Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-target-arm queue:
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
  * mostly my latest v8M stuff, plus a couple of minor patches
-The following changes since commit a0b261db8c030813e30a39eae47359ac2a37f7e2:
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
-  Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2017-10-12 10:02:09 +0100)
+are available in the Git repository at:
-are available in the git repository at:
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171012
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-for you to fetch changes up to cf5f7937b05c84d5565134f058c00cd48304a117:
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
   nvic: Fix miscalculation of offsets into ITNS array (2017-10-12 16:33:16 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * v8M: SG, BLXNS, secure-return
+ * Fix coverity nit in int_to_float code
- * v8M: fixes for coverity issues in previous patches
+ * Don't set Invalid for float-to-int(MAXINT)
- * arm: fix armv7m_init() declaration to match definition
+ * Fix fp_status_f16 tininess before rounding
- * watchdog/aspeed: fix variable type to store reload value
+ * Add various missing insns from the v8.2-FP16 extension
  * Fix sqrt_f16 exception raising
  * sdcard: Correct CRC16 offset in sd_function_switch()
  * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Cédric Le Goater (1):
+Alex Bennée (5):
-      watchdog/aspeed: fix variable type to store reload value
+      fpu/softfloat: int_to_float ensure r fully initialised
       target/arm: Implement FCMP for fp16
       target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Igor Mammedov (1):
+Peter Maydell (3):
-      arm: fix armv7m_init() declaration to match definition
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
       target/arm: Fix fp_status_f16 tininess before rounding
       tcg: Optionally log FPU state in TCG -d cpu logging
-Peter Maydell (11):
+Philippe Mathieu-Daudé (1):
-      target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
+      sdcard: Correct CRC16 offset in sd_function_switch()
       target/arm: Implement SG instruction
       target/arm: Implement BLXNS
       target/arm: Implement secure function return
       target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
       target/arm: Pull Thumb insn word loads up to top level
       target-arm: Simplify insn_crosses_page()
       target/arm: Support some Thumb insns being always unconditional
       target/arm: Implement SG instruction corner cases
       nvic: Add missing 'break'
       nvic: Fix miscalculation of offsets into ITNS array
- include/hw/arm/arm.h     |   2 +-
+Richard Henderson (7):
- target/arm/helper.h      |   1 +
+      target/arm: Implement FMOV (general) for fp16
- target/arm/internals.h   |   8 ++
+      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
- hw/intc/armv7m_nvic.c    |   5 +-
+      target/arm: Implement FCVT (scalar, integer) for fp16
- hw/watchdog/wdt_aspeed.c |   4 +-
+      target/arm: Implement FCVT (scalar, fixed-point) for fp16
- target/arm/helper.c      | 306 ++++++++++++++++++++++++++++++++++++++++++++--
+      target/arm: Introduce and use read_fp_hreg
- target/arm/translate.c   | 310 ++++++++++++++++++++++++++++++++---------------
+      target/arm: Implement FP data-processing (2 source) for fp16
-files changed, 521 insertions(+), 115 deletions(-)
+      target/arm: Implement FP data-processing (3 source) for fp16
+ include/qemu/log.h         |   1 +
+ target/arm/helper-a64.h    |   2 +
+ target/arm/helper.h        |   6 +
+ accel/tcg/cpu-exec.c       |   9 +-
+ fpu/softfloat.c            |   6 +-
+ hw/sd/sd.c                 |   2 +-
+ target/arm/cpu.c           |   2 +
+ target/arm/helper-a64.c    |  10 ++
+ target/arm/helper.c        |  38 +++-
+ target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
+ util/log.c                 |   2 +
+files changed, 428 insertions(+), 71 deletions(-)

-New patch
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+From: Alex Bennée <alex.bennee@linaro.org>
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
+later on so we might as well mirror that.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ fpu/softfloat.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+ static FloatParts int_to_float(int64_t a, float_status *status)
+ {
+-    FloatParts r;
++    FloatParts r = {};
+     if (a == 0) {
+         r.cls = float_class_zero;
+         r.sign = false;
+--
+.17.0

-[Qemu-devel] [PULL 13/13] nvic: Fix miscalculation of offsets into ITNS array
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-This calculation of the first exception vector in
+In float-to-integer conversion, if the floating point input
-the ITNS<n> register being accessed:
+converts exactly to the largest or smallest integer that
-        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
+fits in to the result type, this is not an overflow.
 In this situation we were producing the correct result value,
 but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-is incorrect, because offset is in bytes, so we only want
+Fix the boundary case to take the right half of the if()
-to multiply by 8.
+statements.
-Spotted by Coverity (CID 1381484, CID 1381488), though it is
+This fixes a regression from 2.11 introduced by the softfloat
-not correct that it actually overflows the buffer, because
+refactoring.
 we have a 'startvec + i < s->num_irq' guard.
+Cc: qemu-stable@nongnu.org
+Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 4 ++--
+ fpu/softfloat.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/fpu/softfloat.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
-         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
+             r = UINT64_MAX;
-     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
+         }
-     {
+         if (p.sign) {
--        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
+-            if (r < -(uint64_t) min) {
-+        int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
++            if (r <= -(uint64_t) min) {
-         int i;
+                 return -r;
+             } else {
-         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+                 return min;
-     switch (offset) {
+             }
-     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
+         } else {
-     {
+-            if (r < max) {
--        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
++            if (r <= max) {
-+        int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
+                 return r;
-         int i;
+             } else {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
          if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 --
-.7.4
+.17.0

-New patch
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+In commit d81ce0ef2c4f105 we added an extra float_status field
+fp_status_fp16 for Arm, but forgot to initialize it correctly
+by setting it to float_tininess_before_rounding. This currently
+will only cause problems for the new V8_FP16 feature, since the
+float-to-float conversion code doesn't use it yet. The effect
+would be that we failed to set the Underflow IEEE exception flag
+in all the cases where we should.
+Add the missing initialization.
+Fixes: d81ce0ef2c4f105
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
+---
+ target/arm/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+                               &env->vfp.fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding,
+                               &env->vfp.standard_fp_status);
++    set_float_detect_tininess(float_tininess_before_rounding,
++                              &env->vfp.fp_status_f16);
+ #ifndef CONFIG_USER_ONLY
+     if (kvm_enabled()) {
+         kvm_arm_reset_vcpu(cpu);
+--
+.17.0

