccr[2]; /* Configuration and Control */
-        uint32_t cfsr[2]; /* Configurable Fault Status */
+        uint32_t vecbase[M_REG_NUM_BANKS];
+        uint32_t basepri[M_REG_NUM_BANKS];
+        uint32_t control[M_REG_NUM_BANKS];
+        uint32_t ccr[M_REG_NUM_BANKS]; /* Configuration and Control */
+        uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
-        uint32_t mmfar[2]; /* MemManage Fault Address */
+        uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
-        unsigned mpu_ctrl[2]; /* MPU_CTRL */
+        unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
-        uint32_t primask[2];
-        uint32_t faultmask[2];
+        uint32_t primask[M_REG_NUM_BANKS];
+        uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
     } v7m;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t *drbar;
         uint32_t *drsr;
         uint32_t *dracr;
-        uint32_t rnr[2];
+        uint32_t rnr[M_REG_NUM_BANKS];
     } pmsav7;
 
     /* PMSAv8 MPU */
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          *  pmsav7.rnr (region number register)
          *  pmsav7_dregion (number of configured regions)
          */
-        uint32_t *rbar[2];
-        uint32_t *rlar[2];
-        uint32_t mair0[2];
-        uint32_t mair1[2];
+        uint32_t *rbar[M_REG_NUM_BANKS];
+        uint32_t *rlar[M_REG_NUM_BANKS];
+        uint32_t mair0[M_REG_NUM_BANKS];
+        uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
     void *nvic;
-- 
2.7.4

For M profile we must clear the exclusive monitor on reset, exception
entry and exception exit.  We weren't doing any of these things; fix
this bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/cpu.c       |  6 ++++++
 target/arm/helper.c    |  2 ++
 target/arm/op_helper.c |  2 +-
 4 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu);
 #endif
 
 /**
+ * arm_clear_exclusive: clear the exclusive monitor
+ * @env: CPU env
+ * Clear the CPU's exclusive monitor, like the guest CLREX instruction.
+ */
+static inline void arm_clear_exclusive(CPUARMState *env)
+{
+    env->exclusive_addr = -1;
+}
+
+/**
  * ARMMMUFaultInfo: Information describing an ARM MMU Fault
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->regs[15] = 0xFFFF0000;
     }
 
+    /* M profile requires that reset clears the exclusive monitor;
+     * A profile does not, but clearing it makes more sense than having it
+     * set with an exclusive access on address zero.
+     */
+    arm_clear_exclusive(env);
+
     env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 
     armv7m_nvic_acknowledge_irq(env->nvic);
     switch_v7m_sp(env, 0);
+    arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     }
 
     /* Otherwise, we have a successful exception exit. */
+    arm_clear_exclusive(env);
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env)
 
     aarch64_save_sp(env, cur_el);
 
-    env->exclusive_addr = -1;
+    arm_clear_exclusive(env);
 
     /* We must squash the PSTATE.SS bit to zero unless both of the
      * following hold:
-- 
2.7.4

For a bus fault, the M profile BFSR bit PRECISERR means a bus
fault on a data access, and IBUSERR means a bus fault on an
instruction access. We had these the wrong way around; fix this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
-                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_PRECISERR_MASK;
-                qemu_log_mask(CPU_LOG_INT, "...with CFSR.PRECISERR\n");
+                env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+                qemu_log_mask(CPU_LOG_INT, "...with CFSR.IBUSERR\n");
                 break;
             case EXCP_DATA_ABORT:
                 env->v7m.cfsr[M_REG_NS] |=
-                    (R_V7M_CFSR_IBUSERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
+                    (R_V7M_CFSR_PRECISERR_MASK | R_V7M_CFSR_BFARVALID_MASK);
                 env->v7m.bfar = env->exception.vaddress;
                 qemu_log_mask(CPU_LOG_INT,
-                              "...with CFSR.IBUSERR and BFAR 0x%x\n",
+                              "...with CFSR.PRECISERR and BFAR 0x%x\n",
                               env->v7m.bfar);
                 break;
             }
-- 
2.7.4

In several places we were unconditionally applying the
nvic_gprio_mask() to a priority value. This is incorrect
if the priority is one of the fixed negative priority
values (for NMI and HardFault), so don't do it.

This bug would have caused both NMI and HardFault to be
considered as the same priority and so NMI wouldn't
correctly preempt HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-5-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state(NVICState *s)
         }
     }
 
+    if (active_prio > 0) {
+        active_prio &= nvic_gprio_mask(s);
+    }
+
     s->vectpending = pend_irq;
-    s->exception_prio = active_prio & nvic_gprio_mask(s);
+    s->exception_prio = active_prio;
 
     trace_nvic_recompute_state(s->vectpending, s->exception_prio);
 }
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     assert(vec->enabled);
     assert(vec->pending);
 
-    pendgroupprio = vec->prio & nvic_gprio_mask(s);
+    pendgroupprio = vec->prio;
+    if (pendgroupprio > 0) {
+        pendgroupprio &= nvic_gprio_mask(s);
+    }
     assert(pendgroupprio < running);
 
     trace_nvic_acknowledge_irq(pending, vec->prio);
-- 
2.7.4

In do_v7m_exception_exit(), there's no need to force the high 4
bits of 'type' to 1 when calling v7m_exception_taken(), because
we know that they're always 1 or we could not have got to this
"handle return to magic exception return address" code. Remove
the unnecessary ORs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type | 0xf0000000);
+        v7m_exception_taken(cpu, type);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

The exception-return magic values get some new bits in v8M, which
makes some bit definitions for them worthwhile.

We don't use the bit definitions for the switch on the low bits
which checks the return type for v7M, because this is defined
in the v7M ARM ARM as a set of valid values rather than via
per-bit checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505137930-13255-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    | 14 +++++++++-----
 2 files changed, 19 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
 
+/* Bit definitions for v7M exception return payload */
+FIELD(V7M_EXCRET, ES, 0, 1)
+FIELD(V7M_EXCRET, RES0, 1, 1)
+FIELD(V7M_EXCRET, SPSEL, 2, 1)
+FIELD(V7M_EXCRET, MODE, 3, 1)
+FIELD(V7M_EXCRET, FTYPE, 4, 1)
+FIELD(V7M_EXCRET, DCRS, 5, 1)
+FIELD(V7M_EXCRET, S, 6, 1)
+FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                   " previous exception %d\n",
                   type, env->v7m.exception);
 
-    if (extract32(type, 5, 23) != extract32(-1, 5, 23)) {
+    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
                       "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
     }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & 1;
+            int es = type & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = 0xfffffff1;
+    lr = R_V7M_EXCRET_RES1_MASK |
+        R_V7M_EXCRET_S_MASK |
+        R_V7M_EXCRET_DCRS_MASK |
+        R_V7M_EXCRET_FTYPE_MASK |
+        R_V7M_EXCRET_ES_MASK;
     if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= 4;
+        lr |= R_V7M_EXCRET_SPSEL_MASK;
     }
     if (!arm_v7m_is_handler_mode(env)) {
-        lr |= 8;
+        lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-- 
2.7.4

In the v7M and v8M ARM ARM, the magic exception return values are
referred to as EXC_RETURN values, and in QEMU we use V7M_EXCRET_*
constants to define bits within them. Rename the 'type' variable
which holds the exception return value in do_v7m_exception_exit()
to excret, making it clearer that it does hold an EXC_RETURN value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1505137930-13255-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t type;
+    uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
     bool return_to_sp_process = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * the target value up between env->regs[15] and env->thumb in
      * gen_bx(). Reconstitute it.
      */
-    type = env->regs[15];
+    excret = env->regs[15];
     if (env->thumb) {
-        type |= 1;
+        excret |= 1;
     }
 
     qemu_log_mask(CPU_LOG_INT, "Exception return: magic PC %" PRIx32
                   " previous exception %d\n",
-                  type, env->v7m.exception);
+                  excret, env->v7m.exception);
 
-    if ((type & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
+    if ((excret & R_V7M_EXCRET_RES1_MASK) != R_V7M_EXCRET_RES1_MASK) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero high bits in exception "
-                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n", type);
+                      "exit PC value 0x%" PRIx32 " are UNPREDICTABLE\n",
+                      excret);
     }
 
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * which security state's faultmask to clear. (v8M ARM ARM R_KBNF.)
          */
         if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
-            int es = type & R_V7M_EXCRET_ES_MASK;
+            int es = excret & R_V7M_EXCRET_ES_MASK;
             if (armv7m_nvic_raw_execution_priority(env->nvic) >= 0) {
                 env->v7m.faultmask[es] = 0;
             }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
-    switch (type & 0xf) {
+    switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
         break;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-     * exception return type specified then this is a UsageFault.
+     * exception return excret specified then this is a UsageFault.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
         /* Take an INVPC UsageFault by pushing the stack again. */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, type);
+        v7m_exception_taken(cpu, excret);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 is a early access development board. Now that silicon is in
production people have access to the ZCU102. Let's rename the internal
QEMU files and variables to use the ZCU102.

There is no functional change here as the EP108 is still a valid board
option.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                   |  2 +-
 hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} | 30 +++++++++++++++---------------
 2 files changed, 16 insertions(+), 16 deletions(-)
 rename hw/arm/{xlnx-ep108.c => xlnx-zcu102.c} (85%)

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-y += omap1.o omap2.o strongarm.o
 obj-$(CONFIG_ALLWINNER_A10) += allwinner-a10.o cubieboard.o
 obj-$(CONFIG_RASPI) += bcm2835_peripherals.o bcm2836.o raspi.o
 obj-$(CONFIG_STM32F205_SOC) += stm32f205_soc.o
-obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-ep108.o
+obj-$(CONFIG_XLNX_ZYNQMP) += xlnx-zynqmp.o xlnx-zcu102.o
 obj-$(CONFIG_FSL_IMX25) += fsl-imx25.o imx25_pdk.o
 obj-$(CONFIG_FSL_IMX31) += fsl-imx31.o kzm.o
 obj-$(CONFIG_FSL_IMX6) += fsl-imx6.o sabrelite.o
diff --git a/hw/arm/xlnx-ep108.c b/hw/arm/xlnx-zcu102.c
similarity index 85%
rename from hw/arm/xlnx-ep108.c
rename to hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-ep108.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 /*
- * Xilinx ZynqMP EP108 board
+ * Xilinx ZynqMP ZCU102 board
  *
  * Copyright (C) 2015 Xilinx Inc
  * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com>
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "qemu/log.h"
 
-typedef struct XlnxEP108 {
+typedef struct XlnxZCU102 {
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
-} XlnxEP108;
+} XlnxZCU102;
 
-static struct arm_boot_info xlnx_ep108_binfo;
+static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_ep108_init(MachineState *machine)
+static void xlnx_zcu102_init(MachineState *machine)
 {
-    XlnxEP108 *s = g_new0(XlnxEP108, 1);
+    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
     }
 
     if (ram_size < 0x08000000) {
-        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for EP108",
+        qemu_log("WARNING: RAM size 0x%" PRIx64 " is small for ZCU102",
                  ram_size);
     }
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
     /* TODO create and connect IDE devices for ide_drive_get() */
 
-    xlnx_ep108_binfo.ram_size = ram_size;
-    xlnx_ep108_binfo.kernel_filename = machine->kernel_filename;
-    xlnx_ep108_binfo.kernel_cmdline = machine->kernel_cmdline;
-    xlnx_ep108_binfo.initrd_filename = machine->initrd_filename;
-    xlnx_ep108_binfo.loader_start = 0;
-    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_ep108_binfo);
+    xlnx_zcu102_binfo.ram_size = ram_size;
+    xlnx_zcu102_binfo.kernel_filename = machine->kernel_filename;
+    xlnx_zcu102_binfo.kernel_cmdline = machine->kernel_cmdline;
+    xlnx_zcu102_binfo.initrd_filename = machine->initrd_filename;
+    xlnx_zcu102_binfo.loader_start = 0;
+    arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
 static void xlnx_ep108_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
 static void xlnx_zcu102_machine_init(MachineClass *mc)
 {
     mc->desc = "Xilinx ZynqMP ZCU102 board";
-    mc->init = xlnx_ep108_init;
+    mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

