Series comparison

-[Qemu-devel] [PULL 0/7] target-arm queue
+[Qemu-devel] [PULL 00/24] target-arm queue
-A small set of arm bugfixes for rc0.
+Latest arm queue, half minor code cleanups and half minor
 bug fixes.
+-- PMM
+The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:
-The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:
+  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)
-  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)
+are available in the Git repository at:
-are available in the git repository at:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107
+for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:
-for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:
+  target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)
   hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * arm_gicv3_its: Don't abort on table save failure
+ * support large kernel images in bootloader (by avoiding
- * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+   putting the initrd over the top of them)
- * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
+ * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
- * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
+ * arm_gicv3: Fix decoding of ID register range
- * arm: implement cache/shareability attribute bits for PAR registers
+ * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
  * some code cleanups following on from the VFP decodetree conversion
  * Only implement doubles if the FPU supports them
    (so we now correctly model Cortex-M4, -M33 as single precision only)
 ----------------------------------------------------------------
-Andrew Baumann (1):
+Peter Maydell (24):
-      arm: implement cache/shareability attribute bits for PAR registers
+      hw/arm/boot: Don't assume RAM starts at address zero
       hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
       hw/arm/boot: Avoid placing the initrd on top of the kernel
       hw/arm/boot: Honour image size field in AArch64 Image format kernels
       target/arm: Allow VFP and Neon to be disabled via a CPU property
       target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
       hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
       hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
       hw/intc/arm_gicv3: Fix decoding of ID register range
       hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
       target/arm: Move vfp_expand_imm() to translate.[ch]
       target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
       target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
       target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
       target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
       target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
       target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
       target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
       target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
       target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
       target/arm: Fix typos in trans function prototypes
       target/arm: Only implement doubles if the FPU supports them
-Eric Auger (1):
+ include/hw/arm/armsse.h        |   7 ++
-      hw/intc/arm_gicv3_its: Don't abort on table save failure
+ include/hw/arm/armv7m.h        |   4 +
  target/arm/cpu.h               |  12 +++
  target/arm/translate-a64.h     |   1 -
  target/arm/translate.h         |   7 ++
  hw/arm/armsse.c                |  58 +++++++---
  hw/arm/armv7m.c                |  18 ++++
  hw/arm/boot.c                  |  83 ++++++++++----
  hw/arm/musca.c                 |   8 ++
  hw/intc/arm_gicv3_dist.c       |  12 ++-
  hw/intc/arm_gicv3_redist.c     |   4 +-
  target/arm/cpu.c               | 179 ++++++++++++++++++++++++++++--
  target/arm/translate-a64.c     |  32 ------
  target/arm/translate-vfp.inc.c | 173 ++++++++++++++++++++++-------
  target/arm/translate.c         | 240 ++++++++++++++---------------------------
  target/arm/vfp.decode          |  10 +-
 files changed, 572 insertions(+), 276 deletions(-)
-Peter Maydell (1):
-      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
-Shanker Donthineni (1):
-      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
-Thomas Huth (3):
-      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
-      hw/arm: Mark the "fsl,imx25" device with user_creatable = false
-      hw/arm: Mark the "fsl,imx31" device with user_creatable = false
- hw/arm/fsl-imx25.c          |   6 +-
- hw/arm/fsl-imx31.c          |   6 +-
- hw/arm/fsl-imx6.c           |   3 +-
- hw/intc/arm_gicv3_its_kvm.c |  12 +--
- target/arm/helper.c         | 178 ++++++++++++++++++++++++++++++++++++++++----
- target/arm/translate.c      |  39 ++++++++--
-files changed, 214 insertions(+), 30 deletions(-)

-New patch
+[Qemu-devel] [PULL 01/24] hw/arm/boot: Don't assume RAM starts at address zero
+In the Arm kernel/initrd loading code, in some places we make the
+incorrect assumption that info->ram_size can be treated as the
+address of the end of RAM, as for instance when we calculate the
+available space for the initrd using "info->ram_size - info->initrd_start".
+This is wrong, because many Arm boards (including "virt") specify
+a non-zero info->loader_start to indicate that their RAM area
+starts at a non-zero physical address.
+Correct the places which make this incorrect assumption.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     int elf_machine;
+     hwaddr entry;
+     static const ARMInsnFixup *primary_loader;
++    uint64_t ram_end = info->loader_start + info->ram_size;
+     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+         primary_loader = bootloader_aarch64;
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         /* 32-bit ARM */
+         entry = info->loader_start + KERNEL_LOAD_ADDR;
+         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
+-                                             info->ram_size - KERNEL_LOAD_ADDR,
+-                                             as);
++                                             ram_end - KERNEL_LOAD_ADDR, as);
+         is_linux = 1;
+     }
+     if (kernel_size < 0) {
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         if (info->initrd_filename) {
+             initrd_size = load_ramdisk_as(info->initrd_filename,
+                                           info->initrd_start,
+-                                          info->ram_size - info->initrd_start,
+-                                          as);
++                                          ram_end - info->initrd_start, as);
+             if (initrd_size < 0) {
+                 initrd_size = load_image_targphys_as(info->initrd_filename,
+                                                      info->initrd_start,
+-                                                     info->ram_size -
++                                                     ram_end -
+                                                      info->initrd_start,
+                                                      as);
+             }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 02/24] hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
+We calculate the locations in memory where we want to put the
+initrd and the DTB based on the size of the kernel, since they
+come after it. Add some explicit checks that these aren't off the
+end of RAM entirely.