-[Qemu-devel] [PULL 01/13] watchdog/aspeed: fix variable type to store reload value
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Initially from Anton D. Kachalov" <mouse@yandex-team.ru> but the SoB was
+Adding the fp16 moves to/from general registers.
 missing.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Cc: qemu-stable@nongnu.org
-Acked-by: Andrew Jeffery <andrew@aj.id.au>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20170920064915.30027-1-clg@kaod.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-[clg: change commit log and subject
+Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
       replace UL suffix by ULL ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/watchdog/wdt_aspeed.c | 4 ++--
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 21 insertions(+)
-diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/watchdog/wdt_aspeed.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/watchdog/wdt_aspeed.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
- static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)
+             clear_vec_high(s, true, rd);
- {
+             break;
--    uint32_t reload;
++        case 3:
-+    uint64_t reload;
++            /* 16 bit */
++            tmp = tcg_temp_new_i64();
-     if (pclk) {
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
-         reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
++            write_fp_dreg(s, rd, tmp);
-                           s->pclk_freq);
++            tcg_temp_free_i64(tmp);
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      } else {
--        reload = s->regs[WDT_RELOAD_VALUE] * 1000;
+         TCGv_i64 tcg_rd = cpu_reg(s, rd);
-+        reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
+ }
-     if (aspeed_wdt_is_enabled(s)) {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          case 0xa: /* 64 bit */
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 02/13] arm: fix armv7m_init() declaration to match definition
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-From: Igor Mammedov <imammedo@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-s/cpu_model/cpu_type/ that has been forgotten during
+No sense in emitting code after the exception.
 conversion (ba1ba5cc), while touching the line also
 fixup alignment.
-Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507710805-221721-1-git-send-email-imammedo@redhat.com
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/arm.h | 2 +-
+ target/arm/translate-a64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/arm.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/arm.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef enum {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+         default:
- /* armv7m.c */
+             /* all other sf/type/rmode combinations are invalid */
- DeviceState *armv7m_init(MemoryRegion *system_memory, int mem_size, int num_irq,
+             unallocated_encoding(s);
--                      const char *kernel_filename, const char *cpu_model);
+-            break;
-+                         const char *kernel_filename, const char *cpu_type);
++            return;
- /**
+         }
-  * armv7m_load_kernel:
-  * @cpu: CPU
+         if (!fp_access_check(s)) {
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 05/13] target/arm: Implement BLXNS
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
-Implement the BLXNS instruction, which allows secure code to
+From: Richard Henderson <richard.henderson@linaro.org>
-call non-secure code.
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-4-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.h    |  1 +
+ target/arm/helper.h        |  6 +++
- target/arm/internals.h |  1 +
+ target/arm/helper.c        | 38 ++++++++++++++-
- target/arm/helper.c    | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
- target/arm/translate.c | 17 +++++++++++++--
+files changed, 122 insertions(+), 18 deletions(-)
 files changed, 76 insertions(+), 2 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(v7m_msr, void, env, i32, i32)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
- DEF_HELPER_2(v7m_mrs, i32, env, i32)
+ DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+ DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
- DEF_HELPER_2(v7m_bxns, void, env, i32)
+ DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
-+DEF_HELPER_2(v7m_blxns, void, env, i32)
++DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
++DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
- DEF_HELPER_4(access_check_cp_reg, void, env, ptr, i32, i32)
++DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
- DEF_HELPER_3(set_cp_reg, void, env, ptr, i32)
++DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+ DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
-index XXXXXXX..XXXXXXX 100644
+ DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
---- a/target/arm/internals.h
+ DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
-+++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
-@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)
+ DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
- FIELD(V7M_CONTROL, NPRIV, 0, 1)
+ DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
- FIELD(V7M_CONTROL, SPSEL, 1, 1)
+ DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
- FIELD(V7M_CONTROL, FPCA, 2, 1)
++DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
-+FIELD(V7M_CONTROL, SFPA, 3, 1)
++DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
- /* Bit definitions for v7M exception return payload */
+ DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
- FIELD(V7M_EXCRET, ES, 0, 1)
+ DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
+@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
-     g_assert_not_reached();
+ #undef VFP_CONV_FIX_A64
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
-+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
++float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
-+    /* translate.c should never generate calls here in user-only mode */
++    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
-+    g_assert_not_reached();
++}
-+}
++
-+
++float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
- void switch_mode(CPUARMState *env, int mode)
++{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+     if (unlikely(float16_is_any_nan(f))) {
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
-     env->regs[15] = dest & ~1;
+     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
-+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
++uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
-+    /* Handle v7M BLXNS:
++    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
-+     *  - bit 0 of the destination address is the target security state
++}
-+     */
++
-+
++uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
-+    /* At this point regs[15] is the address just after the BLXNS */
++{
-+    uint32_t nextinst = env->regs[15] | 1;
++    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
-+    uint32_t sp = env->regs[13] - 8;
++}
-+    uint32_t saved_psr;
++
-+
++uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
-+    /* translate.c will have made BLXNS UNDEF unless we're secure */
++{
-+    assert(env->v7m.secure);
++    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
-+
++}
-+    if (dest & 1) {
++
-+        /* target is Secure, so this is just a normal BLX,
++uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
-+         * except that the low bit doesn't indicate Thumb/not.
++{
-+         */
++    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
-+        env->regs[14] = nextinst;
++}
-+        env->thumb = 1;
++
-+        env->regs[15] = dest & ~1;
+ /* Set the current fp rounding mode and return the old one.
-+        return;
+  * The argument is a softfloat float_round_ value.
-+    }
+  */
-+
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-+    /* Target is non-secure: first push a stack frame */
+index XXXXXXX..XXXXXXX 100644
-+    if (!QEMU_IS_ALIGNED(sp, 8)) {
+--- a/target/arm/translate-a64.c
-+        qemu_log_mask(LOG_GUEST_ERROR,
++++ b/target/arm/translate-a64.c
-+                      "BLXNS with misaligned SP is UNPREDICTABLE\n");
+@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
-+    }
+                            bool itof, int rmode, int scale, int sf, int type)
 +
 +    saved_psr = env->v7m.exception;
 +    if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
 +        saved_psr |= XPSR_SFPA;
 +    }
 +
 +    /* Note that these stores can throw exceptions on MPU faults */
 +    cpu_stl_data(env, sp, nextinst);
 +    cpu_stl_data(env, sp + 4, saved_psr);
 +
 +    env->regs[13] = sp;
 +    env->regs[14] = 0xfeffffff;
 +    if (arm_v7m_is_handler_mode(env)) {
 +        /* Write a dummy value to IPSR, to avoid leaking the current secure
 +         * exception number to non-secure code. This is guaranteed not
 +         * to cause write_v7m_exception() to actually change stacks.
 +         */
 +        write_v7m_exception(env, 1);
 +    }
 +    switch_v7m_security_state(env, 0);
 +    env->thumb = 1;
 +    env->regs[15] = dest;
 +}
 +
  static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
                                  bool spsel)
  {
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+     bool is_signed = !(opcode & 1);
-index XXXXXXX..XXXXXXX 100644
+-    bool is_double = type;
---- a/target/arm/translate.c
+     TCGv_ptr tcg_fpstatus;
-+++ b/target/arm/translate.c
+-    TCGv_i32 tcg_shift;
-@@ -XXX,XX +XXX,XX @@ static inline void gen_bxns(DisasContext *s, int rm)
++    TCGv_i32 tcg_shift, tcg_single;
-     s->base.is_jmp = DISAS_EXIT;
++    TCGv_i64 tcg_double;
- }
+-    tcg_fpstatus = get_fpstatus_ptr(false);
-+static inline void gen_blxns(DisasContext *s, int rm)
++    tcg_fpstatus = get_fpstatus_ptr(type == 3);
-+{
-+    TCGv_i32 var = load_reg(s, rm);
+     tcg_shift = tcg_const_i32(64 - scale);
-+
-+    /* We don't need to sync condexec state, for the same reason as bxns.
+@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
-+     * We do however need to set the PC, because the blxns helper reads it.
+             tcg_int = tcg_extend;
-+     * The blxns helper may throw an exception.
+         }
-+     */
-+    gen_set_pc_im(s, s->pc);
+-        if (is_double) {
-+    gen_helper_v7m_blxns(cpu_env, var);
+-            TCGv_i64 tcg_double = tcg_temp_new_i64();
-+    tcg_temp_free_i32(var);
++        switch (type) {
-+    s->base.is_jmp = DISAS_EXIT;
++        case 1: /* float64 */
-+}
++            tcg_double = tcg_temp_new_i64();
-+
+             if (is_signed) {
- /* Variant of store_reg which uses branch&exchange logic when storing
+                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
-    to r15 in ARM architecture v7 and above. The source must be a temporary
+                                      tcg_shift, tcg_fpstatus);
-    and will be marked as dead. */
+@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+             }
-                         goto undef;
+             write_fp_dreg(s, rd, tcg_double);
-                     }
+             tcg_temp_free_i64(tcg_double);
-                     if (link) {
+-        } else {
--                        /* BLXNS: not yet implemented */
+-            TCGv_i32 tcg_single = tcg_temp_new_i32();
--                        goto undef;
++            break;
-+                        gen_blxns(s, rm);
++
-                     } else {
++        case 0: /* float32 */
-                         gen_bxns(s, rm);
++            tcg_single = tcg_temp_new_i32();
-                     }
+             if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 12/13] nvic: Add missing 'break'
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
-Coverity points out that we forgot the 'break' for
+From: Richard Henderson <richard.henderson@linaro.org>
 the SAU_CTRL write case (CID1381683). This has
 no actual visible consequences because it happens
 that the following case is effectively a no-op.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1507742676-9908-1-git-send-email-peter.maydell@linaro.org
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- hw/intc/armv7m_nvic.c | 1 +
+ target/arm/translate-a64.c | 17 +++++++++++++++--
-file changed, 1 insertion(+)
+file changed, 15 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
-             return;
+     bool sf = extract32(insn, 31, 1);
-         }
+     bool itof;
-         cpu->env.sau.ctrl = value & 3;
 -    if (sbit || (type > 1)
 -        || (!sf && scale < 32)) {
 +    if (sbit || (!sf && scale < 32)) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0: /* float32 */
 +    case 1: /* float64 */
 +        break;
-     case 0xdd4: /* SAU_TYPE */
++    case 3: /* float16 */
-         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-             goto bad_offset;
++            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 10/13] target/arm: Support some Thumb insns being always unconditional
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
-A few Thumb instructions are always unconditional even inside an
+From: Richard Henderson <richard.henderson@linaro.org>
 IT block (as opposed to being UNPREDICTABLE if used inside an
 IT block): BKPT, the v8M SG instruction, and the A profile
 HLT (debug halt) instruction.
-This means we need to suppress the jump-over-instruction-on-condfail
+Cc: qemu-stable@nongnu.org
-code generation (though the IT state still advances as usual and
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-subsequent insns in the IT block may be conditional).
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 30 ++++++++++++++----------------
 file changed, 14 insertions(+), 16 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1507556919-24992-9-git-send-email-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 file changed, 47 insertions(+), 1 deletion(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/translate.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
-        in init_disas_context by adjusting max_insns.  */
+     return v;
  }
-+static bool thumb_insn_is_unconditional(DisasContext *s, uint32_t insn)
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
 +{
-+    /* Return true if this Thumb insn is always unconditional,
++    TCGv_i32 v = tcg_temp_new_i32();
 +     * even inside an IT block. This is true of only a very few
 +     * instructions: BKPT, HLT, and SG.
 +     *
 +     * A larger class of instructions are UNPREDICTABLE if used
 +     * inside an IT block; we do not need to detect those here, because
 +     * what we do by default (perform the cc check and update the IT
 +     * bits state machine) is a permitted CONSTRAINED UNPREDICTABLE
 +     * choice for those situations.
 +     *
 +     * insn is either a 16-bit or a 32-bit instruction; the two are
 +     * distinguishable because for the 16-bit case the top 16 bits
 +     * are zeroes, and that isn't a valid 32-bit encoding.
 +     */
 +    if ((insn & 0xffffff00) == 0xbe00) {
 +        /* BKPT */
 +        return true;
 +    }
 +
-+    if ((insn & 0xffffffc0) == 0xba80 && arm_dc_feature(s, ARM_FEATURE_V8) &&
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
-+        !arm_dc_feature(s, ARM_FEATURE_M)) {
++    return v;
 +        /* HLT: v8A only. This is unconditional even when it is going to
 +         * UNDEF; see the v8A ARM ARM DDI0487B.a H3.3.
 +         * For v7 cores this was a plain old undefined encoding and so
 +         * honours its cc check. (We might be using the encoding as
 +         * a semihosting trap, but we don't change the cc check behaviour
 +         * on that account, because a debugger connected to a real v7A
 +         * core and emulating semihosting traps by catching the UNDEF
 +         * exception would also only see cases where the cc check passed.
 +         * No guest code should be trying to do a HLT semihosting trap
 +         * in an IT block anyway.
 +         */
 +        return true;
 +    }
 +
 +    if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_V8) &&
 +        arm_dc_feature(s, ARM_FEATURE_M)) {
 +        /* SG: v8M only */
 +        return true;
 +    }
 +
 +    return false;
 +}
 +
- static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
+     TCGv_ptr fpst = NULL;
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
-         dc->pc += 2;
++    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
      TCGv_i32 tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
      switch (opcode) {
      case 0x0: /* FMOV */
          tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
          tcg_temp_free_i64(tcg_op2);
          tcg_temp_free_i64(tcg_res);
      } else {
 -        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
 -        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
 +        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
          TCGv_i64 tcg_res = tcg_temp_new_i64();
 -        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
--    if (dc->condexec_mask) {
+     if (is_scalar) {
-+    if (dc->condexec_mask && !thumb_insn_is_unconditional(dc, insn)) {
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
-         uint32_t cond = dc->condexec_cond;
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
-         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
 -        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
          switch (fpop) {
          case 0x1a: /* FCVTNS */
          case 0x1b: /* FCVTMS */
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 08/13] target/arm: Pull Thumb insn word loads up to top level
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
-Refactor the Thumb decode to do the loads of the instruction words at
+From: Richard Henderson <richard.henderson@linaro.org>
 the top level rather than only loading the second half of a 32-bit
 Thumb insn in the middle of the decode.
-This is simple apart from the awkward case of Thumb1, where the
+We missed all of the scalar fp16 binary operations.
 BL/BLX prefix and suffix instructions live in what in Thumb2 is the
 -bit insn space.  To handle these we decode enough to identify
 whether we're looking at a prefix/suffix that we handle as a 16 bit
 insn, or a prefix that we're going to merge with the following suffix
 to consider as a 32 bit insn.  The translation of the 16 bit cases
 then moves from disas_thumb2_insn() to disas_thumb_insn().
-The refactoring has the benefit that we don't need to pass the
+Cc: qemu-stable@nongnu.org
-CPUARMState* down into the decoder code any more, but the major
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-reason for doing this is that some Thumb instructions must be always
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-unconditional regardless of the IT state bits, so we need to know the
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-whole insn before we emit the "skip this insn if the IT bits and cond
+Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
-state tell us to" code.  (The always unconditional insns are BKPT,
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-HLT and SG; the last of these is 32 bits.)
+---
  target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 file changed, 65 insertions(+)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1507556919-24992-7-git-send-email-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 178 ++++++++++++++++++++++++++++++-------------------
 file changed, 108 insertions(+), 70 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/translate.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