In preperation for future work let's manually create the Xilnx machines.
This will allow us to set properties for the machines in the future.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 67 insertions(+), 7 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 typedef struct XlnxZCU102 {
+    MachineState parent_obj;
+
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
 } XlnxZCU102;
 
+#define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
+#define ZCU102_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_ZCU102_MACHINE)
+
+#define TYPE_EP108_MACHINE   MACHINE_TYPE_NAME("xlnx-ep108")
+#define EP108_MACHINE(obj) \
+    OBJECT_CHECK(XlnxZCU102, (obj), TYPE_EP108_MACHINE)
+
 static struct arm_boot_info xlnx_zcu102_binfo;
 
-static void xlnx_zcu102_init(MachineState *machine)
+static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
-    XlnxZCU102 *s = g_new0(XlnxZCU102, 1);
     int i;
     uint64_t ram_size = machine->ram_size;
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
     arm_load_kernel(s->soc.boot_cpu_ptr, &xlnx_zcu102_binfo);
 }
 
-static void xlnx_ep108_machine_init(MachineClass *mc)
+static void xlnx_ep108_init(MachineState *machine)
+{
+    XlnxZCU102 *s = EP108_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+}
+
+static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP EP108 board";
-    mc->init = xlnx_zcu102_init;
+    mc->init = xlnx_ep108_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-ep108", xlnx_ep108_machine_init)
+static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-ep108"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_ep108_machine_class_init,
+    .instance_init = xlnx_ep108_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
 
-static void xlnx_zcu102_machine_init(MachineClass *mc)
+static void xlnx_ep108_machine_init_register_types(void)
 {
+    type_register_static(&xlnx_ep108_machine_init_typeinfo);
+}
+
+static void xlnx_zcu102_init(MachineState *machine)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(machine);
+
+    xlnx_zynqmp_init(s, machine);
+}
+
+static void xlnx_zcu102_machine_instance_init(Object *obj)
+{
+}
+
+static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Xilinx ZynqMP ZCU102 board";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("xlnx-zcu102", xlnx_zcu102_machine_init)
+static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+    .name       = MACHINE_TYPE_NAME("xlnx-zcu102"),
+    .parent     = TYPE_MACHINE,
+    .class_init = xlnx_zcu102_machine_class_init,
+    .instance_init = xlnx_zcu102_machine_instance_init,
+    .instance_size = sizeof(XlnxZCU102),
+};
+
+static void xlnx_zcu102_machine_init_register_types(void)
+{
+    type_register_static(&xlnx_zcu102_machine_init_typeinfo);
+}
+
+type_init(xlnx_zcu102_machine_init_register_types)
+type_init(xlnx_ep108_machine_init_register_types)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level secure property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,secure=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
     XlnxZynqMPState soc;
     MemoryRegion ddr_ram;
+
+    bool secure;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
 
 static struct arm_boot_info xlnx_zcu102_binfo;
 
+static bool zcu102_get_secure(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->secure;
+}
+
+static void zcu102_set_secure(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->secure = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 
     object_property_set_link(OBJECT(&s->soc), OBJECT(&s->ddr_ram),
                          "ddr-ram", &error_abort);
+    object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 
 static void xlnx_ep108_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = EP108_MACHINE(obj);
+
+    /* EP108, we don't support setting secure */
+    s->secure = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_init(MachineState *machine)
 
 static void xlnx_zcu102_machine_instance_init(Object *obj)
 {
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    /* Default to secure mode being disabled */
+    s->secure = false;
+    object_property_add_bool(obj, "secure", zcu102_get_secure,
+                             zcu102_set_secure, NULL);
+    object_property_set_description(obj, "secure",
+                                    "Set on/off to enable/disable the ARM "
+                                    "Security Extensions (TrustZone)",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Add a machine level virtualization property. This defaults to false and can be
set to true using this machine command line argument:
    -machine xlnx-zcu102,virtualization=on

This follows what the ARM virt machine does.

This property only applies to the ZCU102 machine. The EP108 machine does
not have this property.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zcu102.c         | 30 +++++++++++++++++++++++++++++-
 hw/arm/xlnx-zynqmp.c         |  3 ++-
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZynqMPState {
 
     /* Has the ARM Security extensions?  */
     bool secure;
+    /* Has the ARM Virtualization extensions?  */
+    bool virt;
     /* Has the RPU subsystem?  */
     bool has_rpu;
 }  XlnxZynqMPState;
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxZCU102 {
     MemoryRegion ddr_ram;
 
     bool secure;
+    bool virt;
 } XlnxZCU102;
 
 #define TYPE_ZCU102_MACHINE   MACHINE_TYPE_NAME("xlnx-zcu102")
@@ -XXX,XX +XXX,XX @@ static void zcu102_set_secure(Object *obj, bool value, Error **errp)
     s->secure = value;
 }
 
+static bool zcu102_get_virt(Object *obj, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    return s->virt;
+}
+
+static void zcu102_set_virt(Object *obj, bool value, Error **errp)
+{
+    XlnxZCU102 *s = ZCU102_MACHINE(obj);
+
+    s->virt = value;
+}
+
 static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(XlnxZCU102 *s, MachineState *machine)
                          "ddr-ram", &error_abort);
     object_property_set_bool(OBJECT(&s->soc), s->secure, "secure",
                              &error_fatal);
+    object_property_set_bool(OBJECT(&s->soc), s->virt, "virtualization",
+                             &error_fatal);
 
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_fatal);
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_instance_init(Object *obj)
 {
     XlnxZCU102 *s = EP108_MACHINE(obj);
 
-    /* EP108, we don't support setting secure */
+    /* EP108, we don't support setting secure or virt */
     s->secure = false;
+    s->virt = false;
 }
 
 static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_instance_init(Object *obj)
                                     "Set on/off to enable/disable the ARM "
                                     "Security Extensions (TrustZone)",
                                     NULL);
+
+    /* Default to virt (EL2) being disabled */
+    s->virt = false;
+    object_property_add_bool(obj, "virtualization", zcu102_get_virt,
+                             zcu102_set_virt, NULL);
+    object_property_set_description(obj, "virtualization",
+                                    "Set on/off to enable/disable emulating a "
+                                    "guest CPU which implements the ARM "
+                                    "Virtualization Extensions",
+                                    NULL);
 }
 
 static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
                                  s->secure, "has_el3", NULL);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]),
-                                 false, "has_el2", NULL);
+                                 s->virt, "has_el2", NULL);
         object_property_set_int(OBJECT(&s->apu_cpu[i]), GIC_BASE_ADDR,
                                 "reset-cbar", &error_abort);
         object_property_set_bool(OBJECT(&s->apu_cpu[i]), true, "realized",
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 static Property xlnx_zynqmp_props[] = {
     DEFINE_PROP_STRING("boot-cpu", XlnxZynqMPState, boot_cpu),
     DEFINE_PROP_BOOL("secure", XlnxZynqMPState, secure, false),
+    DEFINE_PROP_BOOL("virtualization", XlnxZynqMPState, virt, false),
     DEFINE_PROP_BOOL("has_rpu", XlnxZynqMPState, has_rpu, false),
     DEFINE_PROP_LINK("ddr-ram", XlnxZynqMPState, ddr_ram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-- 
2.7.4

From: Jaroslaw Pelczar <j.pelczar@samsung.com>

Previously when single stepping through ERET instruction via GDB
would result in debugger entering the "next" PC after ERET instruction.
When debugging in kernel mode, this will also cause unintended behavior,
because debugger will try to access memory from EL0 point of view.

Signed-off-by: Jaroslaw Pelczar <j.pelczar@samsung.com>
Message-id: 001c01d32895$483027f0$d89077d0$@samsung.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
         default:
             gen_a64_set_pc_im(dc->pc);
             /* fall through */
+        case DISAS_EXIT:
         case DISAS_JUMP:
             if (dc->base.singlestep_enabled) {
                 gen_exception_internal(EXCP_DEBUG);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Instead of copying addr to a local temp, reuse the value (which we
have just compared as equal) already saved in cpu_exclusive_addr.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170908163859.29820-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 26 +++++++++-----------------
 1 file changed, 9 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
 }
 
 static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
-                                TCGv_i64 inaddr, int size, int is_pair)
+                                TCGv_i64 addr, int size, int is_pair)
 {
     /* if (env->exclusive_addr == addr && env->exclusive_val == [addr]
      *     && (!is_pair || env->exclusive_high == [addr + datasize])) {
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      */
     TCGLabel *fail_label = gen_new_label();
     TCGLabel *done_label = gen_new_label();
-    TCGv_i64 addr = tcg_temp_local_new_i64();
     TCGv_i64 tmp;
 
-    /* Copy input into a local temp so it is not trashed when the
-     * basic block ends at the branch insn.
-     */
-    tcg_gen_mov_i64(addr, inaddr);
     tcg_gen_brcond_i64(TCG_COND_NE, addr, cpu_exclusive_addr, fail_label);
 
     tmp = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
             } else {
                 tcg_gen_concat32_i64(tmp, cpu_reg(s, rt2), cpu_reg(s, rt));
             }
-            tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, tmp,
+            tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr,
+                                       cpu_exclusive_val, tmp,
                                        get_mem_index(s),
                                        MO_64 | MO_ALIGN | s->be_data);
             tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
         } else if (s->be_data == MO_LE) {
-            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_le(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         } else {
-            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, addr, cpu_reg(s, rt),
-                                           cpu_reg(s, rt2));
+            gen_helper_paired_cmpxchg64_be(tmp, cpu_env, cpu_exclusive_addr,
+                                           cpu_reg(s, rt), cpu_reg(s, rt2));
         }
     } else {
-        TCGv_i64 val = cpu_reg(s, rt);
-        tcg_gen_atomic_cmpxchg_i64(tmp, addr, cpu_exclusive_val, val,
-                                   get_mem_index(s),
+        tcg_gen_atomic_cmpxchg_i64(tmp, cpu_exclusive_addr, cpu_exclusive_val,
+                                   cpu_reg(s, rt), get_mem_index(s),
                                    size | MO_ALIGN | s->be_data);
         tcg_gen_setcond_i64(TCG_COND_NE, tmp, tmp, cpu_exclusive_val);
     }
-
-    tcg_temp_free_i64(addr);
-
     tcg_gen_mov_i64(cpu_reg(s, rd), tmp);
     tcg_temp_free_i64(tmp);
     tcg_gen_br(done_label);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

To implement INTx to gsi routing we need to pass the gpex host
bridge the gsi associated to each INTx index. Let's introduce
irq_num array and gpex_set_irq_num setter function.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1505296004-6798-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/pci-host/gpex.h |  3 +++
 hw/pci-host/gpex.c         | 10 ++++++++++
 2 files changed, 13 insertions(+)

diff --git a/include/hw/pci-host/gpex.h b/include/hw/pci-host/gpex.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/gpex.h
+++ b/include/hw/pci-host/gpex.h
@@ -XXX,XX +XXX,XX @@ typedef struct GPEXHost {
     MemoryRegion io_ioport;
     MemoryRegion io_mmio;
     qemu_irq irq[GPEX_NUM_IRQS];
+    int irq_num[GPEX_NUM_IRQS];
 } GPEXHost;
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi);
+
 #endif /* HW_GPEX_H */
diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ static void gpex_set_irq(void *opaque, int irq_num, int level)
     qemu_set_irq(s->irq[irq_num], level);
 }
 
+int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
+{
+    if (index >= GPEX_NUM_IRQS) {
+        return -EINVAL;
+    }
+
+    s->irq_num[index] = gsi;
+    return 0;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Let's provide the GPEX host bridge with the INTx/gsi mapping. This is
needed for INTx/gsi routing.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 
     for (i = 0; i < GPEX_NUM_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+        gpex_set_irq_num(GPEX_HOST(dev), i, irq + i);
     }
 
     pci = PCI_HOST_BRIDGE(dev);
-- 
2.7.4

From: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>

Now we are able to retrieve the gsi from the INTx pin, let's
enable intx_to_irq routing. From that point on, irqfd becomes
usable along with INTx when assigning a PCIe device.