+(At the moment the way we calculate the initrd_start means that
+it can't ever be off the end of RAM, but that will change with
+the next commit.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 23 +++++++++++++++++++++++
+file changed, 23 insertions(+)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         error_report("could not load kernel '%s'", info->kernel_filename);
+         exit(1);
+     }
++
++    if (kernel_size > info->ram_size) {
++        error_report("kernel '%s' is too large to fit in RAM "
++                     "(kernel size %d, RAM size %" PRId64 ")",
++                     info->kernel_filename, kernel_size, info->ram_size);
++        exit(1);
++    }
++
+     info->entry = entry;
+     if (is_linux) {
+         uint32_t fixupcontext[FIXUP_MAX];
+         if (info->initrd_filename) {
++
++            if (info->initrd_start >= ram_end) {
++                error_report("not enough space after kernel to load initrd");
++                exit(1);
++            }
++
+             initrd_size = load_ramdisk_as(info->initrd_filename,
+                                           info->initrd_start,
+                                           ram_end - info->initrd_start, as);
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+                              info->initrd_filename);
+                 exit(1);
+             }
++            if (info->initrd_start + initrd_size > info->ram_size) {
++                error_report("could not load initrd '%s': "
++                             "too big to fit into RAM after the kernel",
++                             info->initrd_filename);
++            }
+         } else {
+             initrd_size = 0;
+         }
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+             /* Place the DTB after the initrd in memory with alignment. */
+             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
+                                            align);
++            if (info->dtb_start >= ram_end) {
++                error_report("Not enough space for DTB after kernel/initrd");
++                exit(1);
++            }
+             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
+             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
+         } else {
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 03/24] hw/arm/boot: Avoid placing the initrd on top of the kernel
+We currently put the initrd at the smaller of:
+ * 128MB into RAM
+ * halfway into the RAM
+(with the dtb following it).
+However for large kernels this might mean that the kernel
+overlaps the initrd. For some kinds of kernel (self-decompressing
+-bit kernels, and ELF images with a BSS section at the end)
+we don't know the exact size, but even there we have a
+minimum size. Put the initrd at least further into RAM than
+that. For image formats that can give us an exact kernel size, this
+will mean that we definitely avoid overlaying kernel and initrd.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 34 ++++++++++++++++++++--------------
+file changed, 20 insertions(+), 14 deletions(-)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     if (info->nb_cpus == 0)
+         info->nb_cpus = 1;
+-    /*
+-     * We want to put the initrd far enough into RAM that when the
+-     * kernel is uncompressed it will not clobber the initrd. However
+-     * on boards without much RAM we must ensure that we still leave
+-     * enough room for a decent sized initrd, and on boards with large
+-     * amounts of RAM we must avoid the initrd being so far up in RAM
+-     * that it is outside lowmem and inaccessible to the kernel.
+-     * So for boards with less  than 256MB of RAM we put the initrd
+-     * halfway into RAM, and for boards with 256MB of RAM or more we put
+-     * the initrd at 128MB.
+-     */
+-    info->initrd_start = info->loader_start +
+-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+-
+     /* Assume that raw images are linux kernels, and ELF images are not.  */
+     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
+                                &elf_high_addr, elf_machine, as);
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     }
+     info->entry = entry;
++
++    /*
++     * We want to put the initrd far enough into RAM that when the
++     * kernel is uncompressed it will not clobber the initrd. However
++     * on boards without much RAM we must ensure that we still leave
++     * enough room for a decent sized initrd, and on boards with large
++     * amounts of RAM we must avoid the initrd being so far up in RAM
++     * that it is outside lowmem and inaccessible to the kernel.
++     * So for boards with less  than 256MB of RAM we put the initrd
++     * halfway into RAM, and for boards with 256MB of RAM or more we put
++     * the initrd at 128MB.
++     * We also refuse to put the initrd somewhere that will definitely
++     * overlay the kernel we just loaded, though for kernel formats which
++     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
++     * we might still make a bad choice here.
++     */
++    info->initrd_start = info->loader_start +
++        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
++    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
++
+     if (is_linux) {
+         uint32_t fixupcontext[FIXUP_MAX];
+--
+.20.1

-[Qemu-devel] [PULL 7/7] hw/intc/arm_gicv3_its: Don't abort on table save failure
+[Qemu-devel] [PULL 04/24] hw/arm/boot: Honour image size field in AArch64 Image format kernels
-From: Eric Auger <eric.auger@redhat.com>
+Since Linux v3.17, the kernel's Image header includes a field image_size,
 which gives the total size of the kernel including unpopulated data
 sections such as the BSS). If this is present, then return it from
 load_aarch64_image() as the true size of the kernel rather than
 just using the size of the Image file itself. This allows the code
 which calculates where to put the initrd to avoid putting it in
 the kernel's BSS area.
-The ITS is not fully properly reset at the moment. Caches are
+This means that we should be able to reliably load kernel images
-not emptied.
+which are larger than 128MB without accidentally putting the
 initrd or dtb in locations that clash with the kernel itself.
-After a reset, in case we attempt to save the state before
+Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
-the bound devices have registered their MSIs and after the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-st level table has been allocated by the ITS driver
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-(device BASER is valid), the first level entries are still
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-invalid. If the device cache is not empty (devices registered
+Tested-by: Mark Rutland <mark.rutland@arm.com>
-before the reset), vgic_its_save_device_tables fails with -EINVAL.
+Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
-This causes a QEMU abort().
+---
  hw/arm/boot.c | 17 +++++++++++++++--
 file changed, 15 insertions(+), 2 deletions(-)
-Cc: qemu-stable@nongnu.org
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/intc/arm_gicv3_its_kvm.c | 8 ++------
 file changed, 2 insertions(+), 6 deletions(-)
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
+--- a/hw/arm/boot.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
+@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
                                     hwaddr *entry, AddressSpace *as)
  {
-     GICv3ITSState *s = (GICv3ITSState *)opaque;
+     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
-     Error *err = NULL;
++    uint64_t kernel_size = 0;
--    int ret;
+     uint8_t *buffer;
+     int size;
-     if (running) {
-         return;
+@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
           * is only valid if the image_size is non-zero.
           */
          memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
 -        if (hdrvals[1] != 0) {
 +
 +        kernel_size = le64_to_cpu(hdrvals[1]);
 +
 +        if (kernel_size != 0) {
              kernel_load_offset = le64_to_cpu(hdrvals[0]);
              /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          }
      }
--    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
++    /*
--                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
++     * Kernels before v3.17 don't populate the image_size field, and
-+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
++     * raw images have no header. For those our best guess at the size
-+                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
++     * is the size of the Image file itself.
-     if (err) {
++     */
-         error_report_err(err);
++    if (kernel_size == 0) {
-     }
++        kernel_size = size;
--    if (ret < 0 && ret != -EFAULT) {
++    }
--        abort();
++
--    }
+     *entry = mem_base + kernel_load_offset;
      rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
      g_free(buffer);
 -    return size;
 +    return kernel_size;
  }
- static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
+ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 05/24] target/arm: Allow VFP and Neon to be disabled via a CPU property
+Allow VFP and neon to be disabled via a CPU property. As with
 the "pmu" property, we only allow these features to be removed
 from CPUs which have it by default, not added to CPUs which
 don't have it.