-     }
+     tcg_temp_free_i64(tcg_res);
  }
-+static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
++/* Floating-point data-processing (2 source) - half precision */
 +static void handle_fp_2src_half(DisasContext *s, int opcode,
 +                                int rd, int rn, int rm)
 +{
-+    /* Return true if this is a 16 bit instruction. We must be precise
++    TCGv_i32 tcg_op1;
-+     * about this (matching the decode).  We assume that s->pc still
++    TCGv_i32 tcg_op2;
-+     * points to the first 16 bits of the insn.
++    TCGv_i32 tcg_res;
-+     */
++    TCGv_ptr fpst;
-+    if ((insn >> 11) < 0x1d) {
++
-+        /* Definitely a 16-bit instruction */
++    tcg_res = tcg_temp_new_i32();
-+        return true;
++    fpst = get_fpstatus_ptr(true);
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
 +
 +    switch (opcode) {
 +    case 0x0: /* FMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x1: /* FDIV */
 +        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
-+    /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
++    write_fp_sreg(s, rd, tcg_res);
 +     * first half of a 32-bit Thumb insn. Thumb-1 cores might
 +     * end up actually treating this as two 16-bit insns, though,
 +     * if it's half of a bl/blx pair that might span a page boundary.
 +     */
 +    if (arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
 +        /* Thumb2 cores (including all M profile ones) always treat
 +         * 32-bit insns as 32-bit.
 +         */
 +        return false;
 +    }
 +
-+    if ((insn >> 11) == 0x1e && (s->pc < s->next_page_start - 3)) {
++    tcg_temp_free_ptr(fpst);
-+        /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
++    tcg_temp_free_i32(tcg_op1);
-+         * is not on the next page; we merge this into a 32-bit
++    tcg_temp_free_i32(tcg_op2);
-+         * insn.
++    tcg_temp_free_i32(tcg_res);
 +         */
 +        return false;
 +    }
 +    /* 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF);
 +     * 0b1111_1xxx_xxxx_xxxx : BL suffix;
 +     * 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix on the end of a page
 +     *  -- handle as single 16 bit insn
 +     */
 +    return true;
 +}
 +
- /* Return true if this is a Thumb-2 logical op.  */
+ /* Floating point data-processing (2 source)
- static int
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
- thumb2_logic_op(int op)
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
-@@ -XXX,XX +XXX,XX @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
+         }
- /* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
-    is not legal.  */
+         break;
--static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
++    case 3:
-+static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- {
++            unallocated_encoding(s);
--    uint32_t insn, imm, shift, offset;
++            return;
-+    uint32_t imm, shift, offset;
++        }
-     uint32_t rd, rn, rm, rs;
++        if (!fp_access_check(s)) {
-     TCGv_i32 tmp;
++            return;
-     TCGv_i32 tmp2;
++        }
-@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
++        handle_fp_2src_half(s, opcode, rd, rn, rm);
-     int conds;
++        break;
-     int logic_cc;
+     default:
+         unallocated_encoding(s);
 -    if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
 -        /* Thumb-1 cores may need to treat bl and blx as a pair of
 -           16-bit instructions to get correct prefetch abort behavior.  */
 -        insn = insn_hw1;
 -        if ((insn & (1 << 12)) == 0) {
 -            ARCH(5);
 -            /* Second half of blx.  */
 -            offset = ((insn & 0x7ff) << 1);
 -            tmp = load_reg(s, 14);
 -            tcg_gen_addi_i32(tmp, tmp, offset);
 -            tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
 -
 -            tmp2 = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp2, s->pc | 1);
 -            store_reg(s, 14, tmp2);
 -            gen_bx(s, tmp);
 -            return 0;
 -        }
 -        if (insn & (1 << 11)) {
 -            /* Second half of bl.  */
 -            offset = ((insn & 0x7ff) << 1) | 1;
 -            tmp = load_reg(s, 14);
 -            tcg_gen_addi_i32(tmp, tmp, offset);
 -
 -            tmp2 = tcg_temp_new_i32();
 -            tcg_gen_movi_i32(tmp2, s->pc | 1);
 -            store_reg(s, 14, tmp2);
 -            gen_bx(s, tmp);
 -            return 0;
 -        }
 -        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
 -            /* Instruction spans a page boundary.  Implement it as two
 -               16-bit instructions in case the second half causes an
 -               prefetch abort.  */
 -            offset = ((int32_t)insn << 21) >> 9;
 -            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
 -            return 0;
 -        }
 -        /* Fall through to 32-bit decode.  */
 -    }
 -
 -    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 -    s->pc += 2;
 -    insn |= (uint32_t)insn_hw1 << 16;
 -
 +    /* The only 32 bit insn that's allowed for Thumb1 is the combined
 +     * BL/BLX prefix and suffix.
 +     */
      if ((insn & 0xf800e800) != 0xf000e800) {
          ARCH(6T2);
      }
-@@ -XXX,XX +XXX,XX @@ illegal_op:
-     return 1;
- }
--static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
-+static void disas_thumb_insn(DisasContext *s, uint32_t insn)
- {
--    uint32_t val, insn, op, rm, rn, rd, shift, cond;
-+    uint32_t val, op, rm, rn, rd, shift, cond;
-     int32_t offset;
-     int i;
-     TCGv_i32 tmp;
-     TCGv_i32 tmp2;
-     TCGv_i32 addr;
--    if (s->condexec_mask) {
--        cond = s->condexec_cond;
--        if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
--          s->condlabel = gen_new_label();
--          arm_gen_test_cc(cond ^ 1, s->condlabel);
--          s->condjmp = 1;
--        }
--    }
--
--    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
--    s->pc += 2;
--
-     switch (insn >> 12) {
-     case 0: case 1:
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
-     case 14:
-         if (insn & (1 << 11)) {
--            if (disas_thumb2_insn(env, s, insn))
--              goto undef32;
-+            /* thumb_insn_is_16bit() ensures we can't get here for
-+             * a Thumb2 CPU, so this must be a thumb1 split BL/BLX:
-+             * 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF)
-+             */
-+            assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
-+            ARCH(5);
-+            offset = ((insn & 0x7ff) << 1);
-+            tmp = load_reg(s, 14);
-+            tcg_gen_addi_i32(tmp, tmp, offset);
-+            tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
-+
-+            tmp2 = tcg_temp_new_i32();
-+            tcg_gen_movi_i32(tmp2, s->pc | 1);
-+            store_reg(s, 14, tmp2);
-+            gen_bx(s, tmp);
-             break;
-         }
-         /* unconditional branch */
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
-         break;
-     case 15:
--        if (disas_thumb2_insn(env, s, insn))
--            goto undef32;
-+        /* thumb_insn_is_16bit() ensures we can't get here for
-+         * a Thumb2 CPU, so this must be a thumb1 split BL/BLX.
-+         */
-+        assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
-+
-+        if (insn & (1 << 11)) {
-+            /* 0b1111_1xxx_xxxx_xxxx : BL suffix */
-+            offset = ((insn & 0x7ff) << 1) | 1;
-+            tmp = load_reg(s, 14);
-+            tcg_gen_addi_i32(tmp, tmp, offset);
-+
-+            tmp2 = tcg_temp_new_i32();
-+            tcg_gen_movi_i32(tmp2, s->pc | 1);
-+            store_reg(s, 14, tmp2);
-+            gen_bx(s, tmp);
-+        } else {
-+            /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
-+            uint32_t uoffset = ((int32_t)insn << 21) >> 9;
-+
-+            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
-+        }
-         break;
-     }
-     return;
--undef32:
--    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
--                       default_exception_el(s));
--    return;
- illegal_op:
- undef:
-     gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
- {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUARMState *env = cpu->env_ptr;
-+    uint32_t insn;
-+    bool is_16bit;
-     if (arm_pre_translate_insn(dc)) {
-         return;
-     }
--    disas_thumb_insn(env, dc);
-+    insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-+    is_16bit = thumb_insn_is_16bit(dc, insn);
-+    dc->pc += 2;
-+    if (!is_16bit) {
-+        uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
-+
-+        insn = insn << 16 | insn2;
-+        dc->pc += 2;
-+    }
-+
-+    if (dc->condexec_mask) {
-+        uint32_t cond = dc->condexec_cond;
-+
-+        if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
-+            dc->condlabel = gen_new_label();
-+            arm_gen_test_cc(cond ^ 1, dc->condlabel);
-+            dc->condjmp = 1;
-+        }
-+    }
-+
-+    if (is_16bit) {
-+        disas_thumb_insn(dc, insn);
-+    } else {
-+        disas_thumb2_insn(dc, insn);
-+    }
-     /* Advance the Thumb condexec condition.  */
-     if (dc->condexec_mask) {
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 06/13] target/arm: Implement secure function return
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-Secure function return happens when a non-secure function has been
+From: Richard Henderson <richard.henderson@linaro.org>
 called using BLXNS and so has a particular magic LR value (either
 xfefffffe or 0xfeffffff). The function return via BX behaves
 specially when the new PC value is this magic value, in the same
 way that exception returns are handled.
-Adjust our BX excret guards so that they recognize the function
+We missed all of the scalar fp16 fma operations.
 return magic number as well, and perform the function-return
 unstacking in do_v7m_exception_exit().
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-5-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/internals.h |   7 +++
+ target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
- target/arm/helper.c    | 115 +++++++++++++++++++++++++++++++++++++++++++++----
+file changed, 48 insertions(+)
  target/arm/translate.c |  14 +++++-
 files changed, 126 insertions(+), 10 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/internals.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
- FIELD(V7M_EXCRET, S, 6, 1)
+     tcg_temp_free_i64(tcg_res);
- FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+ }
-+/* Minimum value which is a magic number for exception return */
++/* Floating-point data-processing (3 source) - half precision */
-+#define EXC_RETURN_MIN_MAGIC 0xff000000
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
-+/* Minimum number which is a magic number for function or exception return
++                                int rd, int rn, int rm, int ra)
-+ * when using v8M security extension
++{
-+ */
++    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
-+#define FNC_RETURN_MIN_MAGIC 0xfefffffe
++    TCGv_i32 tcg_res = tcg_temp_new_i32();
 +    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +
- /* We use a few fake FSR values for internal purposes in M profile.
++    tcg_op1 = read_fp_hreg(s, rn);
-  * M profile cores don't have A/R format FSRs, but currently our
++    tcg_op2 = read_fp_hreg(s, rm);
-  * get_phys_addr() code assumes A/R profile and reports failures via
++    tcg_op3 = read_fp_hreg(s, ra);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
       *  - if the return value is a magic value, do exception return (like BX)
       *  - otherwise bit 0 of the return value is the target security state
       */
 -    if (dest >= 0xff000000) {
 +    uint32_t min_magic;
 +
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++    /* These are fused multiply-add, and must be done as one
-+        /* Covers FNC_RETURN and EXC_RETURN magic */
++     * floating point operation with no rounding between the
-+        min_magic = FNC_RETURN_MIN_MAGIC;
++     * multiplication and addition steps.
-+    } else {
++     * NB that doing the negations here as separate steps is
-+        /* EXC_RETURN magic only */
++     * correct : an input NaN should come out with its sign bit
-+        min_magic = EXC_RETURN_MIN_MAGIC;
++     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
-+    if (dest >= min_magic) {
++    if (o0 != o1) {
-         /* This is an exception return magic value; put it where
++        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
           * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
           * Note that if we ever add gen_ss_advance() singlestep support to
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      bool exc_secure = false;
      bool return_to_secure;
 -    /* We can only get here from an EXCP_EXCEPTION_EXIT, and
 -     * gen_bx_excret() enforces the architectural rule
 -     * that jumps to magic addresses don't have magic behaviour unless
 -     * we're in Handler mode (compare pseudocode BXWritePC()).
 +    /* If we're not in Handler mode then jumps to magic exception-exit
 +     * addresses don't have magic behaviour. However for the v8M
 +     * security extensions the magic secure-function-return has to
 +     * work in thread mode too, so to avoid doing an extra check in
 +     * the generated code we allow exception-exit magic to also cause the
 +     * internal exception and bring us here in thread mode. Correct code
 +     * will never try to do this (the following insn fetch will always
 +     * fault) so we the overhead of having taken an unnecessary exception
 +     * doesn't matter.
       */
 -    assert(arm_v7m_is_handler_mode(env));
 +    if (!arm_v7m_is_handler_mode(env)) {
 +        return;
 +    }
      /* In the spec pseudocode ExceptionReturn() is called directly
       * from BXWritePC() and gets the full target PC value including
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
  }
 +static bool do_v7m_function_return(ARMCPU *cpu)
 +{
 +    /* v8M security extensions magic function return.
 +     * We may either:
 +     *  (1) throw an exception (longjump)
 +     *  (2) return true if we successfully handled the function return
 +     *  (3) return false if we failed a consistency check and have
 +     *      pended a UsageFault that needs to be taken now
 +     *
 +     * At this point the magic return value is split between env->regs[15]
 +     * and env->thumb. We don't bother to reconstitute it because we don't
 +     * need it (all values are handled the same way).
 +     */
 +    CPUARMState *env = &cpu->env;
 +    uint32_t newpc, newpsr, newpsr_exc;
 +
 +    qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
 +
 +    {
 +        bool threadmode, spsel;
 +        TCGMemOpIdx oi;
 +        ARMMMUIdx mmu_idx;
 +        uint32_t *frame_sp_p;
 +        uint32_t frameptr;
 +
 +        /* Pull the return address and IPSR from the Secure stack */
 +        threadmode = !arm_v7m_is_handler_mode(env);
 +        spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
 +
 +        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
 +        frameptr = *frame_sp_p;
 +
 +        /* These loads may throw an exception (for MPU faults). We want to
 +         * do them as secure, so work out what MMU index that is.
 +         */
 +        mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
 +        oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
 +        newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
 +        newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
 +
 +        /* Consistency checks on new IPSR */
 +        newpsr_exc = newpsr & XPSR_EXCP;
 +        if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
 +              (env->v7m.exception == 1 && newpsr_exc != 0))) {
 +            /* Pend the fault and tell our caller to take it */
 +            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
 +                                    env->v7m.secure);
 +            qemu_log_mask(CPU_LOG_INT,
 +                          "...taking INVPC UsageFault: "
 +                          "IPSR consistency check failed\n");
 +            return false;
 +        }
 +
 +        *frame_sp_p = frameptr + 8;
 +    }
 +
-+    /* This invalidates frame_sp_p */
++    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +    switch_v7m_security_state(env, true);
 +    env->v7m.exception = newpsr_exc;
 +    env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
 +    if (newpsr & XPSR_SFPA) {
 +        env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
 +    }
 +    xpsr_write(env, 0, XPSR_IT);
 +    env->thumb = newpc & 1;
 +    env->regs[15] = newpc & ~1;
 +
-+    qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
++    write_fp_sreg(s, rd, tcg_res);
-+    return true;
++
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- static void arm_log_exception(int idx)
+ /* Floating point data-processing (3 source)
- {
+  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
-     if (qemu_loglevel_mask(CPU_LOG_INT)) {
+  * +---+---+---+-----------+------+----+------+----+------+------+------+
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
-     case EXCP_IRQ:
+         }
          handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
          break;
-     case EXCP_EXCEPTION_EXIT:
++    case 3:
--        do_v7m_exception_exit(cpu);
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
--        return;
++            unallocated_encoding(s);
 +        if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
 +            /* Must be v8M security extension function return */
 +            assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
 +            assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
 +            if (do_v7m_function_return(cpu)) {
 +                return;
 +            }
 +        } else {
 +            do_v7m_exception_exit(cpu);
 +            return;
 +        }
++        if (!fp_access_check(s)) {
++            return;
++        }
++        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
-         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
+         unallocated_encoding(s);
          return; /* Never happens.  Keep compiler happy.  */
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)
       * s->base.is_jmp that we need to do the rest of the work later.
       */
      gen_bx(s, var);
 -    if (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M)) {
 +    if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||
 +        (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {
          s->base.is_jmp = DISAS_BX_EXCRET;
      }
- }
-@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
- {
-     /* Generate the code to finish possible exception return and end the TB */
-     TCGLabel *excret_label = gen_new_label();
-+    uint32_t min_magic;
-+
-+    if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY)) {
-+        /* Covers FNC_RETURN and EXC_RETURN magic */
-+        min_magic = FNC_RETURN_MIN_MAGIC;
-+    } else {
-+        /* EXC_RETURN magic only */
-+        min_magic = EXC_RETURN_MIN_MAGIC;
-+    }
-     /* Is the new PC value in the magic range indicating exception return? */
--    tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], 0xff000000, excret_label);
-+    tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
-     /* No: end the TB as we would for a DISAS_JMP */
-     if (is_singlestepping(s)) {
-         gen_singlestep_exception(s);
 --
-.7.4
+.17.0