Signed-off-by: Pranavkumar Sawargaonkar <pranavkumar@linaro.org>
Signed-off-by: Tushar Jagad <tushar.jagad@linaro.org>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Feng Kan <fkan@apm.com>
Message-id: 1505296004-6798-4-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci-host/gpex.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/pci-host/gpex.c b/hw/pci-host/gpex.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/gpex.c
+++ b/hw/pci-host/gpex.c
@@ -XXX,XX +XXX,XX @@ int gpex_set_irq_num(GPEXHost *s, int index, int gsi)
     return 0;
 }
 
+static PCIINTxRoute gpex_route_intx_pin_to_irq(void *opaque, int pin)
+{
+    PCIINTxRoute route;
+    GPEXHost *s = opaque;
+
+    route.mode = PCI_INTX_ENABLED;
+    route.irq = s->irq_num[pin];
+
+    return route;
+}
+
 static void gpex_host_realize(DeviceState *dev, Error **errp)
 {
     PCIHostState *pci = PCI_HOST_BRIDGE(dev);
@@ -XXX,XX +XXX,XX @@ static void gpex_host_realize(DeviceState *dev, Error **errp)
                                 &s->io_ioport, 0, 4, TYPE_PCIE_BUS);
 
     qdev_set_parent_bus(DEVICE(&s->gpex_root), BUS(pci->bus));
+    pci_bus_set_route_irq_fn(pci->bus, gpex_route_intx_pin_to_irq);
     qdev_init_nofail(DEVICE(&s->gpex_root));
 }
 
-- 
2.7.4

Fix an error that meant we were wiring every UART's overflow
interrupts into the same inputs 0 and 1 of the OR gate,
rather than giving each its own input.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1505232834-20890-1-git-send-email-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
             cmsdk_apb_uart_create(uartbase[i],
                                   qdev_get_gpio_in(txrx_orgate_dev, 0),
                                   qdev_get_gpio_in(txrx_orgate_dev, 1),
-                                  qdev_get_gpio_in(orgate_dev, 0),
-                                  qdev_get_gpio_in(orgate_dev, 1),
+                                  qdev_get_gpio_in(orgate_dev, i * 2),
+                                  qdev_get_gpio_in(orgate_dev, i * 2 + 1),
                                   NULL,
                                   uartchr, SYSCLK_FRQ);
         }
-- 
2.7.4

The following changes since commit 0d3e41d5efd638a0c5682f6813b26448c3c51624:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-02-14 17:42:25 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190214

for you to fetch changes up to 497bc12b1b374ecd62903bf062229bd93f8924af:

gdbstub: Send a reply to the vKill packet. (2019-02-14 18:45:49 +0000)

----------------------------------------------------------------
target-arm queue:
 * gdbstub: Send a reply to the vKill packet
 * Improve codegen for neon min/max and saturating arithmetic
 * Fix a bug in clearing FPSCR exception status bits
 * hw/arm/armsse: Fix miswiring of expansion IRQs
 * hw/intc/armv7m_nvic: Allow byte accesses to SHPR1
 * MAINTAINERS: Remove Peter Crosthwaite from various entries
 * arm: Allow system registers for KVM guests to be changed by QEMU code
 * linux-user: support HWCAP_CPUID which exposes ID registers to user code
 * Fix bug in 128-bit cmpxchg for BE Arm guests
 * Implement (no-op) HACR_EL2
 * Fix CRn to be 14 for PMEVTYPER/PMEVCNTR

----------------------------------------------------------------
Aaron Lindsay OS (1):
      target/arm: Fix CRn to be 14 for PMEVTYPER/PMEVCNTR

Alex Bennée (5):
      target/arm: relax permission checks for HWCAP_CPUID registers
      target/arm: expose CPUID registers to userspace
      target/arm: expose MPIDR_EL1 to userspace
      target/arm: expose remaining CPUID registers as RAZ
      linux-user/elfload: enable HWCAP_CPUID for AArch64

Catherine Ho (1):
      target/arm: Fix int128_make128 lo, hi order in paired_cmpxchg64_be

Peter Maydell (5):
      target/arm: Implement HACR_EL2
      arm: Allow system registers for KVM guests to be changed by QEMU code
      MAINTAINERS: Remove Peter Crosthwaite from various entries
      hw/intc/armv7m_nvic: Allow byte accesses to SHPR1
      hw/arm/armsse: Fix miswiring of expansion IRQs

Richard Henderson (14):
      target/arm: Force result size into dp after operation
      target/arm: Restructure disas_fp_int_conv
      target/arm: Rely on optimization within tcg_gen_gvec_or
      target/arm: Use vector minmax expanders for aarch64
      target/arm: Use vector minmax expanders for aarch32
      target/arm: Use tcg integer min/max primitives for neon
      target/arm: Remove neon min/max helpers
      target/arm: Fix vfp_gdb_get/set_reg vs FPSCR
      target/arm: Fix arm_cpu_dump_state vs FPSCR
      target/arm: Split out flags setting from vfp compares
      target/arm: Fix set of bits kept in xregs[ARM_VFP_FPSCR]
      target/arm: Split out FPSCR.QC to a vector field
      target/arm: Use vector operations for saturation
      target/arm: Add missing clear_tail calls

Sandra Loosemore (1):
      gdbstub: Send a reply to the vKill packet.

From: Aaron Lindsay OS <aaron@os.amperecomputing.com>

This bug was introduced in:
    commit 5ecdd3e47cadae83a62dc92b472f1fe163b56f59
    target/arm: Finish implementation of PM[X]EVCNTR and PM[X]EVTYPER

Signed-off-by: Aaron Lindsay <aaron@os.amperecomputing.com>
Reported-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20190205135129.19338-1-aaron@os.amperecomputing.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             char *pmevtyper_name = g_strdup_printf("PMEVTYPER%d", i);
             char *pmevtyper_el0_name = g_strdup_printf("PMEVTYPER%d_EL0", i);
             ARMCPRegInfo pmev_regs[] = {
-                { .name = pmevcntr_name, .cp = 15, .crn = 15,
+                { .name = pmevcntr_name, .cp = 15, .crn = 14,
                   .crm = 8 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
                   .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
                   .accessfn = pmreg_access },
                 { .name = pmevcntr_el0_name, .state = ARM_CP_STATE_AA64,
-                  .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 8 | (3 & (i >> 3)),
+                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 8 | (3 & (i >> 3)),
                   .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
                   .type = ARM_CP_IO,
                   .readfn = pmevcntr_readfn, .writefn = pmevcntr_writefn,
                   .raw_readfn = pmevcntr_rawread,
                   .raw_writefn = pmevcntr_rawwrite },
-                { .name = pmevtyper_name, .cp = 15, .crn = 15,
+                { .name = pmevtyper_name, .cp = 15, .crn = 14,
                   .crm = 12 | (3 & (i >> 3)), .opc1 = 0, .opc2 = i & 7,
                   .access = PL0_RW, .type = ARM_CP_IO | ARM_CP_ALIAS,
                   .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
                   .accessfn = pmreg_access },
                 { .name = pmevtyper_el0_name, .state = ARM_CP_STATE_AA64,
-                  .opc0 = 3, .opc1 = 3, .crn = 15, .crm = 12 | (3 & (i >> 3)),
+                  .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 12 | (3 & (i >> 3)),
                   .opc2 = i & 7, .access = PL0_RW, .accessfn = pmreg_access,
                   .type = ARM_CP_IO,
                   .readfn = pmevtyper_readfn, .writefn = pmevtyper_writefn,
-- 
2.20.1

HACR_EL2 is a register with IMPDEF behaviour, which allows
implementation specific trapping to EL2. Implement it as RAZ/WI,
since QEMU's implementation has no extra traps. This also
matches what h/w implementations like Cortex-A53 and A57 do.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190205181218.8995-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW,
       .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
       .access = PL2_RW,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
       .writefn = hcr_writelow },
+    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
-- 
2.20.1

From: Catherine Ho <catherine.hecx@gmail.com>

The lo,hi order is different from the comments. And in commit
1ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128"), it changes
the original code logic. So just restore the old code logic before this
commit:
do_paired_cmpxchg64_be():
    cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
    newv = int128_make128(new_hi, new_lo);

This fixes a bug that would only be visible for big-endian
AArch64 guest code.

Fixes: 1ec182c33379 ("target/arm: Convert to HAVE_CMPXCHG128")
Signed-off-by: Catherine Ho <catherine.hecx@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1548985244-24523-1-git-send-email-catherine.hecx@gmail.com
[PMM: added note that bug only affects BE guests]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(paired_cmpxchg64_be)(CPUARMState *env, uint64_t addr,
      * High and low need to be switched here because this is not actually a
      * 128bit store but two doublewords stored consecutively
      */
-    Int128 cmpv = int128_make128(env->exclusive_val, env->exclusive_high);
-    Int128 newv = int128_make128(new_lo, new_hi);
+    Int128 cmpv = int128_make128(env->exclusive_high, env->exclusive_val);
+    Int128 newv = int128_make128(new_hi, new_lo);
     Int128 oldv;
     uintptr_t ra = GETPC();
     uint64_t o0, o1;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rather than a complex set of cases testing for writeback,
adjust DP after performing the operation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190206052857.5077-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                         tcg_gen_or_i32(tmp, tmp, tmp2);
                         tcg_temp_free_i32(tmp2);
                         gen_vfp_msr(tmp);
+                        dp = 0; /* always a single precision result */
                         break;
                     }
                     case 7: /* vcvtt.f16.f32, vcvtt.f16.f64 */
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                         tcg_gen_or_i32(tmp, tmp, tmp2);
                         tcg_temp_free_i32(tmp2);
                         gen_vfp_msr(tmp);
+                        dp = 0; /* always a single precision result */
                         break;
                     }
                     case 8: /* cmp */
                         gen_vfp_cmp(dp);
+                        dp = -1; /* no write back */
                         break;
                     case 9: /* cmpe */
                         gen_vfp_cmpe(dp);
+                        dp = -1; /* no write back */
                         break;
                     case 10: /* cmpz */
                         gen_vfp_cmp(dp);
+                        dp = -1; /* no write back */
                         break;
                     case 11: /* cmpez */
                         gen_vfp_F1_ld0(dp);
                         gen_vfp_cmpe(dp);
+                        dp = -1; /* no write back */
                         break;
                     case 12: /* vrintr */
                     {
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                         break;
                     }
                     case 15: /* single<->double conversion */
-                        if (dp)
+                        if (dp) {
                             gen_helper_vfp_fcvtsd(cpu_F0s, cpu_F0d, cpu_env);
-                        else
+                        } else {
                             gen_helper_vfp_fcvtds(cpu_F0d, cpu_F0s, cpu_env);
+                        }
+                        dp = !dp; /* result size is opposite */
                         break;
                     case 16: /* fuito */
                         gen_vfp_uito(dp, 0);
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                         break;
                     case 24: /* ftoui */
                         gen_vfp_toui(dp, 0);
+                        dp = 0; /* always an integer result */
                         break;
                     case 25: /* ftouiz */
                         gen_vfp_touiz(dp, 0);
+                        dp = 0; /* always an integer result */
                         break;
                     case 26: /* ftosi */
                         gen_vfp_tosi(dp, 0);
+                        dp = 0; /* always an integer result */
                         break;
                     case 27: /* ftosiz */
                         gen_vfp_tosiz(dp, 0);
+                        dp = 0; /* always an integer result */
                         break;
                     case 28: /* ftosh */
                         if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                     return 1;
                 }
 