 The primary motivation here is to be able to optionally
 create Cortex-M33 CPUs with no FPU, but we provide switches
 for both VFP and Neon because the two interact:
  * AArch64 can't have one without the other
  * Some ID register fields only change if both are disabled
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
 ---
  target/arm/cpu.h |   4 ++
  target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
 files changed, 148 insertions(+), 6 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      bool has_el3;
      /* CPU has PMU (Performance Monitor Unit) */
      bool has_pmu;
 +    /* CPU has VFP */
 +    bool has_vfp;
 +    /* CPU has Neon */
 +    bool has_neon;
      /* CPU has memory protection unit */
      bool has_mpu;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
  static Property arm_cpu_has_pmu_property =
              DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 +static Property arm_cpu_has_vfp_property =
 +            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
 +
 +static Property arm_cpu_has_neon_property =
 +            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 +
  static Property arm_cpu_has_mpu_property =
              DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
          set_feature(&cpu->env, ARM_FEATURE_PMSA);
      }
 +    /* Similarly for the VFP feature bits */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP3);
 +    }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP);
 +    }
      if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
          arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                   &error_abort);
      }
 +    /*
 +     * Allow user to turn off VFP and Neon support, but only for TCG --
 +     * KVM does not currently allow us to lie to the guest about its
 +     * ID/feature registers, so the guest always sees what the host has.
 +     */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        cpu->has_vfp = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
 +                                     &error_abort);
 +        }
 +    }
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
 +        cpu->has_neon = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
 +                                     &error_abort);
 +        }
 +    }
 +
      if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          return;
      }
 +    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
 +        cpu->has_vfp != cpu->has_neon) {
 +        /*
 +         * This is an architectural requirement for AArch64; AArch32 is
 +         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
 +         */
 +        error_setg(errp,
 +                   "AArch64 CPUs must have both VFP and Neon or neither");
 +        return;
 +    }
 +
 +    if (!cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_VFP);
 +        unset_feature(env, ARM_FEATURE_VFP3);
 +        unset_feature(env, ARM_FEATURE_VFP4);
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, FPSP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
 +        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
 +        cpu->isar.mvfr0 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
 +        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
 +        u = FIELD_DP32(u, MVFR1, FPHP, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_NEON);
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar5;
 +        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
 +        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
 +        cpu->isar.id_isar5 = u;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
 +        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon && !cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
 +        cpu->isar.mvfr0 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V5)) {
          set_feature(env, ARM_FEATURE_V4T);
      }
 -    if (arm_feature(env, ARM_FEATURE_VFP4)) {
 -        set_feature(env, ARM_FEATURE_VFP3);
 -    }
 -    if (arm_feature(env, ARM_FEATURE_VFP3)) {
 -        set_feature(env, ARM_FEATURE_VFP);
 -    }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
          set_feature(env, ARM_FEATURE_PXN);
 --
 .20.1

-New patch
+[Qemu-devel] [PULL 06/24] target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
+Allow the DSP extension to be disabled via a CPU property for
+M-profile CPUs. (A and R-profile CPUs don't have this extension
+as a defined separate optional architecture extension, so
+they don't need the property.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
+---
+ target/arm/cpu.h |  2 ++
+ target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
+files changed, 31 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+     bool has_vfp;
+     /* CPU has Neon */
+     bool has_neon;
++    /* CPU has M-profile DSP extension */
++    bool has_dsp;
+     /* CPU has memory protection unit */
+     bool has_mpu;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
+ static Property arm_cpu_has_neon_property =
+             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
++static Property arm_cpu_has_dsp_property =
++            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
++
+ static Property arm_cpu_has_mpu_property =
+             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
+         }
+     }
++    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
++        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
++        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
++                                 &error_abort);
++    }
++
+     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
+         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
+                                  &error_abort);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+         cpu->isar.mvfr0 = u;
+     }
++    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
++        uint32_t u;
++
++        unset_feature(env, ARM_FEATURE_THUMB_DSP);
++
++        u = cpu->isar.id_isar1;
++        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
++        cpu->isar.id_isar1 = u;
++
++        u = cpu->isar.id_isar2;
++        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
++        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
++        cpu->isar.id_isar2 = u;
++
++        u = cpu->isar.id_isar3;
++        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
++        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
++        cpu->isar.id_isar3 = u;
++    }
++
+     /* Some features automatically imply others: */
+     if (arm_feature(env, ARM_FEATURE_V8)) {
+         if (arm_feature(env, ARM_FEATURE_M)) {
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 07/24] hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
+Create "vfp" and "dsp" properties on the armv7m container object
+which will be forwarded to its CPU object, so that SoCs can
+configure whether the CPU has these features.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
+---
+ include/hw/arm/armv7m.h |  4 ++++
+ hw/arm/armv7m.c         | 18 ++++++++++++++++++
+files changed, 22 insertions(+)
+diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armv7m.h
++++ b/include/hw/arm/armv7m.h
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+  *   devices will be automatically layered on top of this view.)
+  * + Property "idau": IDAU interface (forwarded to CPU object)
+  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
++ * + Property "vfp": enable VFP (forwarded to CPU object)
++ * + Property "dsp": enable DSP (forwarded to CPU object)
+  * + Property "enable-bitband": expose bitbanded IO
+  */
+ typedef struct ARMv7MState {
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
+     uint32_t init_svtor;
+     bool enable_bitband;
+     bool start_powered_off;
++    bool vfp;
++    bool dsp;
+ } ARMv7MState;
+ #endif
+diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armv7m.c
++++ b/hw/arm/armv7m.c
+@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
+             return;
+         }
+     }
++    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
++        object_property_set_bool(OBJECT(s->cpu), s->vfp,
++                                 "vfp", &err);
++        if (err != NULL) {
++            error_propagate(errp, err);
++            return;
++        }
++    }
++    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
++        object_property_set_bool(OBJECT(s->cpu), s->dsp,
++                                 "dsp", &err);
++        if (err != NULL) {
++            error_propagate(errp, err);
++            return;
++        }
++    }
+     /*
+      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
+@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
+     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
+     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
+                      false),
++    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
++    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
+     DEFINE_PROP_END_OF_LIST(),
+ };
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 08/24] hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
+The SSE-200 hardware has configurable integration settings which
+determine whether its two CPUs have the FPU and DSP:
+ * CPU0_FPU (default 0)
+ * CPU0_DSP (default 0)
+ * CPU1_FPU (default 1)
+ * CPU1_DSP (default 1)
+Similarly, the IoTKit has settings for its single CPU:
+ * CPU0_FPU (default 1)
+ * CPU0_DSP (default 1)
+Of our four boards that use either the IoTKit or the SSE-200:
+ * mps2-an505, mps2-an521 and musca-a use the default settings
+ * musca-b1 enables FPU and DSP on both CPUs
+Currently QEMU models all these boards using CPUs with
+both FPU and DSP enabled. This means that we are incorrect
+for mps2-an521 and musca-a, which should not have FPU or DSP
+on CPU0.