-New patch
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+From: Alex Bennée <alex.bennee@linaro.org>
 These where missed out from the rest of the half-precision work.
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
 [rth: Diagnose lack of FP16 before fp_access_check]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper-a64.h    |  2 +
  target/arm/helper-a64.c    | 10 +++++
  target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 files changed, 83 insertions(+), 17 deletions(-)
 diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.h
 +++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
  DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
  DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
  DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
 +DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
 +DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
  DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
  DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
  DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
      return flags;
  }
 +uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
 +{
 +    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
 +}
 +
 +uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
 +{
 +    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
      return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
      }
  }
 -static void handle_fp_compare(DisasContext *s, bool is_double,
 +static void handle_fp_compare(DisasContext *s, int size,
                                unsigned int rn, unsigned int rm,
                                bool cmp_with_zero, bool signal_all_nans)
  {
      TCGv_i64 tcg_flags = tcg_temp_new_i64();
 -    TCGv_ptr fpst = get_fpstatus_ptr(false);
 +    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
  /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
 .17.0

-[Qemu-devel] [PULL 04/13] target/arm: Implement SG instruction
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-Implement the SG instruction, which we emulate 'by hand' in the
+From: Alex Bennée <alex.bennee@linaro.org>
 exception handling code path.
+These were missed out from the rest of the half-precision work.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
+[rth: Fix erroneous check vs type]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 132 ++++++++++++++++++++++++++++++++++++++++++++++++++--
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
-file changed, 127 insertions(+), 5 deletions(-)
+file changed, 25 insertions(+), 6 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-     bool irvalid;
+     unsigned int mos, type, rm, cond, rn, rd;
- } V8M_SAttributes;
+     TCGv_i64 t_true, t_false, t_zero;
+     DisasCompare64 c;
-+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
++    TCGMemOp sz;
-+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-+                                V8M_SAttributes *sattrs);
+     mos = extract32(insn, 29, 3);
-+
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
- /* Definitions for the PMCCNTR and PMCR registers */
++    type = extract32(insn, 22, 2);
- #define PMCRD   0x8
+     rm = extract32(insn, 16, 5);
- #define PMCRC   0x4
+     cond = extract32(insn, 12, 4);
-@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)
+     rn = extract32(insn, 5, 5);
-     }
+     rd = extract32(insn, 0, 5);
- }
+-    if (mos || type > 1) {
-+static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
++    if (mos) {
-+                               uint32_t addr, uint16_t *insn)
++        unallocated_encoding(s);
-+{
++        return;
 +    /* Load a 16-bit portion of a v7M instruction, returning true on success,
 +     * or false on failure (in which case we will have pended the appropriate
 +     * exception).
 +     * We need to do the instruction fetch's MPU and SAU checks
 +     * like this because there is no MMU index that would allow
 +     * doing the load with a single function call. Instead we must
 +     * first check that the security attributes permit the load
 +     * and that they don't mismatch on the two halves of the instruction,
 +     * and then we do the load as a secure load (ie using the security
 +     * attributes of the address, not the CPU, as architecturally required).
 +     */
 +    CPUState *cs = CPU(cpu);
 +    CPUARMState *env = &cpu->env;
 +    V8M_SAttributes sattrs = {};
 +    MemTxAttrs attrs = {};
 +    ARMMMUFaultInfo fi = {};
 +    MemTxResult txres;
 +    target_ulong page_size;
 +    hwaddr physaddr;
 +    int prot;
 +    uint32_t fsr;
 +
 +    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
 +    if (!sattrs.nsc || sattrs.ns) {
 +        /* This must be the second half of the insn, and it straddles a
 +         * region boundary with the second half not being S&NSC.
 +         */
 +        env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "...really SecureFault with SFSR.INVEP\n");
 +        return false;
 +    }
 +    if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
 +                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
 +        /* the MPU lookup failed */
 +        env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
 +        qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
 +        return false;
 +    }
 +    *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
 +                                 attrs, &txres);
 +    if (txres != MEMTX_OK) {
 +        env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
 +        qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static bool v7m_handle_execute_nsc(ARMCPU *cpu)
 +{
 +    /* Check whether this attempt to execute code in a Secure & NS-Callable
 +     * memory region is for an SG instruction; if so, then emulate the
 +     * effect of the SG instruction and return true. Otherwise pend
 +     * the correct kind of exception and return false.
 +     */
 +    CPUARMState *env = &cpu->env;
 +    ARMMMUIdx mmu_idx;
 +    uint16_t insn;
 +
 +    /* We should never get here unless get_phys_addr_pmsav8() caused
 +     * an exception for NS executing in S&NSC memory.
 +     */
 +    assert(!env->v7m.secure);
 +    assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
 +
 +    /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
 +    mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
 +
 +    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
 +        return false;
 +    }
 +
-+    if (!env->thumb) {
++    switch (type) {
-+        goto gen_invep;
++    case 0:
-+    }
++        sz = MO_32;
-+
++        break;
-+    if (insn != 0xe97f) {
++    case 1:
-+        /* Not an SG instruction first half (we choose the IMPDEF
++        sz = MO_64;
-+         * early-SG-check option).
++        break;
-+         */
++    case 3:
-+        goto gen_invep;
++        sz = MO_16;
-+    }
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+
++            break;
-+    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
++        }
-+        return false;
++        /* fallthru */
-+    }
++    default:
-+
+         unallocated_encoding(s);
-+    if (insn != 0xe97f) {
+         return;
-+        /* Not an SG instruction second half (yes, both halves of the SG
+     }
-+         * insn have the same hex value)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+         */
+         return;
-+        goto gen_invep;
+     }
-+    }
-+
+-    /* Zero extend sreg inputs to 64 bits now.  */
-+    /* OK, we have confirmed that we really have an SG instruction.
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-+     * We know we're NS in S memory so don't need to repeat those checks.
+     t_true = tcg_temp_new_i64();
-+     */
+     t_false = tcg_temp_new_i64();
-+    qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
+-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-+                  ", executing it\n", env->regs[15]);
+-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-+    env->regs[14] &= ~1;
++    read_vec_element(s, t_true, rn, 0, sz);
-+    switch_v7m_security_state(env, true);
++    read_vec_element(s, t_false, rm, 0, sz);
-+    xpsr_write(env, 0, XPSR_IT);
-+    env->regs[15] += 4;
+     a64_test_cc(&c, cond);
-+    return true;
+     t_zero = tcg_const_i64(0);
-+
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-+gen_invep:
+     tcg_temp_free_i64(t_false);
-+    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+     a64_free_cc(&c);
-+    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-+    qemu_log_mask(CPU_LOG_INT,
+-    /* Note that sregs write back zeros to the high bits,
-+                  "...really SecureFault with SFSR.INVEP\n");
++    /* Note that sregs & hregs write back zeros to the high bits,
-+    return false;
+        and we've already done the zero-extension.  */
-+}
+     write_fp_dreg(s, rd, t_true);
-+
+     tcg_temp_free_i64(t_true);
  void arm_v7m_cpu_do_interrupt(CPUState *cs)
  {
      ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
               * the SG instruction have the same security attributes.)
               * Everything else must generate an INVEP SecureFault, so we
               * emulate the SG instruction here.
 -             * TODO: actually emulate SG.
               */
 -            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 -            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 -            qemu_log_mask(CPU_LOG_INT,
 -                          "...really SecureFault with SFSR.INVEP\n");
 +            if (v7m_handle_execute_nsc(cpu)) {
 +                return;
 +            }
              break;
          case M_FAKE_FSR_SFAULT:
              /* Various flavours of SecureFault for attempts to execute or
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 11/13] target/arm: Implement SG instruction corner cases
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
-The common situation of the SG instruction is that it is
+From: Alex Bennée <alex.bennee@linaro.org>
 executed from S&NSC memory by a CPU in NS state. That case
 is handled by v7m_handle_execute_nsc(). However the instruction
 also has defined behaviour in a couple of other cases:
  * SG instruction in NS memory (behaves as a NOP)
  * SG in S memory but CPU already secure (clears IT bits and
    does nothing else)
  * SG instruction in v8M without Security Extension (NOP)
-These can be implemented in translate.c.
+All the hard work is already done by vfp_expand_imm, we just need to
 make sure we pick up the correct size.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
+[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-10-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 23 ++++++++++++++++++++++-
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
-file changed, 22 insertions(+), 1 deletion(-)
+file changed, 17 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/translate.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-              * - load/store doubleword, load/store exclusive, ldacq/strel,
+ {
-              *   table branch.
+     int rd = extract32(insn, 0, 5);
-              */
+     int imm8 = extract32(insn, 13, 8);
--            if (insn & 0x01200000) {
+-    int is_double = extract32(insn, 22, 2);
-+            if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_M) &&
++    int type = extract32(insn, 22, 2);
-+                arm_dc_feature(s, ARM_FEATURE_V8)) {
+     uint64_t imm;
-+                /* 0b1110_1001_0111_1111_1110_1001_0111_111
+     TCGv_i64 tcg_res;
-+                 *  - SG (v8M only)
++    TCGMemOp sz;
-+                 * The bulk of the behaviour for this instruction is implemented
-+                 * in v7m_handle_execute_nsc(), which deals with the insn when
+-    if (is_double > 1) {
-+                 * it is executed by a CPU in non-secure state from memory
++    switch (type) {
-+                 * which is Secure & NonSecure-Callable.
++    case 0:
-+                 * Here we only need to handle the remaining cases:
++        sz = MO_32;
-+                 *  * in NS memory (including the "security extension not
++        break;
-+                 *    implemented" case) : NOP
++    case 1:
-+                 *  * in S memory but CPU already secure (clear IT bits)
++        sz = MO_64;
-+                 * We know that the attribute for the memory this insn is
++        break;
-+                 * in must match the current CPU state, because otherwise
++    case 3:
-+                 * get_phys_addr_pmsav8 would have generated an exception.
++        sz = MO_16;
-+                 */
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+                if (s->v8m_secure) {
++            break;
-+                    /* Like the IT insn, we don't need to generate any code */
++        }
-+                    s->condexec_cond = 0;
++        /* fallthru */
-+                    s->condexec_mask = 0;
++    default:
-+                }
+         unallocated_encoding(s);
-+            } else if (insn & 0x01200000) {
+         return;
-                 /* 0b1110_1000_x11x_xxxx_xxxx_xxxx_xxxx_xxxx
+     }
-                  *  - load/store dual (post-indexed)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-                  * 0b1111_1001_x10x_xxxx_xxxx_xxxx_xxxx_xxxx
+         return;
      }
 -    imm = vfp_expand_imm(MO_32 + is_double, imm8);
 +    imm = vfp_expand_imm(sz, imm8);
      tcg_res = tcg_const_i64(imm);
      write_fp_dreg(s, rd, tcg_res);
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 07/13] target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
-The code which implements the Thumb1 split BL/BLX instructions
+From: Alex Bennée <alex.bennee@linaro.org>
 is guarded by a check on "not M or THUMB2". All we really need
 to check here is "not THUMB2" (and we assume that elsewhere too,
 eg in the ARCH(6T2) test that UNDEFs the Thumb2 insns).
-This doesn't change behaviour because all M profile cores
+We are meant to explicitly pass fpst, not cpu_env.
 have Thumb2 and so ARM_FEATURE_M implies ARM_FEATURE_THUMB2.
 (v6M implements a very restricted subset of Thumb2, but we
 can cross that bridge when we get to it with appropriate
 feature bits.)
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-6-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 3 +--
+ target/arm/translate-a64.c | 3 ++-
-file changed, 1 insertion(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/translate.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
-     int conds;
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-     int logic_cc;
+         break;
+     case 0x3: /* FSQRT */
--    if (!(arm_dc_feature(s, ARM_FEATURE_THUMB2)
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
--          || arm_dc_feature(s, ARM_FEATURE_M))) {
++        fpst = get_fpstatus_ptr(true);
-+    if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
-         /* Thumb-1 cores may need to treat bl and blx as a pair of
+         break;
--bit instructions to get correct prefetch abort behavior.  */
+     case 0x8: /* FRINTN */
-         insn = insn_hw1;
+     case 0x9: /* FRINTP */
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 09/13] target-arm: Simplify insn_crosses_page()
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
-Recent changes have left insn_crosses_page() more complicated
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 than it needed to be:
  * it's only called from thumb_tr_translate_insn() so we know
    for certain that we're looking at a Thumb insn
  * the caller's check for dc->pc >= dc->next_page_start - 3
    means that dc->pc can't possibly be 4 aligned, so there's
    no need to check that (the check was partly there to ensure
    that we didn't treat an ARM insn as Thumb, I think)
  * we now have thumb_insn_is_16bit() which lets us do a precise
    check of the length of the next insn, rather than opencoding
    an inaccurate check
-Simplify it down to just loading the first half of the insn
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
 and calling thumb_insn_is_16bit() on it.
+  The block length is predefined to 512 bits
+and "4.10.2 SD Status":
+  The SD Status contains status bits that are related to the SD Memory Card
+  proprietary features and may be used for future application-specific usage.
+  The size of the SD Status is one data block of 512 bit. The content of this
+  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
+Thus the 16-bit CRC goes at offset 64.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20180509060104.4458-3-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-8-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 27 ++++++---------------------
+ hw/sd/sd.c | 2 +-
-file changed, 6 insertions(+), 21 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/hw/sd/sd.c
-+++ b/target/arm/translate.c
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
- {
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
-     /* Return true if the insn at dc->pc might cross a page boundary.
+     }
-      * (False positives are OK, false negatives are not.)
+     memset(&sd->data[17], 0, 47);
-+     * We know this is a Thumb insn, and our caller ensures we are
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-+     * only called if dc->pc is less than 4 bytes from the page
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 +     * boundary, so we cross the page if the first 16 bits indicate
 +     * that this is a 32 bit insn.
       */
 -    uint16_t insn;
 +    uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 -    if ((s->pc & 3) == 0) {
 -        /* At a 4-aligned address we can't be crossing a page */
 -        return false;
 -    }
 -
 -    /* This must be a Thumb insn */
 -    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 -
 -    if ((insn >> 11) >= 0x1d) {
 -        /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
 -         * First half of a 32-bit Thumb insn. Thumb-1 cores might
 -         * end up actually treating this as two 16-bit insns (see the
 -         * code at the start of disas_thumb2_insn()) but we don't bother
 -         * to check for that as it is unlikely, and false positives here
 -         * are harmless.
 -         */
 -        return true;
 -    }
 -    /* Definitely a 16-bit insn, can't be crossing a page. */
 -    return false;
 +    return !thumb_insn_is_16bit(s, insn);
  }
- static int arm_tr_init_disas_context(DisasContextBase *dcbase,
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 --
-.7.4
+.17.0