-                /* Write back the result.  */
-                if (op == 15 && (rn >= 8 && rn <= 11)) {
-                    /* Comparison, do nothing.  */
-                } else if (op == 15 && dp && ((rn & 0x1c) == 0x18 ||
-                                              (rn & 0x1e) == 0x6)) {
-                    /* VCVT double to int: always integer result.
-                     * VCVT double to half precision is always a single
-                     * precision result.
-                     */
-                    gen_mov_vreg_F0(0, rd);
-                } else if (op == 15 && rn == 15) {
-                    /* conversion */
-                    gen_mov_vreg_F0(!dp, rd);
-                } else {
+                /* Write back the result, if any.  */
+                if (dp >= 0) {
                     gen_mov_vreg_F0(dp, rd);
                 }
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

For opcodes 0-5, move some if conditions into the structure
of a switch statement.  For opcodes 6 & 7, decode everything
at once with a second switch.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190206052857.5077-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 94 ++++++++++++++++++++------------------
 1 file changed, 49 insertions(+), 45 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
     int type = extract32(insn, 22, 2);
     bool sbit = extract32(insn, 29, 1);
     bool sf = extract32(insn, 31, 1);
+    bool itof = false;
 
     if (sbit) {
-        unallocated_encoding(s);
-        return;
+        goto do_unallocated;
     }
 
-    if (opcode > 5) {
-        /* FMOV */
-        bool itof = opcode & 1;
-
-        if (rmode >= 2) {
-            unallocated_encoding(s);
-            return;
-        }
-
-        switch (sf << 3 | type << 1 | rmode) {
-        case 0x0: /* 32 bit */
-        case 0xa: /* 64 bit */
-        case 0xd: /* 64 bit to top half of quad */
-            break;
-        case 0x6: /* 16-bit float, 32-bit int */
-        case 0xe: /* 16-bit float, 64-bit int */
-            if (dc_isar_feature(aa64_fp16, s)) {
-                break;
-            }
-            /* fallthru */
-        default:
-            /* all other sf/type/rmode combinations are invalid */
-            unallocated_encoding(s);
-            return;
-        }
-
-        if (!fp_access_check(s)) {
-            return;
-        }
-        handle_fmov(s, rd, rn, type, itof);
-    } else {
-        /* actual FP conversions */
-        bool itof = extract32(opcode, 1, 1);
-
-        if (rmode != 0 && opcode > 1) {
-            unallocated_encoding(s);
-            return;
+    switch (opcode) {
+    case 2: /* SCVTF */
+    case 3: /* UCVTF */
+        itof = true;
+        /* fallthru */
+    case 4: /* FCVTAS */
+    case 5: /* FCVTAU */
+        if (rmode != 0) {
+            goto do_unallocated;
         }
+        /* fallthru */
+    case 0: /* FCVT[NPMZ]S */
+    case 1: /* FCVT[NPMZ]U */
         switch (type) {
         case 0: /* float32 */
         case 1: /* float64 */
             break;
         case 3: /* float16 */
-            if (dc_isar_feature(aa64_fp16, s)) {
-                break;
+            if (!dc_isar_feature(aa64_fp16, s)) {
+                goto do_unallocated;
             }
-            /* fallthru */
+            break;
         default:
-            unallocated_encoding(s);
-            return;
+            goto do_unallocated;
         }
-
         if (!fp_access_check(s)) {
             return;
         }
         handle_fpfpcvt(s, rd, rn, opcode, itof, rmode, 64, sf, type);
+        break;
+
+    default:
+        switch (sf << 7 | type << 5 | rmode << 3 | opcode) {
+        case 0b01100110: /* FMOV half <-> 32-bit int */
+        case 0b01100111:
+        case 0b11100110: /* FMOV half <-> 64-bit int */
+        case 0b11100111:
+            if (!dc_isar_feature(aa64_fp16, s)) {
+                goto do_unallocated;
+            }
+            /* fallthru */
+        case 0b00000110: /* FMOV 32-bit */
+        case 0b00000111:
+        case 0b10100110: /* FMOV 64-bit */
+        case 0b10100111:
+        case 0b11001110: /* FMOV top half of 128-bit */
+        case 0b11001111:
+            if (!fp_access_check(s)) {
+                return;
+            }
+            itof = opcode & 1;
+            handle_fmov(s, rd, rn, type, itof);
+            break;
+
+        default:
+        do_unallocated:
+            unallocated_encoding(s);
+            return;
+        }
+        break;
     }
 }
 
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

Although technically not visible to userspace the kernel does make
them visible via a trap and emulate ABI. We provide a new permission
mask (PL0U_R) which maps to PL0_R for CONFIG_USER builds and adjust
the minimum permission check accordingly.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190205190224.2198-2-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 12 ++++++++++++
 target/arm/helper.c |  6 +++++-
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool cptype_valid(int cptype)
 #define PL0_R (0x02 | PL1_R)
 #define PL0_W (0x01 | PL1_W)
 
+/*
+ * For user-mode some registers are accessible to EL0 via a kernel
+ * trap-and-emulate ABI. In this case we define the read permissions
+ * as actually being PL0_R. However some bits of any given register
+ * may still be masked.
+ */
+#ifdef CONFIG_USER_ONLY
+#define PL0U_R PL0_R
+#else
+#define PL0U_R PL1_R
+#endif
+
 #define PL3_RW (PL3_R | PL3_W)
 #define PL2_RW (PL2_R | PL2_W)
 #define PL1_RW (PL1_R | PL1_W)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
     if (r->state != ARM_CP_STATE_AA32) {
         int mask = 0;
         switch (r->opc1) {
-        case 0: case 1: case 2:
+        case 0:
+            /* min_EL EL1, but some accessible to EL0 via kernel ABI */
+            mask = PL0U_R | PL1_RW;
+            break;
+        case 1: case 2:
             /* min_EL EL1 */
             mask = PL1_RW;
             break;
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

A number of CPUID registers are exposed to userspace by modern Linux
kernels thanks to the "ARM64 CPU Feature Registers" ABI. For QEMU's
user-mode emulation we don't need to emulate the kernels trap but just
return the value the trap would have done. To avoid too much #ifdef
hackery we process ARMCPRegInfo with a new helper (modify_arm_cp_regs)
before defining the registers. The modify routine is driven by a
simple data structure which describes which bits are exported and
which are fixed.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190205190224.2198-3-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 21 ++++++++++++++++
 target/arm/helper.c | 59 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
 }
 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
 
+/*
+ * Definition of an ARM co-processor register as viewed from
+ * userspace. This is used for presenting sanitised versions of
+ * registers to userspace when emulating the Linux AArch64 CPU
+ * ID/feature ABI (advertised as HWCAP_CPUID).
+ */
+typedef struct ARMCPRegUserSpaceInfo {
+    /* Name of register */
+    const char *name;
+
+    /* Only some bits are exported to user space */
+    uint64_t exported_bits;
+
+    /* Fixed bits are applied after the mask */
+    uint64_t fixed_bits;
+} ARMCPRegUserSpaceInfo;
+
+#define REGUSERINFO_SENTINEL { .name = NULL }
+
+void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods);
+
 /* CPWriteFn that can be used to implement writes-ignored behaviour */
 void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .resetvalue = cpu->pmceid1 },
             REGINFO_SENTINEL
         };
+#ifdef CONFIG_USER_ONLY
+        ARMCPRegUserSpaceInfo v8_user_idregs[] = {
+            { .name = "ID_AA64PFR0_EL1",
+              .exported_bits = 0x000f000f00ff0000,
+              .fixed_bits    = 0x0000000000000011 },
+            { .name = "ID_AA64PFR1_EL1",
+              .exported_bits = 0x00000000000000f0 },
+            { .name = "ID_AA64ZFR0_EL1"           },
+            { .name = "ID_AA64MMFR0_EL1",
+              .fixed_bits    = 0x00000000ff000000 },
+            { .name = "ID_AA64MMFR1_EL1"          },
+            { .name = "ID_AA64DFR0_EL1",
+              .fixed_bits    = 0x0000000000000006 },
+            { .name = "ID_AA64DFR1_EL1"           },
+            { .name = "ID_AA64AFR0_EL1"           },
+            { .name = "ID_AA64AFR1_EL1"           },
+            { .name = "ID_AA64ISAR0_EL1",
+              .exported_bits = 0x00fffffff0fffff0 },
+            { .name = "ID_AA64ISAR1_EL1",
+              .exported_bits = 0x000000f0ffffffff },
+            REGUSERINFO_SENTINEL
+        };
+        modify_arm_cp_regs(v8_idregs, v8_user_idregs);
+#endif
         /* RVBAR_EL1 is only implemented if EL1 is the highest EL */
         if (!arm_feature(env, ARM_FEATURE_EL3) &&
             !arm_feature(env, ARM_FEATURE_EL2)) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             .opc1 = CP_ANY, .opc2 = CP_ANY, .access = PL1_W,
             .type = ARM_CP_NOP | ARM_CP_OVERRIDE
         };
+#ifdef CONFIG_USER_ONLY
+        ARMCPRegUserSpaceInfo id_v8_user_midr_cp_reginfo[] = {
+            { .name = "MIDR_EL1",
+              .exported_bits = 0x00000000ffffffff },
+            { .name = "REVIDR_EL1"                },
+            REGUSERINFO_SENTINEL
+        };
+        modify_arm_cp_regs(id_v8_midr_cp_reginfo, id_v8_user_midr_cp_reginfo);
+#endif
         if (arm_feature(env, ARM_FEATURE_OMAPCP) ||
             arm_feature(env, ARM_FEATURE_STRONGARM)) {
             ARMCPRegInfo *r;
@@ -XXX,XX +XXX,XX @@ void define_arm_cp_regs_with_opaque(ARMCPU *cpu,
     }
 }
 
+/*
+ * Modify ARMCPRegInfo for access from userspace.
+ *
+ * This is a data driven modification directed by
+ * ARMCPRegUserSpaceInfo. All registers become ARM_CP_CONST as
+ * user-space cannot alter any values and dynamic values pertaining to
+ * execution state are hidden from user space view anyway.
+ */
+void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
+{
+    const ARMCPRegUserSpaceInfo *m;
+    ARMCPRegInfo *r;
+
+    for (m = mods; m->name; m++) {
+        for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
+            if (strcmp(r->name, m->name) == 0) {
+                r->type = ARM_CP_CONST;
+                r->access = PL0U_R;
+                r->resetvalue &= m->exported_bits;
+                r->resetvalue |= m->fixed_bits;
+                break;
+            }
+        }
+    }
+}
+
 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp)
 {
     return g_hash_table_lookup(cpregs, &encoded_cp);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

As this is a single register we could expose it with a simple ifdef
but we use the existing modify_arm_cp_regs mechanism for consistency.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190205190224.2198-4-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return mpidr_read_val(env);
 }
 
-static const ARMCPRegInfo mpidr_cp_reginfo[] = {
-    { .name = "MPIDR", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
-      .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
-    REGINFO_SENTINEL
-};
-
 static const ARMCPRegInfo lpae_cp_reginfo[] = {
     /* NOP AMAIR0/1 */
     { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     if (arm_feature(env, ARM_FEATURE_MPIDR)) {
+        ARMCPRegInfo mpidr_cp_reginfo[] = {
+            { .name = "MPIDR_EL1", .state = ARM_CP_STATE_BOTH,
+              .opc0 = 3, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 5,
+              .access = PL1_R, .readfn = mpidr_read, .type = ARM_CP_NO_RAW },
+            REGINFO_SENTINEL
+        };
+#ifdef CONFIG_USER_ONLY
+        ARMCPRegUserSpaceInfo mpidr_user_cp_reginfo[] = {
+            { .name = "MPIDR_EL1",
+              .fixed_bits = 0x0000000080000000 },
+            REGUSERINFO_SENTINEL
+        };
+        modify_arm_cp_regs(mpidr_cp_reginfo, mpidr_user_cp_reginfo);
+#endif
         define_arm_cp_regs(cpu, mpidr_cp_reginfo);
     }
 