+Create QOM properties on the ARMSSE devices corresponding to the
+default h/w integration settings, and make the Musca-B1 board
+enable FPU and DSP on both CPUs. This fixes the mps2-an521
+and musca-a behaviour, and leaves the musca-b1 and mps2-an505
+behaviour unchanged.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
+---
+ include/hw/arm/armsse.h |  7 +++++
+ hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
+ hw/arm/musca.c          |  8 ++++++
+files changed, 61 insertions(+), 12 deletions(-)
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/armsse.h
++++ b/include/hw/arm/armsse.h
+@@ -XXX,XX +XXX,XX @@
+  *    address of each SRAM bank (and thus the total amount of internal SRAM)
+  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
+  *    (where it expects to load the PC and SP from the vector table on reset)
++ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
++ *    set whether the CPUs have the FPU and DSP features present. The default
++ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
++ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
++ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
+  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
+  *    which are wired to its NVIC lines 32 .. n+32
+  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
+     uint32_t mainclk_frq;
+     uint32_t sram_addr_width;
+     uint32_t init_svtor;
++    bool cpu_fpu[SSE_MAX_CPUS];
++    bool cpu_dsp[SSE_MAX_CPUS];
+ } ARMSSE;
+ typedef struct ARMSSEInfo ARMSSEInfo;
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
+@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
+     bool has_cachectrl;
+     bool has_cpusecctrl;
+     bool has_cpuid;
++    Property *props;
++};
++
++static Property iotkit_properties[] = {
++    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
++                     MemoryRegion *),
++    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
++    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
++    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
++    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
++    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
++    DEFINE_PROP_END_OF_LIST()
++};
++
++static Property armsse_properties[] = {
++    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
++                     MemoryRegion *),
++    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
++    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
++    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
++    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
++    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
++    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
++    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
++    DEFINE_PROP_END_OF_LIST()
+ };
+ static const ARMSSEInfo armsse_variants[] = {
+@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
+         .has_cachectrl = false,
+         .has_cpusecctrl = false,
+         .has_cpuid = false,
++        .props = iotkit_properties,
+     },
+     {
+         .name = TYPE_SSE200,
+@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
+         .has_cachectrl = true,
+         .has_cpusecctrl = true,
+         .has_cpuid = true,
++        .props = armsse_properties,
+     },
+ };
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+                 return;
+             }
+         }
++        if (!s->cpu_fpu[i]) {
++            object_property_set_bool(cpuobj, false, "vfp", &err);
++            if (err) {
++                error_propagate(errp, err);
++                return;
++            }
++        }
++        if (!s->cpu_dsp[i]) {
++            object_property_set_bool(cpuobj, false, "dsp", &err);
++            if (err) {
++                error_propagate(errp, err);
++                return;
++            }
++        }
+         if (i > 0) {
+             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
+     }
+ };
+-static Property armsse_properties[] = {
+-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+-                     MemoryRegion *),
+-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+-    DEFINE_PROP_END_OF_LIST()
+-};
+-
+ static void armsse_reset(DeviceState *dev)
+ {
+     ARMSSE *s = ARMSSE(dev);
+@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
+     DeviceClass *dc = DEVICE_CLASS(klass);
+     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
+     ARMSSEClass *asc = ARMSSE_CLASS(klass);
++    const ARMSSEInfo *info = data;
+     dc->realize = armsse_realize;
+     dc->vmsd = &armsse_vmstate;
+-    dc->props = armsse_properties;
++    dc->props = info->props;
+     dc->reset = armsse_reset;
+     iic->check = armsse_idau_check;
+-    asc->info = data;
++    asc->info = info;
+ }
+ static const TypeInfo armsse_info = {
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/musca.c
++++ b/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
+     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
+     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
+     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
++    /*
++     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
++     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
++     */
++    if (mmc->type == MUSCA_B1) {
++        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
++        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
++    }
+     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
+                              &error_fatal);
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 09/24] hw/intc/arm_gicv3: Fix decoding of ID register range
+The GIC ID registers cover an area 0x30 bytes in size
+(12 registers, 4 bytes each). We were incorrectly decoding
+only the first 0x20 bytes.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
+---
+ hw/intc/arm_gicv3_dist.c   | 4 ++--
+ hw/intc/arm_gicv3_redist.c | 4 ++--
+files changed, 4 insertions(+), 4 deletions(-)
+diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/arm_gicv3_dist.c
++++ b/hw/intc/arm_gicv3_dist.c
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+         }
+         return MEMTX_OK;
+     }
+-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
++    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
+         /* ID registers */
+         *data = gicv3_idreg(offset - GICD_IDREGS);
+         return MEMTX_OK;
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
+         gicd_write_irouter(s, attrs, irq, r);
+         return MEMTX_OK;
+     }
+-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
++    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
+     case GICD_TYPER:
+     case GICD_IIDR:
+         /* RO registers, ignore the write */
+diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/arm_gicv3_redist.c
++++ b/hw/intc/arm_gicv3_redist.c
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
+         }
+         *data = cs->gicr_nsacr;
+         return MEMTX_OK;
+-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
++    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
+         *data = gicv3_idreg(offset - GICR_IDREGS);
+         return MEMTX_OK;
+     default:
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
+         return MEMTX_OK;
+     case GICR_IIDR:
+     case GICR_TYPER:
+-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
++    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
+         /* RO registers, ignore the write */
+         qemu_log_mask(LOG_GUEST_ERROR,
+                       "%s: invalid guest write to RO register at offset "
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 10/24] hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
+is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
+if the security extension is unsupported. "Security extension
+unsupported" always implies GICD_CTLR.DS == 1, but the guest can
+also set DS on a GIC which does support the security extension.