-[Qemu-devel] [PULL 03/13] target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-Add the M profile secure MMU index values to the switch in
+Usually the logging of the CPU state produced by -d cpu is sufficient
-get_a32_user_mem_index() so that LDRT/STRT work correctly
+to diagnose problems, but sometimes you want to see the state of
-rather than asserting at translate time.
+the floating point registers as well. We don't want to enable that
 by default as it adds a lot of extra data to the log; instead,
 allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1507556919-24992-2-git-send-email-peter.maydell@linaro.org
+Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 4 ++++
+ include/qemu/log.h   | 1 +
-file changed, 4 insertions(+)
+ accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/include/qemu/log.h
-+++ b/target/arm/translate.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ static inline int get_a32_user_mem_index(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
-     case ARMMMUIdx_MPriv:
+ #define CPU_LOG_PAGE       (1 << 14)
-     case ARMMMUIdx_MNegPri:
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-         return arm_to_core_mmu_idx(ARMMMUIdx_MUser);
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
-+    case ARMMMUIdx_MSUser:
++#define CPU_LOG_TB_FPU     (1 << 17)
-+    case ARMMMUIdx_MSPriv:
-+    case ARMMMUIdx_MSNegPri:
+ /* Lock output for a series of related logs.  Since this is not needed
-+        return arm_to_core_mmu_idx(ARMMMUIdx_MSUser);
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-     case ARMMMUIdx_S2NS:
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-     default:
+index XXXXXXX..XXXXXXX 100644
-         g_assert_not_reached();
+--- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
      if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
          && qemu_log_in_addr_range(itb->pc)) {
          qemu_log_lock();
 +        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.7.4
+.17.0

target-arm queue:
 * mostly my latest v8M stuff, plus a couple of minor patches

The following changes since commit a0b261db8c030813e30a39eae47359ac2a37f7e2:

Merge remote-tracking branch 'remotes/ehabkost/tags/python-next-pull-request' into staging (2017-10-12 10:02:09 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171012

for you to fetch changes up to cf5f7937b05c84d5565134f058c00cd48304a117:

nvic: Fix miscalculation of offsets into ITNS array (2017-10-12 16:33:16 +0100)

----------------------------------------------------------------
target-arm queue:
 * v8M: SG, BLXNS, secure-return
 * v8M: fixes for coverity issues in previous patches
 * arm: fix armv7m_init() declaration to match definition
 * watchdog/aspeed: fix variable type to store reload value

----------------------------------------------------------------
Cédric Le Goater (1):
      watchdog/aspeed: fix variable type to store reload value

Igor Mammedov (1):
      arm: fix armv7m_init() declaration to match definition

Peter Maydell (11):
      target/arm: Add M profile secure MMU index values to get_a32_user_mem_index()
      target/arm: Implement SG instruction
      target/arm: Implement BLXNS
      target/arm: Implement secure function return
      target-arm: Don't check for "Thumb2 or M profile" for not-Thumb1
      target/arm: Pull Thumb insn word loads up to top level
      target-arm: Simplify insn_crosses_page()
      target/arm: Support some Thumb insns being always unconditional
      target/arm: Implement SG instruction corner cases
      nvic: Add missing 'break'
      nvic: Fix miscalculation of offsets into ITNS array

include/hw/arm/arm.h     |   2 +-
 target/arm/helper.h      |   1 +
 target/arm/internals.h   |   8 ++
 hw/intc/armv7m_nvic.c    |   5 +-
 hw/watchdog/wdt_aspeed.c |   4 +-
 target/arm/helper.c      | 306 ++++++++++++++++++++++++++++++++++++++++++++--
 target/arm/translate.c   | 310 ++++++++++++++++++++++++++++++++---------------
 7 files changed, 521 insertions(+), 115 deletions(-)

From: Cédric Le Goater <clg@kaod.org>

Initially from Anton D. Kachalov" <mouse@yandex-team.ru> but the SoB was
missing.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20170920064915.30027-1-clg@kaod.org
[clg: change commit log and subject
      replace UL suffix by ULL ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/watchdog/wdt_aspeed.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/watchdog/wdt_aspeed.c b/hw/watchdog/wdt_aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/watchdog/wdt_aspeed.c
+++ b/hw/watchdog/wdt_aspeed.c
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_wdt_read(void *opaque, hwaddr offset, unsigned size)
 
 static void aspeed_wdt_reload(AspeedWDTState *s, bool pclk)
 {
-    uint32_t reload;
+    uint64_t reload;
 
     if (pclk) {
         reload = muldiv64(s->regs[WDT_RELOAD_VALUE], NANOSECONDS_PER_SECOND,
                           s->pclk_freq);
     } else {
-        reload = s->regs[WDT_RELOAD_VALUE] * 1000;
+        reload = s->regs[WDT_RELOAD_VALUE] * 1000ULL;
     }
 
     if (aspeed_wdt_is_enabled(s)) {
-- 
2.7.4

Implement the SG instruction, which we emulate 'by hand' in the
exception handling code path.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 132 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 127 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ typedef struct V8M_SAttributes {
     bool irvalid;
 } V8M_SAttributes;
 