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

There are a whole bunch more registers in the CPUID space which are
currently not used but are exposed as RAZ. To avoid too much
duplication we expand ARMCPRegUserSpaceInfo to understand glob
patterns so we only need one entry to tweak whole ranges of registers.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190205190224.2198-5-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  3 +++
 target/arm/helper.c | 26 +++++++++++++++++++++++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMCPRegUserSpaceInfo {
     /* Name of register */
     const char *name;
 
+    /* Is the name actually a glob pattern */
+    bool is_glob;
+
     /* Only some bits are exported to user space */
     uint64_t exported_bits;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .fixed_bits    = 0x0000000000000011 },
             { .name = "ID_AA64PFR1_EL1",
               .exported_bits = 0x00000000000000f0 },
+            { .name = "ID_AA64PFR*_EL1_RESERVED",
+              .is_glob = true                     },
             { .name = "ID_AA64ZFR0_EL1"           },
             { .name = "ID_AA64MMFR0_EL1",
               .fixed_bits    = 0x00000000ff000000 },
             { .name = "ID_AA64MMFR1_EL1"          },
+            { .name = "ID_AA64MMFR*_EL1_RESERVED",
+              .is_glob = true                     },
             { .name = "ID_AA64DFR0_EL1",
               .fixed_bits    = 0x0000000000000006 },
             { .name = "ID_AA64DFR1_EL1"           },
-            { .name = "ID_AA64AFR0_EL1"           },
-            { .name = "ID_AA64AFR1_EL1"           },
+            { .name = "ID_AA64DFR*_EL1_RESERVED",
+              .is_glob = true                     },
+            { .name = "ID_AA64AFR*",
+              .is_glob = true                     },
             { .name = "ID_AA64ISAR0_EL1",
               .exported_bits = 0x00fffffff0fffff0 },
             { .name = "ID_AA64ISAR1_EL1",
               .exported_bits = 0x000000f0ffffffff },
+            { .name = "ID_AA64ISAR*_EL1_RESERVED",
+              .is_glob = true                     },
             REGUSERINFO_SENTINEL
         };
         modify_arm_cp_regs(v8_idregs, v8_user_idregs);
@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
     ARMCPRegInfo *r;
 
     for (m = mods; m->name; m++) {
+        GPatternSpec *pat = NULL;
+        if (m->is_glob) {
+            pat = g_pattern_spec_new(m->name);
+        }
         for (r = regs; r->type != ARM_CP_SENTINEL; r++) {
-            if (strcmp(r->name, m->name) == 0) {
+            if (pat && g_pattern_match_string(pat, r->name)) {
+                r->type = ARM_CP_CONST;
+                r->access = PL0U_R;
+                r->resetvalue = 0;
+                /* continue */
+            } else if (strcmp(r->name, m->name) == 0) {
                 r->type = ARM_CP_CONST;
                 r->access = PL0U_R;
                 r->resetvalue &= m->exported_bits;
@@ -XXX,XX +XXX,XX @@ void modify_arm_cp_regs(ARMCPRegInfo *regs, const ARMCPRegUserSpaceInfo *mods)
                 break;
             }
         }
+        if (pat) {
+            g_pattern_spec_free(pat);
+        }
     }
 }
 
-- 
2.20.1

At the moment the Arm implementations of kvm_arch_{get,put}_registers()
don't support having QEMU change the values of system registers
(aka coprocessor registers for AArch32). This is because although
kvm_arch_get_registers() calls write_list_to_cpustate() to
update the CPU state struct fields (so QEMU code can read the
values in the usual way), kvm_arch_put_registers() does not
call write_cpustate_to_list(), meaning that any changes to
the CPU state struct fields will not be passed back to KVM.

The rationale for this design is documented in a comment in the
AArch32 kvm_arch_put_registers() -- writing the values in the
cpregs list into the CPU state struct is "lossy" because the
write of a register might not succeed, and so if we blindly
copy the CPU state values back again we will incorrectly
change register values for the guest. The assumption was that
no QEMU code would need to write to the registers.

However, when we implemented debug support for KVM guests, we
broke that assumption: the code to handle "set the guest up
to take a breakpoint exception" does so by updating various
guest registers including ESR_EL1.

Support this by making kvm_arch_put_registers() synchronize
CPU state back into the list. We sync only those registers
where the initial write succeeds, which should be sufficient.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Dongjiu Geng <gengdongjiu@huawei.com>
---
 target/arm/cpu.h     |  9 ++++++++-
 target/arm/helper.c  | 27 +++++++++++++++++++++++++--
 target/arm/kvm32.c   | 20 ++------------------
 target/arm/kvm64.c   |  2 ++
 target/arm/machine.c |  2 +-
 5 files changed, 38 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
 /**
  * write_cpustate_to_list:
  * @cpu: ARMCPU
+ * @kvm_sync: true if this is for syncing back to KVM
  *
  * For each register listed in the ARMCPU cpreg_indexes list, write
  * its value from the ARMCPUState structure into the cpreg_values list.
  * This is used to copy info from TCG's working data structures into
  * KVM or for outbound migration.
  *
+ * @kvm_sync is true if we are doing this in order to sync the
+ * register state back to KVM. In this case we will only update
+ * values in the list if the previous list->cpustate sync actually
+ * successfully wrote the CPU state. Otherwise we will keep the value
+ * that is in the list.
+ *
  * Returns: true if all register values were read correctly,
  * false if some register was unknown or could not be read.
  * Note that we do not stop early on failure -- we will attempt
  * reading all registers in the list.
  */
-bool write_cpustate_to_list(ARMCPU *cpu);
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 
 #define ARM_CPUID_TI915T      0x54029152
 #define ARM_CPUID_TI925T      0x54029252
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
     return true;
 }
 
-bool write_cpustate_to_list(ARMCPU *cpu)
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
 {
     /* Write the coprocessor state from cpu->env to the (index,value) list. */
     int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
     for (i = 0; i < cpu->cpreg_array_len; i++) {
         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
         const ARMCPRegInfo *ri;
+        uint64_t newval;
 
         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
         if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
         if (ri->type & ARM_CP_NO_RAW) {
             continue;
         }
-        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
+
+        newval = read_raw_cp_reg(&cpu->env, ri);
+        if (kvm_sync) {
+            /*
+             * Only sync if the previous list->cpustate sync succeeded.
+             * Rather than tracking the success/failure state for every
+             * item in the list, we just recheck "does the raw write we must
+             * have made in write_list_to_cpustate() read back OK" here.
+             */
+            uint64_t oldval = cpu->cpreg_values[i];
+
+            if (oldval == newval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, oldval);
+            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, newval);
+        }
+        cpu->cpreg_values[i] = newval;
     }
     return ok;
 }
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    /* Note that we do not call write_cpustate_to_list()
-     * here, so we are only writing the tuple list back to
-     * KVM. This is safe because nothing can change the
-     * CPUARMState cp15 fields (in particular gdb accesses cannot)
-     * and so there are no changes to sync. In fact syncing would
-     * be wrong at this point: for a constant register where TCG and
-     * KVM disagree about its value, the preceding write_list_to_cpustate()
-     * would not have had any effect on the CPUARMState value (since the
-     * register is read-only), and a write_cpustate_to_list() here would
-     * then try to write the TCG value back into KVM -- this would either
-     * fail or incorrectly change the value the guest sees.
-     *
-     * If we ever want to allow the user to modify cp15 registers via
-     * the gdb stub, we would need to be more clever here (for instance
-     * tracking the set of registers kvm_arch_get_registers() successfully
-     * managed to update the CPUARMState with, and only allowing those
-     * to be written back up into the kernel).
-     */
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
             abort();
         }
     } else {
-        if (!write_cpustate_to_list(cpu)) {
+        if (!write_cpustate_to_list(cpu, false)) {
             /* This should never fail. */
             abort();
         }
-- 
2.20.1

Peter Crosthwaite hasn't had the bandwidth to do code review or
other QEMU work for some time now -- remove his email address
from MAINTAINERS file entries so we don't bombard him with
patch emails.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190207181422.4907-1-peter.maydell@linaro.org
---
 MAINTAINERS | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Guest CPU cores (TCG):
 ----------------------
 Overall
 L: qemu-devel@nongnu.org
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Richard Henderson <rth@twiddle.net>
 R: Paolo Bonzini <pbonzini@redhat.com>
 S: Maintained
@@ -XXX,XX +XXX,XX @@ F: tests/virtio-scsi-test.c
 T: git https://github.com/bonzini/qemu.git scsi-next
 
 SSI
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/ssi/*
@@ -XXX,XX +XXX,XX @@ F: tests/m25p80-test.c
 
 Xilinx SPI
 M: Alistair Francis <alistair@alistair23.me>
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 S: Maintained
 F: hw/ssi/xilinx_*
 
@@ -XXX,XX +XXX,XX @@ F: qom/cpu.c
 F: include/qom/cpu.h
 
 Device Tree
-M: Peter Crosthwaite <crosthwaite.peter@gmail.com>
 M: Alexander Graf <agraf@suse.de>
 S: Maintained
 F: device_tree.c
-- 
2.20.1

The code for handling the NVIC SHPR1 register intends to permit
byte and halfword accesses (as the architecture requires). However
the 'case' line for it only lists the base address of the
register, so attempts to access bytes other than the first one
end up in the "bad write" default logic. This bug was added
accidentally when we split out the SHPR1 logic from SHPR2 and
SHPR3 to support v6M.

Fixes: 7c9140afd594 ("nvic: Handle ARMv6-M SCS reserved registers")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
The Zephyr RTOS happens to access SHPR1 byte at a time,
which is how I spotted this.
---
 hw/intc/armv7m_nvic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
             }
         }
         break;
-    case 0xd18: /* System Handler Priority (SHPR1) */
+    case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
             val = 0;
             break;
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
         }
         nvic_irq_update(s);
         return MEMTX_OK;
-    case 0xd18: /* System Handler Priority (SHPR1) */
+    case 0xd18 ... 0xd1b: /* System Handler Priority (SHPR1) */
         if (!arm_feature(&s->cpu->env, ARM_FEATURE_M_MAIN)) {
             return MEMTX_OK;
         }
-- 
2.20.1

In commit 91c1e9fcbd7548db368 where we added dual-CPU support to
the ARMSSE, we set up the wiring of the expansion IRQs via nested
loops: the outer loop on 'i' loops for each CPU, and the inner loop
on 'j' loops for each interrupt. Fix a typo which meant we were
wiring every expansion IRQ line to external IRQ 0 on CPU 0 and
to external IRQ 1 on CPU 1.

Fixes: 91c1e9fcbd7548db368 ("hw/arm/armsse: Support dual-CPU configuration")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 hw/arm/armsse.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
         /* Connect EXP_IRQ/EXP_CPUn_IRQ GPIOs to the NVIC's lines 32 and up */
         s->exp_irqs[i] = g_new(qemu_irq, s->exp_numirq);
         for (j = 0; j < s->exp_numirq; j++) {
-            s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, i + 32);
+            s->exp_irqs[i][j] = qdev_get_gpio_in(cpudev, j + 32);
         }
         if (i == 0) {
             gpioname = g_strdup("EXP_IRQ");
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Since we're now handling a == b generically, we no longer need
to do it by hand within target/arm/.