+Fix the condition to correctly check the GICD_CTLR.DS bit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
+---
+ hw/intc/arm_gicv3_dist.c | 8 +++++++-
+file changed, 7 insertions(+), 1 deletion(-)
+diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/arm_gicv3_dist.c
++++ b/hw/intc/arm_gicv3_dist.c
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+          * ITLinesNumber == (num external irqs / 32) - 1
+          */
+         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
++        /*
++         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
++         * "security extensions not supported" always implies DS == 1,
++         * so we only need to check the DS bit.
++         */
++        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
+-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
++        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
+             (0xf << 19) | itlinesnumber;
+         return MEMTX_OK;
+     }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 11/24] target/arm: Move vfp_expand_imm() to translate.[ch]
+We want to use vfp_expand_imm() in the AArch32 VFP decode;
+move it from the a64-only header/source file to the
+AArch32 one (which is always compiled even for AArch64).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
+---
+ target/arm/translate-a64.h     |  1 -
+ target/arm/translate.h         |  7 +++++++
+ target/arm/translate-a64.c     | 32 --------------------------------
+ target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
+files changed, 40 insertions(+), 33 deletions(-)
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.h
++++ b/target/arm/translate-a64.h
+@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
+ TCGv_ptr get_fpstatus_ptr(bool);
+ bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
+                             unsigned int imms, unsigned int immr);
+-uint64_t vfp_expand_imm(int size, uint8_t imm8);
+ bool sve_access_check(DisasContext *s);
+ /* We should have at some point before trying to access an FP register
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
+     }
+ }
++/*
++ * Given a VFP floating point constant encoded into an 8 bit immediate in an
++ * instruction, expand it to the actual constant value of the specified
++ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
++ */
++uint64_t vfp_expand_imm(int size, uint8_t imm8);
++
+ /* Vector operations shared between ARM and AArch64.  */
+ extern const GVecGen3 mla_op[4];
+ extern const GVecGen3 mls_op[4];
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
+     }
+ }
+-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
+- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+- */
+-uint64_t vfp_expand_imm(int size, uint8_t imm8)
+-{
+-    uint64_t imm;
+-
+-    switch (size) {
+-    case MO_64:
+-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+-            extract32(imm8, 0, 6);
+-        imm <<= 48;
+-        break;
+-    case MO_32:
+-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+-            (extract32(imm8, 0, 6) << 3);
+-        imm <<= 16;
+-        break;
+-    case MO_16:
+-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+-            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+-            (extract32(imm8, 0, 6) << 6);
+-        break;
+-    default:
+-        g_assert_not_reached();
+-    }
+-    return imm;
+-}
+-
+ /* Floating point immediate
+  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
+  * +---+---+---+-----------+------+---+------------+-------+------+------+
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
+@@ -XXX,XX +XXX,XX @@
+ #include "decode-vfp.inc.c"
+ #include "decode-vfp-uncond.inc.c"
++/*
++ * The imm8 encodes the sign bit, enough bits to represent an exponent in
++ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
++ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
++ */
++uint64_t vfp_expand_imm(int size, uint8_t imm8)
++{
++    uint64_t imm;
++
++    switch (size) {
++    case MO_64:
++        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
++            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
++            extract32(imm8, 0, 6);
++        imm <<= 48;
++        break;
++    case MO_32:
++        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
++            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
++            (extract32(imm8, 0, 6) << 3);
++        imm <<= 16;
++        break;
++    case MO_16:
++        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
++            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
++            (extract32(imm8, 0, 6) << 6);
++        break;
++    default:
++        g_assert_not_reached();
++    }
++    return imm;
++}
++
+ /*
+  * Return the offset of a 16-bit half of the specified VFP single-precision
+  * register. If top is true, returns the top 16 bits; otherwise the bottom
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 12/24] target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
+The AArch32 VMOV (immediate) instruction uses the same VFP encoded
+immediate format we already handle in vfp_expand_imm().  Use that
+function rather than hand-decoding it.
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
+---
+ target/arm/translate-vfp.inc.c | 28 ++++------------------------
+ target/arm/vfp.decode          | 10 ++++++----
+files changed, 10 insertions(+), 28 deletions(-)
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
+     uint32_t delta_d = 0;
+     int veclen = s->vec_len;
+     TCGv_i32 fd;
+-    uint32_t n, i, vd;
++    uint32_t vd;
+     vd = a->vd;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
+         }
+     }
+-    n = (a->imm4h << 28) & 0x80000000;
+-    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
+-    if (i & 0x40) {
+-        i |= 0x780;
+-    } else {
+-        i |= 0x800;
+-    }
+-    n |= i << 19;
+-
+-    fd = tcg_temp_new_i32();
+-    tcg_gen_movi_i32(fd, n);
++    fd = tcg_const_i32(vfp_expand_imm(MO_32, a->imm));
+     for (;;) {
+         neon_store_reg32(fd, vd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
+     uint32_t delta_d = 0;
+     int veclen = s->vec_len;
+     TCGv_i64 fd;
+-    uint32_t n, i, vd;
++    uint32_t vd;
+     vd = a->vd;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
+         }
+     }
+-    n = (a->imm4h << 28) & 0x80000000;
+-    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
+-    if (i & 0x40) {
+-        i |= 0x3f80;
+-    } else {
+-        i |= 0x4000;
+-    }
+-    n |= i << 16;
+-
+-    fd = tcg_temp_new_i64();
+-    tcg_gen_movi_i64(fd, ((uint64_t)n) << 32);
++    fd = tcg_const_i64(vfp_expand_imm(MO_64, a->imm));
+     for (;;) {
+         neon_store_reg64(fd, vd);
+diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp.decode
++++ b/target/arm/vfp.decode
+@@ -XXX,XX +XXX,XX @@
+ %vmov_idx_b     21:1 5:2
+ %vmov_idx_h     21:1 6:1
++%vmov_imm 16:4 0:4
++
+ # VMOV scalar to general-purpose register; note that this does
+ # include some Neon cases.
+ VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
+@@ -XXX,XX +XXX,XX @@ VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
+ VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
+              vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
+-VMOV_imm_sp  ---- 1110 1.11 imm4h:4 .... 1010 0000 imm4l:4 \
+-             vd=%vd_sp
+-VMOV_imm_dp  ---- 1110 1.11 imm4h:4 .... 1011 0000 imm4l:4 \
+-             vd=%vd_dp
++VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
++             vd=%vd_sp imm=%vmov_imm
++VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
++             vd=%vd_dp imm=%vmov_imm
+ VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
+              vd=%vd_sp vm=%vm_sp
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 13/24] target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
+Where Neon instructions are floating point operations, we
+mostly use the old VFP utility functions like gen_vfp_abs()
+which work on the TCG globals cpu_F0s and cpu_F1s. The
+Neon for-each-element loop conditionally loads the inputs
+into either a plain old TCG temporary for most operations
+or into cpu_F0s for float operations, and similarly stores
+back either cpu_F0s or the temporary.