+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                                V8M_SAttributes *sattrs);
+
 /* Definitions for the PMCCNTR and PMCR registers */
 #define PMCRD   0x8
 #define PMCRC   0x4
@@ -XXX,XX +XXX,XX @@ static void arm_log_exception(int idx)
     }
 }
 
+static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
+                               uint32_t addr, uint16_t *insn)
+{
+    /* Load a 16-bit portion of a v7M instruction, returning true on success,
+     * or false on failure (in which case we will have pended the appropriate
+     * exception).
+     * We need to do the instruction fetch's MPU and SAU checks
+     * like this because there is no MMU index that would allow
+     * doing the load with a single function call. Instead we must
+     * first check that the security attributes permit the load
+     * and that they don't mismatch on the two halves of the instruction,
+     * and then we do the load as a secure load (ie using the security
+     * attributes of the address, not the CPU, as architecturally required).
+     */
+    CPUState *cs = CPU(cpu);
+    CPUARMState *env = &cpu->env;
+    V8M_SAttributes sattrs = {};
+    MemTxAttrs attrs = {};
+    ARMMMUFaultInfo fi = {};
+    MemTxResult txres;
+    target_ulong page_size;
+    hwaddr physaddr;
+    int prot;
+    uint32_t fsr;
+
+    v8m_security_lookup(env, addr, MMU_INST_FETCH, mmu_idx, &sattrs);
+    if (!sattrs.nsc || sattrs.ns) {
+        /* This must be the second half of the insn, and it straddles a
+         * region boundary with the second half not being S&NSC.
+         */
+        env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+        qemu_log_mask(CPU_LOG_INT,
+                      "...really SecureFault with SFSR.INVEP\n");
+        return false;
+    }
+    if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
+                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
+        /* the MPU lookup failed */
+        env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
+        qemu_log_mask(CPU_LOG_INT, "...really MemManage with CFSR.IACCVIOL\n");
+        return false;
+    }
+    *insn = address_space_lduw_le(arm_addressspace(cs, attrs), physaddr,
+                                 attrs, &txres);
+    if (txres != MEMTX_OK) {
+        env->v7m.cfsr[M_REG_NS] |= R_V7M_CFSR_IBUSERR_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+        qemu_log_mask(CPU_LOG_INT, "...really BusFault with CFSR.IBUSERR\n");
+        return false;
+    }
+    return true;
+}
+
+static bool v7m_handle_execute_nsc(ARMCPU *cpu)
+{
+    /* Check whether this attempt to execute code in a Secure & NS-Callable
+     * memory region is for an SG instruction; if so, then emulate the
+     * effect of the SG instruction and return true. Otherwise pend
+     * the correct kind of exception and return false.
+     */
+    CPUARMState *env = &cpu->env;
+    ARMMMUIdx mmu_idx;
+    uint16_t insn;
+
+    /* We should never get here unless get_phys_addr_pmsav8() caused
+     * an exception for NS executing in S&NSC memory.
+     */
+    assert(!env->v7m.secure);
+    assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
+
+    /* We want to do the MPU lookup as secure; work out what mmu_idx that is */
+    mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
+
+    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15], &insn)) {
+        return false;
+    }
+
+    if (!env->thumb) {
+        goto gen_invep;
+    }
+
+    if (insn != 0xe97f) {
+        /* Not an SG instruction first half (we choose the IMPDEF
+         * early-SG-check option).
+         */
+        goto gen_invep;
+    }
+
+    if (!v7m_read_half_insn(cpu, mmu_idx, env->regs[15] + 2, &insn)) {
+        return false;
+    }
+
+    if (insn != 0xe97f) {
+        /* Not an SG instruction second half (yes, both halves of the SG
+         * insn have the same hex value)
+         */
+        goto gen_invep;
+    }
+
+    /* OK, we have confirmed that we really have an SG instruction.
+     * We know we're NS in S memory so don't need to repeat those checks.
+     */
+    qemu_log_mask(CPU_LOG_INT, "...really an SG instruction at 0x%08" PRIx32
+                  ", executing it\n", env->regs[15]);
+    env->regs[14] &= ~1;
+    switch_v7m_security_state(env, true);
+    xpsr_write(env, 0, XPSR_IT);
+    env->regs[15] += 4;
+    return true;
+
+gen_invep:
+    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+    armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+    qemu_log_mask(CPU_LOG_INT,
+                  "...really SecureFault with SFSR.INVEP\n");
+    return false;
+}
+
 void arm_v7m_cpu_do_interrupt(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
              * the SG instruction have the same security attributes.)
              * Everything else must generate an INVEP SecureFault, so we
              * emulate the SG instruction here.
-             * TODO: actually emulate SG.
              */
-            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
-            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-            qemu_log_mask(CPU_LOG_INT,
-                          "...really SecureFault with SFSR.INVEP\n");
+            if (v7m_handle_execute_nsc(cpu)) {
+                return;
+            }
             break;
         case M_FAKE_FSR_SFAULT:
             /* Various flavours of SecureFault for attempts to execute or
-- 
2.7.4

Implement the BLXNS instruction, which allows secure code to
call non-secure code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.h    |  1 +
 target/arm/internals.h |  1 +
 target/arm/helper.c    | 59 ++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/translate.c | 17 +++++++++++++--
 4 files changed, 76 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(v7m_msr, void, env, i32, i32)
 DEF_HELPER_2(v7m_mrs, i32, env, i32)
 
 DEF_HELPER_2(v7m_bxns, void, env, i32)
+DEF_HELPER_2(v7m_blxns, void, env, i32)
 
 DEF_HELPER_4(access_check_cp_reg, void, env, ptr, i32, i32)
 DEF_HELPER_3(set_cp_reg, void, env, ptr, i32)
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool excp_is_internal(int excp)
 FIELD(V7M_CONTROL, NPRIV, 0, 1)
 FIELD(V7M_CONTROL, SPSEL, 1, 1)
 FIELD(V7M_CONTROL, FPCA, 2, 1)
+FIELD(V7M_CONTROL, SFPA, 3, 1)
 
 /* Bit definitions for v7M exception return payload */
 FIELD(V7M_EXCRET, ES, 0, 1)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
     g_assert_not_reached();
 }
 
+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
+{
+    /* translate.c should never generate calls here in user-only mode */
+    g_assert_not_reached();
+}
+
 void switch_mode(CPUARMState *env, int mode)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
     env->regs[15] = dest & ~1;
 }
 
+void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
+{
+    /* Handle v7M BLXNS:
+     *  - bit 0 of the destination address is the target security state
+     */
+
+    /* At this point regs[15] is the address just after the BLXNS */
+    uint32_t nextinst = env->regs[15] | 1;
+    uint32_t sp = env->regs[13] - 8;
+    uint32_t saved_psr;
+
+    /* translate.c will have made BLXNS UNDEF unless we're secure */
+    assert(env->v7m.secure);
+
+    if (dest & 1) {
+        /* target is Secure, so this is just a normal BLX,
+         * except that the low bit doesn't indicate Thumb/not.
+         */
+        env->regs[14] = nextinst;
+        env->thumb = 1;
+        env->regs[15] = dest & ~1;
+        return;
+    }
+
+    /* Target is non-secure: first push a stack frame */
+    if (!QEMU_IS_ALIGNED(sp, 8)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "BLXNS with misaligned SP is UNPREDICTABLE\n");
+    }
+
+    saved_psr = env->v7m.exception;
+    if (env->v7m.control[M_REG_S] & R_V7M_CONTROL_SFPA_MASK) {
+        saved_psr |= XPSR_SFPA;
+    }
+
+    /* Note that these stores can throw exceptions on MPU faults */
+    cpu_stl_data(env, sp, nextinst);
+    cpu_stl_data(env, sp + 4, saved_psr);
+
+    env->regs[13] = sp;
+    env->regs[14] = 0xfeffffff;
+    if (arm_v7m_is_handler_mode(env)) {
+        /* Write a dummy value to IPSR, to avoid leaking the current secure
+         * exception number to non-secure code. This is guaranteed not
+         * to cause write_v7m_exception() to actually change stacks.
+         */
+        write_v7m_exception(env, 1);
+    }
+    switch_v7m_security_state(env, 0);
+    env->thumb = 1;
+    env->regs[15] = dest;
+}
+
 static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
                                 bool spsel)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_bxns(DisasContext *s, int rm)
     s->base.is_jmp = DISAS_EXIT;
 }
 
+static inline void gen_blxns(DisasContext *s, int rm)
+{
+    TCGv_i32 var = load_reg(s, rm);
+
+    /* We don't need to sync condexec state, for the same reason as bxns.
+     * We do however need to set the PC, because the blxns helper reads it.
+     * The blxns helper may throw an exception.
+     */
+    gen_set_pc_im(s, s->pc);
+    gen_helper_v7m_blxns(cpu_env, var);
+    tcg_temp_free_i32(var);
+    s->base.is_jmp = DISAS_EXIT;
+}
+
 /* Variant of store_reg which uses branch&exchange logic when storing
    to r15 in ARM architecture v7 and above. The source must be a temporary
    and will be marked as dead. */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
                         goto undef;
                     }
                     if (link) {
-                        /* BLXNS: not yet implemented */
-                        goto undef;
+                        gen_blxns(s, rm);
                     } else {
                         gen_bxns(s, rm);
                     }
-- 
2.7.4

Secure function return happens when a non-secure function has been
called using BLXNS and so has a particular magic LR value (either
0xfefffffe or 0xfeffffff). The function return via BX behaves
specially when the new PC value is this magic value, in the same
way that exception returns are handled.

Adjust our BX excret guards so that they recognize the function
return magic number as well, and perform the function-return
unstacking in do_v7m_exception_exit().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h |   7 +++
 target/arm/helper.c    | 115 +++++++++++++++++++++++++++++++++++++++++++++----
 target/arm/translate.c |  14 +++++-
 3 files changed, 126 insertions(+), 10 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
 FIELD(V7M_EXCRET, S, 6, 1)
 FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
 
+/* Minimum value which is a magic number for exception return */
+#define EXC_RETURN_MIN_MAGIC 0xff000000
+/* Minimum number which is a magic number for function or exception return
+ * when using v8M security extension
+ */
+#define FNC_RETURN_MIN_MAGIC 0xfefffffe
+
 /* We use a few fake FSR values for internal purposes in M profile.
  * M profile cores don't have A/R format FSRs, but currently our
  * get_phys_addr() code assumes A/R profile and reports failures via
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
      *  - if the return value is a magic value, do exception return (like BX)
      *  - otherwise bit 0 of the return value is the target security state
      */
-    if (dest >= 0xff000000) {
+    uint32_t min_magic;
+
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        /* Covers FNC_RETURN and EXC_RETURN magic */
+        min_magic = FNC_RETURN_MIN_MAGIC;
+    } else {
+        /* EXC_RETURN magic only */
+        min_magic = EXC_RETURN_MIN_MAGIC;
+    }
+
+    if (dest >= min_magic) {
         /* This is an exception return magic value; put it where
          * do_v7m_exception_exit() expects and raise EXCEPTION_EXIT.
          * Note that if we ever add gen_ss_advance() singlestep support to
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     bool exc_secure = false;
     bool return_to_secure;
 