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c |  6 +-----
 target/arm/translate-sve.c |  6 +-----
 target/arm/translate.c     | 12 +++---------
 3 files changed, 5 insertions(+), 19 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_logic(DisasContext *s, uint32_t insn)
         gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_andc, 0);
         return;
     case 2: /* ORR */
-        if (rn == rm) { /* MOV */
-            gen_gvec_fn2(s, is_q, rd, rn, tcg_gen_gvec_mov, 0);
-        } else {
-            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_or, 0);
-        }
+        gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_or, 0);
         return;
     case 3: /* ORN */
         gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_orc, 0);
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_AND_zzz(DisasContext *s, arg_rrr_esz *a)
 
 static bool trans_ORR_zzz(DisasContext *s, arg_rrr_esz *a)
 {
-    if (a->rn == a->rm) { /* MOV */
-        return do_mov_z(s, a->rd, a->rn);
-    } else {
-        return do_vector3_z(s, tcg_gen_gvec_or, 0, a->rd, a->rn, a->rm);
-    }
+    return do_vector3_z(s, tcg_gen_gvec_or, 0, a->rd, a->rn, a->rm);
 }
 
 static bool trans_EOR_zzz(DisasContext *s, arg_rrr_esz *a)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 tcg_gen_gvec_andc(0, rd_ofs, rn_ofs, rm_ofs,
                                   vec_size, vec_size);
                 break;
-            case 2:
-                if (rn == rm) {
-                    /* VMOV */
-                    tcg_gen_gvec_mov(0, rd_ofs, rn_ofs, vec_size, vec_size);
-                } else {
-                    /* VORR */
-                    tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
-                                    vec_size, vec_size);
-                }
+            case 2: /* VORR */
+                tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
+                                vec_size, vec_size);
                 break;
             case 3: /* VORN */
                 tcg_gen_gvec_orc(0, rd_ofs, rn_ofs, rm_ofs,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 35 ++++++++++++++---------------------
 1 file changed, 14 insertions(+), 21 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
     }
 
     switch (opcode) {
+    case 0x0c: /* SMAX, UMAX */
+        if (u) {
+            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umax, size);
+        } else {
+            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_smax, size);
+        }
+        return;
+    case 0x0d: /* SMIN, UMIN */
+        if (u) {
+            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umin, size);
+        } else {
+            gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_smin, size);
+        }
+        return;
     case 0x10: /* ADD, SUB */
         if (u) {
             gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_sub, size);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                 genenvfn = fns[size][u];
                 break;
             }
-            case 0xc: /* SMAX, UMAX */
-            {
-                static NeonGenTwoOpFn * const fns[3][2] = {
-                    { gen_helper_neon_max_s8, gen_helper_neon_max_u8 },
-                    { gen_helper_neon_max_s16, gen_helper_neon_max_u16 },
-                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
-                };
-                genfn = fns[size][u];
-                break;
-            }
-
-            case 0xd: /* SMIN, UMIN */
-            {
-                static NeonGenTwoOpFn * const fns[3][2] = {
-                    { gen_helper_neon_min_s8, gen_helper_neon_min_u8 },
-                    { gen_helper_neon_min_s16, gen_helper_neon_min_u16 },
-                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
-                };
-                genfn = fns[size][u];
-                break;
-            }
             case 0xe: /* SABD, UABD */
             case 0xf: /* SABA, UABA */
             {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 25 +++++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_cmp(u ? TCG_COND_GEU : TCG_COND_GE, size,
                              rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
             return 0;
+
+        case NEON_3R_VMAX:
+            if (u) {
+                tcg_gen_gvec_umax(size, rd_ofs, rn_ofs, rm_ofs,
+                                  vec_size, vec_size);
+            } else {
+                tcg_gen_gvec_smax(size, rd_ofs, rn_ofs, rm_ofs,
+                                  vec_size, vec_size);
+            }
+            return 0;
+        case NEON_3R_VMIN:
+            if (u) {
+                tcg_gen_gvec_umin(size, rd_ofs, rn_ofs, rm_ofs,
+                                  vec_size, vec_size);
+            } else {
+                tcg_gen_gvec_smin(size, rd_ofs, rn_ofs, rm_ofs,
+                                  vec_size, vec_size);
+            }
+            return 0;
         }
 
         if (size == 3) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         case NEON_3R_VQRSHL:
             GEN_NEON_INTEGER_OP_ENV(qrshl);
             break;
-        case NEON_3R_VMAX:
-            GEN_NEON_INTEGER_OP(max);
-            break;
-        case NEON_3R_VMIN:
-            GEN_NEON_INTEGER_OP(min);
-            break;
         case NEON_3R_VABD:
             GEN_NEON_INTEGER_OP(abd);
             break;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The 32-bit PMIN/PMAX has been decomposed to scalars,
and so can be trivially expanded inline.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_neon_rsb(int size, TCGv_i32 t0, TCGv_i32 t1)
 }
 
 /* 32-bit pairwise ops end up the same as the elementwise versions.  */
-#define gen_helper_neon_pmax_s32  gen_helper_neon_max_s32
-#define gen_helper_neon_pmax_u32  gen_helper_neon_max_u32
-#define gen_helper_neon_pmin_s32  gen_helper_neon_min_s32
-#define gen_helper_neon_pmin_u32  gen_helper_neon_min_u32
+#define gen_helper_neon_pmax_s32  tcg_gen_smax_i32
+#define gen_helper_neon_pmax_u32  tcg_gen_umax_i32
+#define gen_helper_neon_pmin_s32  tcg_gen_smin_i32
+#define gen_helper_neon_pmin_u32  tcg_gen_umin_i32
 
 #define GEN_NEON_INTEGER_OP_ENV(name) do { \
     switch ((size << 1) | u) { \
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

These are now unused.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-6-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h      | 12 ------------
 target/arm/neon_helper.c | 12 ------------
 2 files changed, 24 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_2(neon_cge_s16, i32, i32, i32)
 DEF_HELPER_2(neon_cge_u32, i32, i32, i32)
 DEF_HELPER_2(neon_cge_s32, i32, i32, i32)
 
-DEF_HELPER_2(neon_min_u8, i32, i32, i32)
-DEF_HELPER_2(neon_min_s8, i32, i32, i32)
-DEF_HELPER_2(neon_min_u16, i32, i32, i32)
-DEF_HELPER_2(neon_min_s16, i32, i32, i32)
-DEF_HELPER_2(neon_min_u32, i32, i32, i32)
-DEF_HELPER_2(neon_min_s32, i32, i32, i32)
-DEF_HELPER_2(neon_max_u8, i32, i32, i32)
-DEF_HELPER_2(neon_max_s8, i32, i32, i32)
-DEF_HELPER_2(neon_max_u16, i32, i32, i32)
-DEF_HELPER_2(neon_max_s16, i32, i32, i32)
-DEF_HELPER_2(neon_max_u32, i32, i32, i32)
-DEF_HELPER_2(neon_max_s32, i32, i32, i32)
 DEF_HELPER_2(neon_pmin_u8, i32, i32, i32)
 DEF_HELPER_2(neon_pmin_s8, i32, i32, i32)
 DEF_HELPER_2(neon_pmin_u16, i32, i32, i32)
diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon_helper.c
+++ b/target/arm/neon_helper.c
@@ -XXX,XX +XXX,XX @@ NEON_VOP(cge_u32, neon_u32, 1)
 #undef NEON_FN
 
 #define NEON_FN(dest, src1, src2) dest = (src1 < src2) ? src1 : src2
-NEON_VOP(min_s8, neon_s8, 4)
-NEON_VOP(min_u8, neon_u8, 4)
-NEON_VOP(min_s16, neon_s16, 2)
-NEON_VOP(min_u16, neon_u16, 2)
-NEON_VOP(min_s32, neon_s32, 1)
-NEON_VOP(min_u32, neon_u32, 1)
 NEON_POP(pmin_s8, neon_s8, 4)
 NEON_POP(pmin_u8, neon_u8, 4)
 NEON_POP(pmin_s16, neon_s16, 2)
@@ -XXX,XX +XXX,XX @@ NEON_POP(pmin_u16, neon_u16, 2)
 #undef NEON_FN
 
 #define NEON_FN(dest, src1, src2) dest = (src1 > src2) ? src1 : src2
-NEON_VOP(max_s8, neon_s8, 4)
-NEON_VOP(max_u8, neon_u8, 4)
-NEON_VOP(max_s16, neon_s16, 2)
-NEON_VOP(max_u16, neon_u16, 2)
-NEON_VOP(max_s32, neon_s32, 1)
-NEON_VOP(max_u32, neon_u32, 1)
 NEON_POP(pmax_s8, neon_s8, 4)
 NEON_POP(pmax_u8, neon_u8, 4)
 NEON_POP(pmax_s16, neon_s16, 2)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The components of this register is stored in several
different locations.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-7-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     }
     switch (reg - nregs) {
     case 0: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSID]); return 4;
-    case 1: stl_p(buf, env->vfp.xregs[ARM_VFP_FPSCR]); return 4;
+    case 1: stl_p(buf, vfp_get_fpscr(env)); return 4;
     case 2: stl_p(buf, env->vfp.xregs[ARM_VFP_FPEXC]); return 4;
     }
     return 0;
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     }
     switch (reg - nregs) {
     case 0: env->vfp.xregs[ARM_VFP_FPSID] = ldl_p(buf); return 4;
-    case 1: env->vfp.xregs[ARM_VFP_FPSCR] = ldl_p(buf); return 4;
+    case 1: vfp_set_fpscr(env, ldl_p(buf)); return 4;
     case 2: env->vfp.xregs[ARM_VFP_FPEXC] = ldl_p(buf) & (1 << 30); return 4;
     }
     return 0;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Minimize the code within a macro by splitting out a helper function.
Use deposit32 instead of manual bit manipulation.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-9-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 45 +++++++++++++++++++++++++++------------------
 1 file changed, 27 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ float64 VFP_HELPER(sqrt, d)(float64 a, CPUARMState *env)
     return float64_sqrt(a, &env->vfp.fp_status);
 }
 
+static void softfloat_to_vfp_compare(CPUARMState *env, int cmp)
+{
+    uint32_t flags;
+    switch (cmp) {
+    case float_relation_equal:
+        flags = 0x6;
+        break;
+    case float_relation_less:
+        flags = 0x8;
+        break;
+    case float_relation_greater:
+        flags = 0x2;
+        break;
+    case float_relation_unordered:
+        flags = 0x3;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    env->vfp.xregs[ARM_VFP_FPSCR] =
+        deposit32(env->vfp.xregs[ARM_VFP_FPSCR], 28, 4, flags);
+}
+
 /* XXX: check quiet/signaling case */
 #define DO_VFP_cmp(p, type) \
 void VFP_HELPER(cmp, p)(type a, type b, CPUARMState *env)  \
 { \
-    uint32_t flags; \
-    switch(type ## _compare_quiet(a, b, &env->vfp.fp_status)) { \
-    case 0: flags = 0x6; break; \
-    case -1: flags = 0x8; break; \
-    case 1: flags = 0x2; break; \
-    default: case 2: flags = 0x3; break; \
-    } \
-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
+    softfloat_to_vfp_compare(env, \
+        type ## _compare_quiet(a, b, &env->vfp.fp_status)); \
 } \
 void VFP_HELPER(cmpe, p)(type a, type b, CPUARMState *env) \
 { \
-    uint32_t flags; \
-    switch(type ## _compare(a, b, &env->vfp.fp_status)) { \
-    case 0: flags = 0x6; break; \
-    case -1: flags = 0x8; break; \
-    case 1: flags = 0x2; break; \
-    default: case 2: flags = 0x3; break; \
-    } \
-    env->vfp.xregs[ARM_VFP_FPSCR] = (flags << 28) \
-        | (env->vfp.xregs[ARM_VFP_FPSCR] & 0x0fffffff); \
+    softfloat_to_vfp_compare(env, \
+        type ## _compare(a, b, &env->vfp.fp_status)); \
 }
 DO_VFP_cmp(s, float32)
 DO_VFP_cmp(d, float64)
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Given that we mask bits properly on set, there is no reason
to mask them again on get.  We failed to clear the exception
status bits, 0x9f, which means that the wrong value would be
returned on get.  Except in the (probably normal) case in which
the set clears all of the bits.