+Switch NEON_2RM_VABS_F away from using cpu_F0s, and
+update neon_2rm_is_float_op() accordingly.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-4-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 19 ++++++++-----------
+file changed, 8 insertions(+), 11 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-static inline void gen_vfp_abs(int dp)
+-{
+-    if (dp)
+-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
+-    else
+-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
+-}
+-
+ static inline void gen_vfp_neg(int dp)
+ {
+     if (dp)
+@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
+ static int neon_2rm_is_float_op(int op)
+ {
+-    /* Return true if this neon 2reg-misc op is float-to-float */
+-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
++    /*
++     * Return true if this neon 2reg-misc op is float-to-float.
++     * This is not a property of the operation but of our code --
++     * what we are asking here is "does the code for this case in
++     * the Neon for-each-pass loop use cpu_F0s?".
++     */
++    return (op == NEON_2RM_VNEG_F ||
+             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+             op == NEON_2RM_VRINTM ||
+             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             break;
+                         }
+                         case NEON_2RM_VABS_F:
+-                            gen_vfp_abs(0);
++                            gen_helper_vfp_abss(tmp, tmp);
+                             break;
+                         case NEON_2RM_VNEG_F:
+                             gen_vfp_neg(0);
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 14/24] target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
+Switch NEON_2RM_VABS_F away from using cpu_F0s.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-5-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 13 ++-----------
+file changed, 2 insertions(+), 11 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-static inline void gen_vfp_neg(int dp)
+-{
+-    if (dp)
+-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
+-    else
+-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
+-}
+-
+ #define VFP_GEN_ITOF(name) \
+ static inline void gen_vfp_##name(int dp, int neon) \
+ { \
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
+      */
+-    return (op == NEON_2RM_VNEG_F ||
+-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
++    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+             op == NEON_2RM_VRINTM ||
+             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+             op >= NEON_2RM_VRECPE_F);
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             gen_helper_vfp_abss(tmp, tmp);
+                             break;
+                         case NEON_2RM_VNEG_F:
+-                            gen_vfp_neg(0);
++                            gen_helper_vfp_negs(tmp, tmp);
+                             break;
+                         case NEON_2RM_VSWP:
+                             tmp2 = neon_load_reg(rd, pass);
+--
+.20.1

-[Qemu-devel] [PULL 4/7] hw/arm: Mark the "fsl, imx31" device with user_creatable = false
+[Qemu-devel] [PULL 15/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
-From: Thomas Huth <thuth@redhat.com>
+Switch NEON_2RM_VRINT* away from using cpu_F0s.
-QEMU currently crashes when the user tries to instantiate the fsl,imx31
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-device manually:
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-6-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 8 +++-----
 file changed, 3 insertions(+), 5 deletions(-)
-$ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 **
 ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
  assertion failed: (n < max_cpus)
 Aborted (core dumped)
 The kzm board (which is the one that uses this CPU type) only supports
 one CPU, and the realize function of the "fsl,imx31" device also uses
 serial_hds[] directly, so this device clearly can not be instantiated
 twice and thus we should mark it with user_creatable = false.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/fsl-imx31.c | 6 +++++-
 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx31.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/fsl-imx31.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
-     dc->realize = fsl_imx31_realize;
+      */
--
+-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-     dc->desc = "i.MX31 SOC";
+-            op == NEON_2RM_VRINTM ||
-+    /*
+-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
-+     * Reason: uses serial_hds in realize and the kzm board does not
++    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-+     * support multiple CPUs
+             op >= NEON_2RM_VRECPE_F);
 +     */
 +    dc->user_creatable = false;
  }
- static const TypeInfo fsl_imx31_type_info = {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                              tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
                              gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                        cpu_env);
 -                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
 +                            gen_helper_rints(tmp, tmp, fpstatus);
                              gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                        cpu_env);
                              tcg_temp_free_ptr(fpstatus);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          case NEON_2RM_VRINTX:
                          {
                              TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 -                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
 +                            gen_helper_rints_exact(tmp, tmp, fpstatus);
                              tcg_temp_free_ptr(fpstatus);
                              break;
                          }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 5/7] translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
+[Qemu-devel] [PULL 16/24] target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
-For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
+Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.
 lowest address is always Rt and the one at addr+4 is Rt2, even if the
 CPU is big-endian. Our implementation does these with a single
 -bit store, so if we're big-endian then we need to put the two
 -bit halves together in the opposite order to little-endian,
 so that they end up in the right places. We were trying to do
 this with the gen_aa32_frob64() function, but that is not correct
 for the usermode emulator, because there there is a distinction
 between "load a 64 bit value" (which does a BE 64-bit access
 and doesn't need swapping) and "load two 32 bit values as one
 bit access" (where we still need to do the swapping, like
 system mode BE32).
-Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
-Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-7-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
+ target/arm/translate.c | 7 +++----
-file changed, 34 insertions(+), 5 deletions(-)
+file changed, 3 insertions(+), 4 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-         TCGv_i32 tmp2 = tcg_temp_new_i32();
+      * what we are asking here is "does the code for this case in
-         TCGv_i64 t64 = tcg_temp_new_i64();
+      * the Neon for-each-pass loop use cpu_F0s?".
+      */
--        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
+-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-+        /* For AArch32, architecturally the 32-bit word at the lowest
+-            op >= NEON_2RM_VRECPE_F);
-+         * address is always Rt and the one at addr+4 is Rt2, even if
++    return op >= NEON_2RM_VRECPE_F;
-+         * the CPU is big-endian. That means we don't want to do a
+ }
-+         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
-+         * for an architecturally 64-bit access, but instead do a
+ static bool neon_2rm_is_v8_op(int op)
-+         * 64-bit access using MO_BE if appropriate and then split
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-+         * the two halves.
+                                                       cpu_env);
-+         * This only makes a difference for BE32 user-mode, where
-+         * frob64() must not flip the two halves of the 64-bit data
+                             if (is_signed) {
-+         * but this code must treat BE32 user-mode like BE32 system.