-    /* We can only get here from an EXCP_EXCEPTION_EXIT, and
-     * gen_bx_excret() enforces the architectural rule
-     * that jumps to magic addresses don't have magic behaviour unless
-     * we're in Handler mode (compare pseudocode BXWritePC()).
+    /* If we're not in Handler mode then jumps to magic exception-exit
+     * addresses don't have magic behaviour. However for the v8M
+     * security extensions the magic secure-function-return has to
+     * work in thread mode too, so to avoid doing an extra check in
+     * the generated code we allow exception-exit magic to also cause the
+     * internal exception and bring us here in thread mode. Correct code
+     * will never try to do this (the following insn fetch will always
+     * fault) so we the overhead of having taken an unnecessary exception
+     * doesn't matter.
      */
-    assert(arm_v7m_is_handler_mode(env));
+    if (!arm_v7m_is_handler_mode(env)) {
+        return;
+    }
 
     /* In the spec pseudocode ExceptionReturn() is called directly
      * from BXWritePC() and gets the full target PC value including
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     qemu_log_mask(CPU_LOG_INT, "...successful exception return\n");
 }
 
+static bool do_v7m_function_return(ARMCPU *cpu)
+{
+    /* v8M security extensions magic function return.
+     * We may either:
+     *  (1) throw an exception (longjump)
+     *  (2) return true if we successfully handled the function return
+     *  (3) return false if we failed a consistency check and have
+     *      pended a UsageFault that needs to be taken now
+     *
+     * At this point the magic return value is split between env->regs[15]
+     * and env->thumb. We don't bother to reconstitute it because we don't
+     * need it (all values are handled the same way).
+     */
+    CPUARMState *env = &cpu->env;
+    uint32_t newpc, newpsr, newpsr_exc;
+
+    qemu_log_mask(CPU_LOG_INT, "...really v7M secure function return\n");
+
+    {
+        bool threadmode, spsel;
+        TCGMemOpIdx oi;
+        ARMMMUIdx mmu_idx;
+        uint32_t *frame_sp_p;
+        uint32_t frameptr;
+
+        /* Pull the return address and IPSR from the Secure stack */
+        threadmode = !arm_v7m_is_handler_mode(env);
+        spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
+
+        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
+        frameptr = *frame_sp_p;
+
+        /* These loads may throw an exception (for MPU faults). We want to
+         * do them as secure, so work out what MMU index that is.
+         */
+        mmu_idx = arm_v7m_mmu_idx_for_secstate(env, true);
+        oi = make_memop_idx(MO_LE, arm_to_core_mmu_idx(mmu_idx));
+        newpc = helper_le_ldul_mmu(env, frameptr, oi, 0);
+        newpsr = helper_le_ldul_mmu(env, frameptr + 4, oi, 0);
+
+        /* Consistency checks on new IPSR */
+        newpsr_exc = newpsr & XPSR_EXCP;
+        if (!((env->v7m.exception == 0 && newpsr_exc == 0) ||
+              (env->v7m.exception == 1 && newpsr_exc != 0))) {
+            /* Pend the fault and tell our caller to take it */
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            qemu_log_mask(CPU_LOG_INT,
+                          "...taking INVPC UsageFault: "
+                          "IPSR consistency check failed\n");
+            return false;
+        }
+
+        *frame_sp_p = frameptr + 8;
+    }
+
+    /* This invalidates frame_sp_p */
+    switch_v7m_security_state(env, true);
+    env->v7m.exception = newpsr_exc;
+    env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_SFPA_MASK;
+    if (newpsr & XPSR_SFPA) {
+        env->v7m.control[M_REG_S] |= R_V7M_CONTROL_SFPA_MASK;
+    }
+    xpsr_write(env, 0, XPSR_IT);
+    env->thumb = newpc & 1;
+    env->regs[15] = newpc & ~1;
+
+    qemu_log_mask(CPU_LOG_INT, "...function return successful\n");
+    return true;
+}
+
 static void arm_log_exception(int idx)
 {
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
     case EXCP_IRQ:
         break;
     case EXCP_EXCEPTION_EXIT:
-        do_v7m_exception_exit(cpu);
-        return;
+        if (env->regs[15] < EXC_RETURN_MIN_MAGIC) {
+            /* Must be v8M security extension function return */
+            assert(env->regs[15] >= FNC_RETURN_MIN_MAGIC);
+            assert(arm_feature(env, ARM_FEATURE_M_SECURITY));
+            if (do_v7m_function_return(cpu)) {
+                return;
+            }
+        } else {
+            do_v7m_exception_exit(cpu);
+            return;
+        }
+        break;
     default:
         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
         return; /* Never happens.  Keep compiler happy.  */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret(DisasContext *s, TCGv_i32 var)
      * s->base.is_jmp that we need to do the rest of the work later.
      */
     gen_bx(s, var);
-    if (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M)) {
+    if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY) ||
+        (s->v7m_handler_mode && arm_dc_feature(s, ARM_FEATURE_M))) {
         s->base.is_jmp = DISAS_BX_EXCRET;
     }
 }
@@ -XXX,XX +XXX,XX @@ static inline void gen_bx_excret_final_code(DisasContext *s)
 {
     /* Generate the code to finish possible exception return and end the TB */
     TCGLabel *excret_label = gen_new_label();
+    uint32_t min_magic;
+
+    if (arm_dc_feature(s, ARM_FEATURE_M_SECURITY)) {
+        /* Covers FNC_RETURN and EXC_RETURN magic */
+        min_magic = FNC_RETURN_MIN_MAGIC;
+    } else {
+        /* EXC_RETURN magic only */
+        min_magic = EXC_RETURN_MIN_MAGIC;
+    }
 
     /* Is the new PC value in the magic range indicating exception return? */
-    tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], 0xff000000, excret_label);
+    tcg_gen_brcondi_i32(TCG_COND_GEU, cpu_R[15], min_magic, excret_label);
     /* No: end the TB as we would for a DISAS_JMP */
     if (is_singlestepping(s)) {
         gen_singlestep_exception(s);
-- 
2.7.4

The code which implements the Thumb1 split BL/BLX instructions
is guarded by a check on "not M or THUMB2". All we really need
to check here is "not THUMB2" (and we assume that elsewhere too,
eg in the ARCH(6T2) test that UNDEFs the Thumb2 insns).

This doesn't change behaviour because all M profile cores
have Thumb2 and so ARM_FEATURE_M implies ARM_FEATURE_THUMB2.
(v6M implements a very restricted subset of Thumb2, but we
can cross that bridge when we get to it with appropriate
feature bits.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
     int conds;
     int logic_cc;
 
-    if (!(arm_dc_feature(s, ARM_FEATURE_THUMB2)
-          || arm_dc_feature(s, ARM_FEATURE_M))) {
+    if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
         /* Thumb-1 cores may need to treat bl and blx as a pair of
            16-bit instructions to get correct prefetch abort behavior.  */
         insn = insn_hw1;
-- 
2.7.4

Refactor the Thumb decode to do the loads of the instruction words at
the top level rather than only loading the second half of a 32-bit
Thumb insn in the middle of the decode.

This is simple apart from the awkward case of Thumb1, where the
BL/BLX prefix and suffix instructions live in what in Thumb2 is the
32-bit insn space.  To handle these we decode enough to identify
whether we're looking at a prefix/suffix that we handle as a 16 bit
insn, or a prefix that we're going to merge with the following suffix
to consider as a 32 bit insn.  The translation of the 16 bit cases
then moves from disas_thumb2_insn() to disas_thumb_insn().

The refactoring has the benefit that we don't need to pass the
CPUARMState* down into the decoder code any more, but the major
reason for doing this is that some Thumb instructions must be always
unconditional regardless of the IT state bits, so we need to know the
whole insn before we emit the "skip this insn if the IT bits and cond
state tell us to" code.  (The always unconditional insns are BKPT,
HLT and SG; the last of these is 32 bits.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 178 ++++++++++++++++++++++++++++++-------------------
 1 file changed, 108 insertions(+), 70 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     }
 }
 
+static bool thumb_insn_is_16bit(DisasContext *s, uint32_t insn)
+{
+    /* Return true if this is a 16 bit instruction. We must be precise
+     * about this (matching the decode).  We assume that s->pc still
+     * points to the first 16 bits of the insn.
+     */
+    if ((insn >> 11) < 0x1d) {
+        /* Definitely a 16-bit instruction */
+        return true;
+    }
+
+    /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
+     * first half of a 32-bit Thumb insn. Thumb-1 cores might
+     * end up actually treating this as two 16-bit insns, though,
+     * if it's half of a bl/blx pair that might span a page boundary.
+     */
+    if (arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
+        /* Thumb2 cores (including all M profile ones) always treat
+         * 32-bit insns as 32-bit.
+         */
+        return false;
+    }
+
+    if ((insn >> 11) == 0x1e && (s->pc < s->next_page_start - 3)) {
+        /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix, and the suffix
+         * is not on the next page; we merge this into a 32-bit
+         * insn.
+         */
+        return false;
+    }
+    /* 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF);
+     * 0b1111_1xxx_xxxx_xxxx : BL suffix;
+     * 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix on the end of a page
+     *  -- handle as single 16 bit insn
+     */
+    return true;
+}
+
 /* Return true if this is a Thumb-2 logical op.  */
 static int
 thumb2_logic_op(int op)
@@ -XXX,XX +XXX,XX @@ gen_thumb2_data_op(DisasContext *s, int op, int conds, uint32_t shifter_out,
 
 /* Translate a 32-bit thumb instruction.  Returns nonzero if the instruction
    is not legal.  */
-static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw1)
+static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
 {
-    uint32_t insn, imm, shift, offset;
+    uint32_t imm, shift, offset;
     uint32_t rd, rn, rm, rs;
     TCGv_i32 tmp;
     TCGv_i32 tmp2;
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(CPUARMState *env, DisasContext *s, uint16_t insn_hw
     int conds;
     int logic_cc;
 
-    if (!arm_dc_feature(s, ARM_FEATURE_THUMB2)) {
-        /* Thumb-1 cores may need to treat bl and blx as a pair of
-           16-bit instructions to get correct prefetch abort behavior.  */
-        insn = insn_hw1;
-        if ((insn & (1 << 12)) == 0) {
-            ARCH(5);
-            /* Second half of blx.  */
-            offset = ((insn & 0x7ff) << 1);
-            tmp = load_reg(s, 14);
-            tcg_gen_addi_i32(tmp, tmp, offset);
-            tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
-
-            tmp2 = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp2, s->pc | 1);
-            store_reg(s, 14, tmp2);
-            gen_bx(s, tmp);
-            return 0;
-        }
-        if (insn & (1 << 11)) {
-            /* Second half of bl.  */
-            offset = ((insn & 0x7ff) << 1) | 1;
-            tmp = load_reg(s, 14);
-            tcg_gen_addi_i32(tmp, tmp, offset);
-
-            tmp2 = tcg_temp_new_i32();
-            tcg_gen_movi_i32(tmp2, s->pc | 1);
-            store_reg(s, 14, tmp2);
-            gen_bx(s, tmp);
-            return 0;
-        }
-        if ((s->pc & ~TARGET_PAGE_MASK) == 0) {
-            /* Instruction spans a page boundary.  Implement it as two
-               16-bit instructions in case the second half causes an
-               prefetch abort.  */
-            offset = ((int32_t)insn << 21) >> 9;
-            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + offset);
-            return 0;
-        }
-        /* Fall through to 32-bit decode.  */
-    }
-
-    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
-    s->pc += 2;
-    insn |= (uint32_t)insn_hw1 << 16;
-
+    /* The only 32 bit insn that's allowed for Thumb1 is the combined
+     * BL/BLX prefix and suffix.
+     */
     if ((insn & 0xf800e800) != 0xf000e800) {
         ARCH(6T2);
     }
@@ -XXX,XX +XXX,XX @@ illegal_op:
     return 1;
 }
 