Simplify the code in set to also clear the RES0 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-10-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
     int i;
     uint32_t fpscr;
 
-    fpscr = (env->vfp.xregs[ARM_VFP_FPSCR] & 0xffc8ffff)
+    fpscr = env->vfp.xregs[ARM_VFP_FPSCR]
             | (env->vfp.vec_len << 16)
             | (env->vfp.vec_stride << 20);
 
@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_to_host(int target_bits)
 void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
 {
     int i;
-    uint32_t changed;
+    uint32_t changed = env->vfp.xregs[ARM_VFP_FPSCR];
 
     /* When ARMv8.2-FP16 is not supported, FZ16 is RES0.  */
     if (!cpu_isar_feature(aa64_fp16, arm_env_get_cpu(env))) {
@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
 
     /*
      * We don't implement trapped exception handling, so the
-     * trap enable bits are all RAZ/WI (not RES0!)
+     * trap enable bits, IDE|IXE|UFE|OFE|DZE|IOE are all RAZ/WI (not RES0!)
+     *
+     * If we exclude the exception flags, IOC|DZC|OFC|UFC|IXC|IDC
+     * (which are stored in fp_status), and the other RES0 bits
+     * in between, then we clear all of the low 16 bits.
      */
-    val &= ~(FPCR_IDE | FPCR_IXE | FPCR_UFE | FPCR_OFE | FPCR_DZE | FPCR_IOE);
-
-    changed = env->vfp.xregs[ARM_VFP_FPSCR];
-    env->vfp.xregs[ARM_VFP_FPSCR] = (val & 0xffc8ffff);
+    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xffc80000;
     env->vfp.vec_len = (val >> 16) & 7;
     env->vfp.vec_stride = (val >> 20) & 3;
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Change the representation of this field such that it is easy
to set from vector code.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-11-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h         |  5 ++++-
 target/arm/helper.c      | 19 +++++++++++++++----
 target/arm/neon_helper.c |  2 +-
 target/arm/vec_helper.c  |  2 +-
 4 files changed, 21 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         ARMPredicateReg preg_tmp;
 #endif
 
-        uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
+        uint32_t qc[4] QEMU_ALIGNED(16);
         int vec_len;
         int vec_stride;
 
+        uint32_t xregs[16];
+
         /* Scratch space for aa32 neon expansion.  */
         uint32_t scratch[8];
 
@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
 #define FPCR_FZ16   (1 << 19)   /* ARMv8.2+, FP16 flush-to-zero */
 #define FPCR_FZ     (1 << 24)   /* Flush-to-zero enable bit */
 #define FPCR_DN     (1 << 25)   /* Default NaN enable bit */
+#define FPCR_QC     (1 << 27)   /* Cumulative saturation bit */
 
 static inline uint32_t vfp_get_fpsr(CPUARMState *env)
 {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
 
 uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
 {
-    int i;
-    uint32_t fpscr;
+    uint32_t i, fpscr;
 
     fpscr = env->vfp.xregs[ARM_VFP_FPSCR]
             | (env->vfp.vec_len << 16)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_get_fpscr)(CPUARMState *env)
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
           & ~float_flag_input_denormal);
-
     fpscr |= vfp_exceptbits_from_host(i);
+
+    i = env->vfp.qc[0] | env->vfp.qc[1] | env->vfp.qc[2] | env->vfp.qc[3];
+    fpscr |= i ? FPCR_QC : 0;
+
     return fpscr;
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(vfp_set_fpscr)(CPUARMState *env, uint32_t val)
      * (which are stored in fp_status), and the other RES0 bits
      * in between, then we clear all of the low 16 bits.
      */
-    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xffc80000;
+    env->vfp.xregs[ARM_VFP_FPSCR] = val & 0xf7c80000;
     env->vfp.vec_len = (val >> 16) & 7;
     env->vfp.vec_stride = (val >> 20) & 3;
 
+    /*
+     * The bit we set within fpscr_q is arbitrary; the register as a
+     * whole being zero/non-zero is what counts.
+     */
+    env->vfp.qc[0] = val & FPCR_QC;
+    env->vfp.qc[1] = 0;
+    env->vfp.qc[2] = 0;
+    env->vfp.qc[3] = 0;
+
     changed ^= val;
     if (changed & (3 << 22)) {
         i = (val >> 22) & 3;
diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon_helper.c
+++ b/target/arm/neon_helper.c
@@ -XXX,XX +XXX,XX @@
 #define SIGNBIT (uint32_t)0x80000000
 #define SIGNBIT64 ((uint64_t)1 << 63)
 
-#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
+#define SET_QC() env->vfp.qc[0] = 1
 
 #define NEON_TYPE1(name, type) \
 typedef struct \
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@
 #define H4(x)  (x)
 #endif
 
-#define SET_QC() env->vfp.xregs[ARM_VFP_FPSCR] |= CPSR_Q
+#define SET_QC() env->vfp.qc[0] = 1
 
 static void clear_tail(void *vd, uintptr_t opr_sz, uintptr_t max_sz)
 {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

For same-sign saturation, we have tcg vector operations.  We can
compute the QC bit by comparing the saturated value against the
unsaturated value.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-12-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  33 +++++++
 target/arm/translate.h     |   4 +
 target/arm/translate-a64.c |  36 ++++----
 target/arm/translate.c     | 172 +++++++++++++++++++++++++++++++------
 target/arm/vec_helper.c    | 130 ++++++++++++++++++++++++++++
 5 files changed, 331 insertions(+), 44 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqadd_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_uqsub_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_b, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #include "helper-sve.h"
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ extern const GVecGen2i ssra_op[4];
 extern const GVecGen2i usra_op[4];
 extern const GVecGen2i sri_op[4];
 extern const GVecGen2i sli_op[4];
+extern const GVecGen4 uqadd_op[4];
+extern const GVecGen4 sqadd_op[4];
+extern const GVecGen4 uqsub_op[4];
+extern const GVecGen4 sqsub_op[4];
 void gen_cmtst_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b);
 
 /*
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
     }
 
     switch (opcode) {
+    case 0x01: /* SQADD, UQADD */
+        tcg_gen_gvec_4(vec_full_reg_offset(s, rd),
+                       offsetof(CPUARMState, vfp.qc),
+                       vec_full_reg_offset(s, rn),
+                       vec_full_reg_offset(s, rm),
+                       is_q ? 16 : 8, vec_full_reg_size(s),
+                       (u ? uqadd_op : sqadd_op) + size);
+        return;
+    case 0x05: /* SQSUB, UQSUB */
+        tcg_gen_gvec_4(vec_full_reg_offset(s, rd),
+                       offsetof(CPUARMState, vfp.qc),
+                       vec_full_reg_offset(s, rn),
+                       vec_full_reg_offset(s, rm),
+                       is_q ? 16 : 8, vec_full_reg_size(s),
+                       (u ? uqsub_op : sqsub_op) + size);
+        return;
     case 0x0c: /* SMAX, UMAX */
         if (u) {
             gen_gvec_fn3(s, is_q, rd, rn, rm, tcg_gen_gvec_umax, size);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                 genfn = fns[size][u];
                 break;
             }
-            case 0x1: /* SQADD, UQADD */
-            {
-                static NeonGenTwoOpEnvFn * const fns[3][2] = {
-                    { gen_helper_neon_qadd_s8, gen_helper_neon_qadd_u8 },
-                    { gen_helper_neon_qadd_s16, gen_helper_neon_qadd_u16 },
-                    { gen_helper_neon_qadd_s32, gen_helper_neon_qadd_u32 },
-                };
-                genenvfn = fns[size][u];
-                break;
-            }
             case 0x2: /* SRHADD, URHADD */
             {
                 static NeonGenTwoOpFn * const fns[3][2] = {
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                 genfn = fns[size][u];
                 break;
             }
-            case 0x5: /* SQSUB, UQSUB */
-            {
-                static NeonGenTwoOpEnvFn * const fns[3][2] = {
-                    { gen_helper_neon_qsub_s8, gen_helper_neon_qsub_u8 },
-                    { gen_helper_neon_qsub_s16, gen_helper_neon_qsub_u16 },
-                    { gen_helper_neon_qsub_s32, gen_helper_neon_qsub_u32 },
-                };
-                genenvfn = fns[size][u];
-                break;
-            }
             case 0x8: /* SSHL, USHL */
             {
                 static NeonGenTwoOpFn * const fns[3][2] = {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ const GVecGen3 cmtst_op[4] = {
       .vece = MO_64 },
 };
 
+static void gen_uqadd_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
+                          TCGv_vec a, TCGv_vec b)
+{
+    TCGv_vec x = tcg_temp_new_vec_matching(t);
+    tcg_gen_add_vec(vece, x, a, b);
+    tcg_gen_usadd_vec(vece, t, a, b);
+    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
+    tcg_gen_or_vec(vece, sat, sat, x);
+    tcg_temp_free_vec(x);
+}
+
+const GVecGen4 uqadd_op[4] = {
+    { .fniv = gen_uqadd_vec,
+      .fno = gen_helper_gvec_uqadd_b,
+      .opc = INDEX_op_usadd_vec,
+      .write_aofs = true,
+      .vece = MO_8 },
+    { .fniv = gen_uqadd_vec,
+      .fno = gen_helper_gvec_uqadd_h,
+      .opc = INDEX_op_usadd_vec,
+      .write_aofs = true,
+      .vece = MO_16 },
+    { .fniv = gen_uqadd_vec,
+      .fno = gen_helper_gvec_uqadd_s,
+      .opc = INDEX_op_usadd_vec,
+      .write_aofs = true,
+      .vece = MO_32 },
+    { .fniv = gen_uqadd_vec,
+      .fno = gen_helper_gvec_uqadd_d,
+      .opc = INDEX_op_usadd_vec,
+      .write_aofs = true,
+      .vece = MO_64 },
+};
+
+static void gen_sqadd_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
+                          TCGv_vec a, TCGv_vec b)
+{
+    TCGv_vec x = tcg_temp_new_vec_matching(t);
+    tcg_gen_add_vec(vece, x, a, b);
+    tcg_gen_ssadd_vec(vece, t, a, b);
+    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
+    tcg_gen_or_vec(vece, sat, sat, x);
+    tcg_temp_free_vec(x);
+}
+
+const GVecGen4 sqadd_op[4] = {
+    { .fniv = gen_sqadd_vec,
+      .fno = gen_helper_gvec_sqadd_b,
+      .opc = INDEX_op_ssadd_vec,
+      .write_aofs = true,
+      .vece = MO_8 },
+    { .fniv = gen_sqadd_vec,
+      .fno = gen_helper_gvec_sqadd_h,
+      .opc = INDEX_op_ssadd_vec,
+      .write_aofs = true,
+      .vece = MO_16 },
+    { .fniv = gen_sqadd_vec,
+      .fno = gen_helper_gvec_sqadd_s,
+      .opc = INDEX_op_ssadd_vec,
+      .write_aofs = true,
+      .vece = MO_32 },
+    { .fniv = gen_sqadd_vec,
+      .fno = gen_helper_gvec_sqadd_d,
+      .opc = INDEX_op_ssadd_vec,
+      .write_aofs = true,
+      .vece = MO_64 },
+};
+
+static void gen_uqsub_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
+                          TCGv_vec a, TCGv_vec b)
+{
+    TCGv_vec x = tcg_temp_new_vec_matching(t);
+    tcg_gen_sub_vec(vece, x, a, b);
+    tcg_gen_ussub_vec(vece, t, a, b);
+    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
+    tcg_gen_or_vec(vece, sat, sat, x);
+    tcg_temp_free_vec(x);
+}
+
+const GVecGen4 uqsub_op[4] = {
+    { .fniv = gen_uqsub_vec,
+      .fno = gen_helper_gvec_uqsub_b,
+      .opc = INDEX_op_ussub_vec,
+      .write_aofs = true,
+      .vece = MO_8 },
+    { .fniv = gen_uqsub_vec,
+      .fno = gen_helper_gvec_uqsub_h,
+      .opc = INDEX_op_ussub_vec,
+      .write_aofs = true,
+      .vece = MO_16 },
+    { .fniv = gen_uqsub_vec,
+      .fno = gen_helper_gvec_uqsub_s,
+      .opc = INDEX_op_ussub_vec,
+      .write_aofs = true,
+      .vece = MO_32 },
+    { .fniv = gen_uqsub_vec,
+      .fno = gen_helper_gvec_uqsub_d,
+      .opc = INDEX_op_ussub_vec,
+      .write_aofs = true,
+      .vece = MO_64 },
+};
+
+static void gen_sqsub_vec(unsigned vece, TCGv_vec t, TCGv_vec sat,
+                          TCGv_vec a, TCGv_vec b)
+{
+    TCGv_vec x = tcg_temp_new_vec_matching(t);
+    tcg_gen_sub_vec(vece, x, a, b);
+    tcg_gen_sssub_vec(vece, t, a, b);
+    tcg_gen_cmp_vec(TCG_COND_NE, vece, x, x, t);
+    tcg_gen_or_vec(vece, sat, sat, x);
+    tcg_temp_free_vec(x);
+}
+
+const GVecGen4 sqsub_op[4] = {
+    { .fniv = gen_sqsub_vec,
+      .fno = gen_helper_gvec_sqsub_b,
+      .opc = INDEX_op_sssub_vec,
+      .write_aofs = true,
+      .vece = MO_8 },
+    { .fniv = gen_sqsub_vec,
+      .fno = gen_helper_gvec_sqsub_h,
+      .opc = INDEX_op_sssub_vec,
+      .write_aofs = true,
+      .vece = MO_16 },
+    { .fniv = gen_sqsub_vec,
+      .fno = gen_helper_gvec_sqsub_s,
+      .opc = INDEX_op_sssub_vec,
+      .write_aofs = true,
+      .vece = MO_32 },
+    { .fniv = gen_sqsub_vec,
+      .fno = gen_helper_gvec_sqsub_d,
+      .opc = INDEX_op_sssub_vec,
+      .write_aofs = true,
+      .vece = MO_64 },
+};
+
 /* Translate a NEON data processing instruction.  Return nonzero if the
    instruction is invalid.
    We process data in a mixture of 32-bit and 64-bit chunks.
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             return 0;
 