+-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
-+         */
++                                gen_helper_vfp_tosls(tmp, tmp,
-+        TCGv taddr = gen_aa32_addr(s, addr, opc);
+                                                      tcg_shift, fpst);
-+
+                             } else {
-+        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
+-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
-+        tcg_temp_free(taddr);
++                                gen_helper_vfp_touls(tmp, tmp,
-         tcg_gen_mov_i64(cpu_exclusive_val, t64);
+                                                      tcg_shift, fpst);
--        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+                             }
 +        if (s->be_data == MO_BE) {
 +            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
 +        } else {
 +            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
 +        }
          tcg_temp_free_i64(t64);
          store_reg(s, rt2, tmp2);
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
          TCGv_i64 n64 = tcg_temp_new_i64();
          t2 = load_reg(s, rt2);
 -        tcg_gen_concat_i32_i64(n64, t1, t2);
 +        /* For AArch32, architecturally the 32-bit word at the lowest
 +         * address is always Rt and the one at addr+4 is Rt2, even if
 +         * the CPU is big-endian. Since we're going to treat this as a
 +         * single 64-bit BE store, we need to put the two halves in the
 +         * opposite order for BE to LE, so that they end up in the right
 +         * places.
 +         * We don't want gen_aa32_frob64() because that does the wrong
 +         * thing for BE32 usermode.
 +         */
 +        if (s->be_data == MO_BE) {
 +            tcg_gen_concat_i32_i64(n64, t2, t1);
 +        } else {
 +            tcg_gen_concat_i32_i64(n64, t1, t2);
 +        }
          tcg_temp_free_i32(t2);
 -        gen_aa32_frob64(s, n64);
          tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
                                     get_mem_index(s), opc);
          tcg_temp_free_i64(n64);
 -        gen_aa32_frob64(s, o64);
          tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
          tcg_gen_extrl_i64_i32(t0, o64);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 3/7] hw/arm: Mark the "fsl, imx25" device with user_creatable = false
+[Qemu-devel] [PULL 17/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
-From: Thomas Huth <thuth@redhat.com>
+Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.
-QEMU currently crashes when the user tries to instantiate the fsl,imx25
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-device manually:
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-8-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 6 +++---
 file changed, 3 insertions(+), 3 deletions(-)
-$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 **
 ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
  assertion failed: (n < max_cpus)
 The imx25-pdk board (which is the one that uses this CPU type) only
 supports one CPU, and the realize function of the "fsl,imx25" device
 also uses serial_hds[] directly, so this device clearly can not be
 instantiated twice and thus we should mark it with user_creatable = 0.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/fsl-imx25.c | 6 +++++-
 file changed, 5 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx25.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/fsl-imx25.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
-     dc->realize = fsl_imx25_realize;
+      */
--
+-    return op >= NEON_2RM_VRECPE_F;
-     dc->desc = "i.MX25 SOC";
++    return op >= NEON_2RM_VCVT_FS;
 +    /*
 +     * Reason: uses serial_hds in realize and the imx25 board does not
 +     * support multiple CPUs
 +     */
 +    dc->user_creatable = false;
  }
- static const TypeInfo fsl_imx25_type_info = {
+ static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          case NEON_2RM_VRECPE_F:
                          {
                              TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 -                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
 +                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
                              tcg_temp_free_ptr(fpstatus);
                              break;
                          }
                          case NEON_2RM_VRSQRTE_F:
                          {
                              TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 -                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
 +                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
                              tcg_temp_free_ptr(fpstatus);
                              break;
                          }
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 18/24] target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
+Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
+Since this is the last user of cpu_F0s in the Neon 2rm-op
+loop, we can remove the handling code for it too.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-9-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 82 ++++++++++++------------------------------
+file changed, 22 insertions(+), 60 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-#define VFP_GEN_ITOF(name) \
+-static inline void gen_vfp_##name(int dp, int neon) \
+-{ \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+-    } \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-
+-VFP_GEN_ITOF(uito)
+-VFP_GEN_ITOF(sito)
+-#undef VFP_GEN_ITOF
+-
+-#define VFP_GEN_FTOI(name) \
+-static inline void gen_vfp_##name(int dp, int neon) \
+-{ \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+-    } \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-
+-VFP_GEN_FTOI(touiz)
+-VFP_GEN_FTOI(tosiz)
+-#undef VFP_GEN_FTOI
+-
+ #define VFP_GEN_FIX(name, round) \
+ static inline void gen_vfp_##name(int dp, int shift, int neon) \
+ { \
+@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
+ #define NEON_2RM_VCVT_SF 62
+ #define NEON_2RM_VCVT_UF 63
+-static int neon_2rm_is_float_op(int op)
+-{
+-    /*
+-     * Return true if this neon 2reg-misc op is float-to-float.
+-     * This is not a property of the operation but of our code --
+-     * what we are asking here is "does the code for this case in
+-     * the Neon for-each-pass loop use cpu_F0s?".
+-     */
+-    return op >= NEON_2RM_VCVT_FS;
+-}
+-
+ static bool neon_2rm_is_v8_op(int op)
+ {
+     /* Return true if this neon 2reg-misc op is ARMv8 and up */
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                 default:
+                 elementwise:
+                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
+-                        if (neon_2rm_is_float_op(op)) {
+-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
+-                                           neon_reg_offset(rm, pass));
+-                            tmp = NULL;
+-                        } else {
+-                            tmp = neon_load_reg(rm, pass);
+-                        }
++                        tmp = neon_load_reg(rm, pass);
+                         switch (op) {
+                         case NEON_2RM_VREV32:
+                             switch (size) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             break;
+                         }
+                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
+-                            gen_vfp_sito(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
+-                            gen_vfp_uito(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
+-                            gen_vfp_tosiz(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
+-                            gen_vfp_touiz(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         default:
+                             /* Reserved op values were caught by the
+                              * neon_2rm_sizes[] check earlier.