-static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
+static void disas_thumb_insn(DisasContext *s, uint32_t insn)
 {
-    uint32_t val, insn, op, rm, rn, rd, shift, cond;
+    uint32_t val, op, rm, rn, rd, shift, cond;
     int32_t offset;
     int i;
     TCGv_i32 tmp;
     TCGv_i32 tmp2;
     TCGv_i32 addr;
 
-    if (s->condexec_mask) {
-        cond = s->condexec_cond;
-        if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
-          s->condlabel = gen_new_label();
-          arm_gen_test_cc(cond ^ 1, s->condlabel);
-          s->condjmp = 1;
-        }
-    }
-
-    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
-    s->pc += 2;
-
     switch (insn >> 12) {
     case 0: case 1:
 
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
 
     case 14:
         if (insn & (1 << 11)) {
-            if (disas_thumb2_insn(env, s, insn))
-              goto undef32;
+            /* thumb_insn_is_16bit() ensures we can't get here for
+             * a Thumb2 CPU, so this must be a thumb1 split BL/BLX:
+             * 0b1110_1xxx_xxxx_xxxx : BLX suffix (or UNDEF)
+             */
+            assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
+            ARCH(5);
+            offset = ((insn & 0x7ff) << 1);
+            tmp = load_reg(s, 14);
+            tcg_gen_addi_i32(tmp, tmp, offset);
+            tcg_gen_andi_i32(tmp, tmp, 0xfffffffc);
+
+            tmp2 = tcg_temp_new_i32();
+            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            store_reg(s, 14, tmp2);
+            gen_bx(s, tmp);
             break;
         }
         /* unconditional branch */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb_insn(CPUARMState *env, DisasContext *s)
         break;
 
     case 15:
-        if (disas_thumb2_insn(env, s, insn))
-            goto undef32;
+        /* thumb_insn_is_16bit() ensures we can't get here for
+         * a Thumb2 CPU, so this must be a thumb1 split BL/BLX.
+         */
+        assert(!arm_dc_feature(s, ARM_FEATURE_THUMB2));
+
+        if (insn & (1 << 11)) {
+            /* 0b1111_1xxx_xxxx_xxxx : BL suffix */
+            offset = ((insn & 0x7ff) << 1) | 1;
+            tmp = load_reg(s, 14);
+            tcg_gen_addi_i32(tmp, tmp, offset);
+
+            tmp2 = tcg_temp_new_i32();
+            tcg_gen_movi_i32(tmp2, s->pc | 1);
+            store_reg(s, 14, tmp2);
+            gen_bx(s, tmp);
+        } else {
+            /* 0b1111_0xxx_xxxx_xxxx : BL/BLX prefix */
+            uint32_t uoffset = ((int32_t)insn << 21) >> 9;
+
+            tcg_gen_movi_i32(cpu_R[14], s->pc + 2 + uoffset);
+        }
         break;
     }
     return;
-undef32:
-    gen_exception_insn(s, 4, EXCP_UDEF, syn_uncategorized(),
-                       default_exception_el(s));
-    return;
 illegal_op:
 undef:
     gen_exception_insn(s, 2, EXCP_UDEF, syn_uncategorized(),
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t insn;
+    bool is_16bit;
 
     if (arm_pre_translate_insn(dc)) {
         return;
     }
 
-    disas_thumb_insn(env, dc);
+    insn = arm_lduw_code(env, dc->pc, dc->sctlr_b);
+    is_16bit = thumb_insn_is_16bit(dc, insn);
+    dc->pc += 2;
+    if (!is_16bit) {
+        uint32_t insn2 = arm_lduw_code(env, dc->pc, dc->sctlr_b);
+
+        insn = insn << 16 | insn2;
+        dc->pc += 2;
+    }
+
+    if (dc->condexec_mask) {
+        uint32_t cond = dc->condexec_cond;
+
+        if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
+            dc->condlabel = gen_new_label();
+            arm_gen_test_cc(cond ^ 1, dc->condlabel);
+            dc->condjmp = 1;
+        }
+    }
+
+    if (is_16bit) {
+        disas_thumb_insn(dc, insn);
+    } else {
+        disas_thumb2_insn(dc, insn);
+    }
 
     /* Advance the Thumb condexec condition.  */
     if (dc->condexec_mask) {
-- 
2.7.4

Recent changes have left insn_crosses_page() more complicated
than it needed to be:
 * it's only called from thumb_tr_translate_insn() so we know
   for certain that we're looking at a Thumb insn
 * the caller's check for dc->pc >= dc->next_page_start - 3
   means that dc->pc can't possibly be 4 aligned, so there's
   no need to check that (the check was partly there to ensure
   that we didn't treat an ARM insn as Thumb, I think)
 * we now have thumb_insn_is_16bit() which lets us do a precise
   check of the length of the next insn, rather than opencoding
   an inaccurate check

Simplify it down to just loading the first half of the insn
and calling thumb_insn_is_16bit() on it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 27 ++++++---------------------
 1 file changed, 6 insertions(+), 21 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool insn_crosses_page(CPUARMState *env, DisasContext *s)
 {
     /* Return true if the insn at dc->pc might cross a page boundary.
      * (False positives are OK, false negatives are not.)
+     * We know this is a Thumb insn, and our caller ensures we are
+     * only called if dc->pc is less than 4 bytes from the page
+     * boundary, so we cross the page if the first 16 bits indicate
+     * that this is a 32 bit insn.
      */
-    uint16_t insn;
+    uint16_t insn = arm_lduw_code(env, s->pc, s->sctlr_b);
 
-    if ((s->pc & 3) == 0) {
-        /* At a 4-aligned address we can't be crossing a page */
-        return false;
-    }
-
-    /* This must be a Thumb insn */
-    insn = arm_lduw_code(env, s->pc, s->sctlr_b);
-
-    if ((insn >> 11) >= 0x1d) {
-        /* Top five bits 0b11101 / 0b11110 / 0b11111 : this is the
-         * First half of a 32-bit Thumb insn. Thumb-1 cores might
-         * end up actually treating this as two 16-bit insns (see the
-         * code at the start of disas_thumb2_insn()) but we don't bother
-         * to check for that as it is unlikely, and false positives here
-         * are harmless.
-         */
-        return true;
-    }
-    /* Definitely a 16-bit insn, can't be crossing a page. */
-    return false;
+    return !thumb_insn_is_16bit(s, insn);
 }
 
 static int arm_tr_init_disas_context(DisasContextBase *dcbase,
-- 
2.7.4

A few Thumb instructions are always unconditional even inside an
IT block (as opposed to being UNPREDICTABLE if used inside an
IT block): BKPT, the v8M SG instruction, and the A profile
HLT (debug halt) instruction.

This means we need to suppress the jump-over-instruction-on-condfail
code generation (though the IT state still advances as usual and
subsequent insns in the IT block may be conditional).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-9-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 48 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
        in init_disas_context by adjusting max_insns.  */
 }
 
+static bool thumb_insn_is_unconditional(DisasContext *s, uint32_t insn)
+{
+    /* Return true if this Thumb insn is always unconditional,
+     * even inside an IT block. This is true of only a very few
+     * instructions: BKPT, HLT, and SG.
+     *
+     * A larger class of instructions are UNPREDICTABLE if used
+     * inside an IT block; we do not need to detect those here, because
+     * what we do by default (perform the cc check and update the IT
+     * bits state machine) is a permitted CONSTRAINED UNPREDICTABLE
+     * choice for those situations.
+     *
+     * insn is either a 16-bit or a 32-bit instruction; the two are
+     * distinguishable because for the 16-bit case the top 16 bits
+     * are zeroes, and that isn't a valid 32-bit encoding.
+     */
+    if ((insn & 0xffffff00) == 0xbe00) {
+        /* BKPT */
+        return true;
+    }
+
+    if ((insn & 0xffffffc0) == 0xba80 && arm_dc_feature(s, ARM_FEATURE_V8) &&
+        !arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* HLT: v8A only. This is unconditional even when it is going to
+         * UNDEF; see the v8A ARM ARM DDI0487B.a H3.3.
+         * For v7 cores this was a plain old undefined encoding and so
+         * honours its cc check. (We might be using the encoding as
+         * a semihosting trap, but we don't change the cc check behaviour
+         * on that account, because a debugger connected to a real v7A
+         * core and emulating semihosting traps by catching the UNDEF
+         * exception would also only see cases where the cc check passed.
+         * No guest code should be trying to do a HLT semihosting trap
+         * in an IT block anyway.
+         */
+        return true;
+    }
+
+    if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_V8) &&
+        arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* SG: v8M only */
+        return true;
+    }
+
+    return false;
+}
+
 static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         dc->pc += 2;
     }
 
-    if (dc->condexec_mask) {
+    if (dc->condexec_mask && !thumb_insn_is_unconditional(dc, insn)) {
         uint32_t cond = dc->condexec_cond;
 
         if (cond != 0x0e) {     /* Skip conditional when condition is AL. */
-- 
2.7.4

The common situation of the SG instruction is that it is
executed from S&NSC memory by a CPU in NS state. That case
is handled by v7m_handle_execute_nsc(). However the instruction
also has defined behaviour in a couple of other cases:
 * SG instruction in NS memory (behaves as a NOP)
 * SG in S memory but CPU already secure (clears IT bits and
   does nothing else)
 * SG instruction in v8M without Security Extension (NOP)

These can be implemented in translate.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507556919-24992-10-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_thumb2_insn(DisasContext *s, uint32_t insn)
              * - load/store doubleword, load/store exclusive, ldacq/strel,
              *   table branch.
              */
-            if (insn & 0x01200000) {
+            if (insn == 0xe97fe97f && arm_dc_feature(s, ARM_FEATURE_M) &&
+                arm_dc_feature(s, ARM_FEATURE_V8)) {
+                /* 0b1110_1001_0111_1111_1110_1001_0111_111
+                 *  - SG (v8M only)
+                 * The bulk of the behaviour for this instruction is implemented
+                 * in v7m_handle_execute_nsc(), which deals with the insn when
+                 * it is executed by a CPU in non-secure state from memory
+                 * which is Secure & NonSecure-Callable.
+                 * Here we only need to handle the remaining cases:
+                 *  * in NS memory (including the "security extension not
+                 *    implemented" case) : NOP
+                 *  * in S memory but CPU already secure (clear IT bits)
+                 * We know that the attribute for the memory this insn is
+                 * in must match the current CPU state, because otherwise
+                 * get_phys_addr_pmsav8 would have generated an exception.
+                 */
+                if (s->v8m_secure) {
+                    /* Like the IT insn, we don't need to generate any code */
+                    s->condexec_cond = 0;
+                    s->condexec_mask = 0;
+                }
+            } else if (insn & 0x01200000) {
                 /* 0b1110_1000_x11x_xxxx_xxxx_xxxx_xxxx_xxxx
                  *  - load/store dual (post-indexed)
                  * 0b1111_1001_x10x_xxxx_xxxx_xxxx_xxxx_xxxx
-- 
2.7.4

This calculation of the first exception vector in
the ITNS<n> register being accessed:
        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;

is incorrect, because offset is in bytes, so we only want
to multiply by 8.

Spotted by Coverity (CID 1381484, CID 1381488), though it is
not correct that it actually overflows the buffer, because
we have a 'startvec + i < s->num_irq' guard.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1507650856-11718-1-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
     {
-        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
+        int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
         int i;
 
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
     switch (offset) {
     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
     {
-        int startvec = 32 * (offset - 0x380) + NVIC_FIRST_IRQ;
+        int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
         int i;
 
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
-- 
2.7.4

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0