+        case NEON_3R_VQADD:
+            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
+                           rn_ofs, rm_ofs, vec_size, vec_size,
+                           (u ? uqadd_op : sqadd_op) + size);
+            break;
+
+        case NEON_3R_VQSUB:
+            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
+                           rn_ofs, rm_ofs, vec_size, vec_size,
+                           (u ? uqsub_op : sqsub_op) + size);
+            break;
+
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
                 /* Polynomial case allows only P8 and is handled below.  */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 neon_load_reg64(cpu_V0, rn + pass);
                 neon_load_reg64(cpu_V1, rm + pass);
                 switch (op) {
-                case NEON_3R_VQADD:
-                    if (u) {
-                        gen_helper_neon_qadd_u64(cpu_V0, cpu_env,
-                                                 cpu_V0, cpu_V1);
-                    } else {
-                        gen_helper_neon_qadd_s64(cpu_V0, cpu_env,
-                                                 cpu_V0, cpu_V1);
-                    }
-                    break;
-                case NEON_3R_VQSUB:
-                    if (u) {
-                        gen_helper_neon_qsub_u64(cpu_V0, cpu_env,
-                                                 cpu_V0, cpu_V1);
-                    } else {
-                        gen_helper_neon_qsub_s64(cpu_V0, cpu_env,
-                                                 cpu_V0, cpu_V1);
-                    }
-                    break;
                 case NEON_3R_VSHL:
                     if (u) {
                         gen_helper_neon_shl_u64(cpu_V0, cpu_V1, cpu_V0);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         case NEON_3R_VHADD:
             GEN_NEON_INTEGER_OP(hadd);
             break;
-        case NEON_3R_VQADD:
-            GEN_NEON_INTEGER_OP_ENV(qadd);
-            break;
         case NEON_3R_VRHADD:
             GEN_NEON_INTEGER_OP(rhadd);
             break;
         case NEON_3R_VHSUB:
             GEN_NEON_INTEGER_OP(hsub);
             break;
-        case NEON_3R_VQSUB:
-            GEN_NEON_INTEGER_OP_ENV(qsub);
-            break;
         case NEON_3R_VSHL:
             GEN_NEON_INTEGER_OP(shl);
             break;
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4)
 DO_FMLA_IDX(gvec_fmla_idx_d, float64, )
 
 #undef DO_FMLA_IDX
+
+#define DO_SAT(NAME, WTYPE, TYPEN, TYPEM, OP, MIN, MAX) \
+void HELPER(NAME)(void *vd, void *vq, void *vn, void *vm, uint32_t desc)   \
+{                                                                          \
+    intptr_t i, oprsz = simd_oprsz(desc);                                  \
+    TYPEN *d = vd, *n = vn; TYPEM *m = vm;                                 \
+    bool q = false;                                                        \
+    for (i = 0; i < oprsz / sizeof(TYPEN); i++) {                          \
+        WTYPE dd = (WTYPE)n[i] OP m[i];                                    \
+        if (dd < MIN) {                                                    \
+            dd = MIN;                                                      \
+            q = true;                                                      \
+        } else if (dd > MAX) {                                             \
+            dd = MAX;                                                      \
+            q = true;                                                      \
+        }                                                                  \
+        d[i] = dd;                                                         \
+    }                                                                      \
+    if (q) {                                                               \
+        uint32_t *qc = vq;                                                 \
+        qc[0] = 1;                                                         \
+    }                                                                      \
+    clear_tail(d, oprsz, simd_maxsz(desc));                                \
+}
+
+DO_SAT(gvec_uqadd_b, int, uint8_t, uint8_t, +, 0, UINT8_MAX)
+DO_SAT(gvec_uqadd_h, int, uint16_t, uint16_t, +, 0, UINT16_MAX)
+DO_SAT(gvec_uqadd_s, int64_t, uint32_t, uint32_t, +, 0, UINT32_MAX)
+
+DO_SAT(gvec_sqadd_b, int, int8_t, int8_t, +, INT8_MIN, INT8_MAX)
+DO_SAT(gvec_sqadd_h, int, int16_t, int16_t, +, INT16_MIN, INT16_MAX)
+DO_SAT(gvec_sqadd_s, int64_t, int32_t, int32_t, +, INT32_MIN, INT32_MAX)
+
+DO_SAT(gvec_uqsub_b, int, uint8_t, uint8_t, -, 0, UINT8_MAX)
+DO_SAT(gvec_uqsub_h, int, uint16_t, uint16_t, -, 0, UINT16_MAX)
+DO_SAT(gvec_uqsub_s, int64_t, uint32_t, uint32_t, -, 0, UINT32_MAX)
+
+DO_SAT(gvec_sqsub_b, int, int8_t, int8_t, -, INT8_MIN, INT8_MAX)
+DO_SAT(gvec_sqsub_h, int, int16_t, int16_t, -, INT16_MIN, INT16_MAX)
+DO_SAT(gvec_sqsub_s, int64_t, int32_t, int32_t, -, INT32_MIN, INT32_MAX)
+
+#undef DO_SAT
+
+void HELPER(gvec_uqadd_d)(void *vd, void *vq, void *vn,
+                          void *vm, uint32_t desc)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    uint64_t *d = vd, *n = vn, *m = vm;
+    bool q = false;
+
+    for (i = 0; i < oprsz / 8; i++) {
+        uint64_t nn = n[i], mm = m[i], dd = nn + mm;
+        if (dd < nn) {
+            dd = UINT64_MAX;
+            q = true;
+        }
+        d[i] = dd;
+    }
+    if (q) {
+        uint32_t *qc = vq;
+        qc[0] = 1;
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_uqsub_d)(void *vd, void *vq, void *vn,
+                          void *vm, uint32_t desc)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    uint64_t *d = vd, *n = vn, *m = vm;
+    bool q = false;
+
+    for (i = 0; i < oprsz / 8; i++) {
+        uint64_t nn = n[i], mm = m[i], dd = nn - mm;
+        if (nn < mm) {
+            dd = 0;
+            q = true;
+        }
+        d[i] = dd;
+    }
+    if (q) {
+        uint32_t *qc = vq;
+        qc[0] = 1;
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_sqadd_d)(void *vd, void *vq, void *vn,
+                          void *vm, uint32_t desc)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    int64_t *d = vd, *n = vn, *m = vm;
+    bool q = false;
+
+    for (i = 0; i < oprsz / 8; i++) {
+        int64_t nn = n[i], mm = m[i], dd = nn + mm;
+        if (((dd ^ nn) & ~(nn ^ mm)) & INT64_MIN) {
+            dd = (nn >> 63) ^ ~INT64_MIN;
+            q = true;
+        }
+        d[i] = dd;
+    }
+    if (q) {
+        uint32_t *qc = vq;
+        qc[0] = 1;
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_sqsub_d)(void *vd, void *vq, void *vn,
+                          void *vm, uint32_t desc)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    int64_t *d = vd, *n = vn, *m = vm;
+    bool q = false;
+
+    for (i = 0; i < oprsz / 8; i++) {
+        int64_t nn = n[i], mm = m[i], dd = nn - mm;
+        if (((dd ^ nn) & (nn ^ mm)) & INT64_MIN) {
+            dd = (nn >> 63) ^ ~INT64_MIN;
+            q = true;
+        }
+        d[i] = dd;
+    }
+    if (q) {
+        uint32_t *qc = vq;
+        qc[0] = 1;
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Fortunately, the functions affected are so far only called from SVE,
so there is no tail to be cleared.  But as we convert more of AdvSIMD
to gvec, this will matter.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190209033847.9014-13-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/vec_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *stat, uint32_t desc)  \
     for (i = 0; i < oprsz / sizeof(TYPE); i++) {                  \
         d[i] = FUNC(n[i], stat);                                  \
     }                                                             \
+    clear_tail(d, oprsz, simd_maxsz(desc));                       \
 }
 
 DO_2OP(gvec_frecpe_h, helper_recpe_f16, float16)
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *vm, void *stat, uint32_t desc) \
     for (i = 0; i < oprsz / sizeof(TYPE); i++) {                           \
         d[i] = FUNC(n[i], m[i], stat);                                     \
     }                                                                      \
+    clear_tail(d, oprsz, simd_maxsz(desc));                                \
 }
 
 DO_3OP(gvec_fadd_h, float16_add, float16)
-- 
2.20.1

From: Sandra Loosemore <sandra@codesourcery.com>

Per the GDB remote protocol documentation

https://sourceware.org/gdb/current/onlinedocs/gdb/Packets.html#index-vKill-packet

the debug stub is expected to send a reply to the 'vKill' packet.  At
least some versions of GDB crash if the gdb stub simply exits without
sending a reply.  This patch fixes QEMU's gdb stub to conform to the
expected behavior.

Note that QEMU's existing handling of the legacy 'k' packet is
correct: in that case GDB does not expect a reply, and QEMU does not
send one.

Signed-off-by: Sandra Loosemore <sandra@codesourcery.com>
Message-id: 1550008033-26540-1-git-send-email-sandra@codesourcery.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 gdbstub.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/gdbstub.c b/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/gdbstub.c
+++ b/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int gdb_handle_packet(GDBState *s, const char *line_buf)
             break;
         } else if (strncmp(p, "Kill;", 5) == 0) {
             /* Kill the target */
+            put_packet(s, "OK");
             error_report("QEMU: Terminated via GDBstub");
             exit(0);
         } else {
-- 
2.20.1