+                              */
+                             abort();
+                         }
+-                        if (neon_2rm_is_float_op(op)) {
+-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
+-                                           neon_reg_offset(rd, pass));
+-                        } else {
+-                            neon_store_reg(rd, pass, tmp);
+-                        }
++                        neon_store_reg(rd, pass, tmp);
+                     }
+                     break;
+                 }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 19/24] target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
+Stop using cpu_F0s in the Neon VCVT fixed-point operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 62 +++++++++++++++++++-----------------------
+file changed, 28 insertions(+), 34 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+ /* Function prototypes for gen_ functions calling Neon helpers.  */
+ typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                  TCGv_i32, TCGv_i32);
++/* Function prototypes for gen_ functions for fix point conversions */
++typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-#define VFP_GEN_FIX(name, round) \
+-static inline void gen_vfp_##name(int dp, int shift, int neon) \
+-{ \
+-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
+-                                        statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
+-                                        statusptr); \
+-    } \
+-    tcg_temp_free_i32(tmp_shift); \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-VFP_GEN_FIX(tosl, _round_to_zero)
+-VFP_GEN_FIX(toul, _round_to_zero)
+-VFP_GEN_FIX(slto, )
+-VFP_GEN_FIX(ulto, )
+-#undef VFP_GEN_FIX
+-
+ static inline long vfp_reg_offset(bool dp, unsigned reg)
+ {
+     if (dp) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                 }
+             } else if (op >= 14) {
+                 /* VCVT fixed-point.  */
++                TCGv_ptr fpst;
++                TCGv_i32 shiftv;
++                VFPGenFixPointFn *fn;
++
+                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
+                     return 1;
+                 }
++
++                if (!(op & 1)) {
++                    if (u) {
++                        fn = gen_helper_vfp_ultos;
++                    } else {
++                        fn = gen_helper_vfp_sltos;
++                    }
++                } else {
++                    if (u) {
++                        fn = gen_helper_vfp_touls_round_to_zero;
++                    } else {
++                        fn = gen_helper_vfp_tosls_round_to_zero;
++                    }
++                }
++
+                 /* We have already masked out the must-be-1 top bit of imm6,
+                  * hence this 32-shift where the ARM ARM has 64-imm6.
+                  */
+                 shift = 32 - shift;
++                fpst = get_fpstatus_ptr(1);
++                shiftv = tcg_const_i32(shift);
+                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
+-                    if (!(op & 1)) {
+-                        if (u)
+-                            gen_vfp_ulto(0, shift, 1);
+-                        else
+-                            gen_vfp_slto(0, shift, 1);
+-                    } else {
+-                        if (u)
+-                            gen_vfp_toul(0, shift, 1);
+-                        else
+-                            gen_vfp_tosl(0, shift, 1);
+-                    }
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
++                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
++                    fn(tmpf, tmpf, shiftv, fpst);
++                    neon_store_reg(rd, pass, tmpf);
+                 }
++                tcg_temp_free_ptr(fpst);
++                tcg_temp_free_i32(shiftv);
+             } else {
+                 return 1;
+             }
+--
+.20.1

-[Qemu-devel] [PULL 2/7] hw/arm: Mark the "fsl, imx6" device with user_creatable = false
+[Qemu-devel] [PULL 20/24] target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
-From: Thomas Huth <thuth@redhat.com>
+Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
  * don't use cpu_F0s
  * don't use tcg_gen_ld_f32
-This device causes QEMU to abort if the user tries to instantiate it:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-11-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 27 ++++++++++++---------------
 file changed, 12 insertions(+), 15 deletions(-)
-$ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
 qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
 Aborted (core dumped)
 The device uses serial_hds[] directly in its realize function, so it
 can not be instantiated again by the user.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/fsl-imx6.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/fsl-imx6.c
+--- a/target/arm/translate.c
-+++ b/hw/arm/fsl-imx6.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-     DeviceClass *dc = DEVICE_CLASS(oc);
+     return ret;
      dc->realize = fsl_imx6_realize;
 -
      dc->desc = "i.MX6 SOC";
 +    /* Reason: Uses serial_hds[] in the realize() function */
 +    dc->user_creatable = false;
  }
- static const TypeInfo fsl_imx6_type_info = {
+-#define tcg_gen_ld_f32 tcg_gen_ld_i32
  #define tcg_gen_st_f32 tcg_gen_st_i32
  #define ARM_CP_RW_BIT   (1 << 20)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          q || (rm & 1)) {
                          return 1;
                      }
 -                    tmp = tcg_temp_new_i32();
 -                    tmp2 = tcg_temp_new_i32();
                      fpst = get_fpstatus_ptr(true);
                      ahp = get_ahp_flag();
 -                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
 -                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
 -                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
 -                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
 +                    tmp = neon_load_reg(rm, 0);
 +                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
 +                    tmp2 = neon_load_reg(rm, 1);
 +                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
                      tcg_gen_shli_i32(tmp2, tmp2, 16);
                      tcg_gen_or_i32(tmp2, tmp2, tmp);
 -                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
 -                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
 -                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
 +                    tcg_temp_free_i32(tmp);
 +                    tmp = neon_load_reg(rm, 2);
 +                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
 +                    tmp3 = neon_load_reg(rm, 3);
                      neon_store_reg(rd, 0, tmp2);
 -                    tmp2 = tcg_temp_new_i32();
 -                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
 -                    tcg_gen_shli_i32(tmp2, tmp2, 16);
 -                    tcg_gen_or_i32(tmp2, tmp2, tmp);
 -                    neon_store_reg(rd, 1, tmp2);
 +                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
 +                    tcg_gen_shli_i32(tmp3, tmp3, 16);
 +                    tcg_gen_or_i32(tmp3, tmp3, tmp);
 +                    neon_store_reg(rd, 1, tmp3);
                      tcg_temp_free_i32(tmp);
                      tcg_temp_free_i32(ahp);
                      tcg_temp_free_ptr(fpst);
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 21/24] target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
+Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
+ * don't use CPU_F0s
+ * don't use tcg_gen_st_f32
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-12-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 26 +++++++++++---------------
+file changed, 11 insertions(+), 15 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+     return ret;
+ }
+-#define tcg_gen_st_f32 tcg_gen_st_i32
+-
+ #define ARM_CP_RW_BIT   (1 << 20)
+ /* Include the VFP decoder */
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                     tmp = neon_load_reg(rm, 0);
+                     tmp2 = neon_load_reg(rm, 1);
+                     tcg_gen_ext16u_i32(tmp3, tmp);
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
+-                    tcg_gen_shri_i32(tmp3, tmp, 16);
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
+-                    tcg_temp_free_i32(tmp);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
++                    neon_store_reg(rd, 0, tmp3);
++                    tcg_gen_shri_i32(tmp, tmp, 16);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
++                    neon_store_reg(rd, 1, tmp);
++                    tmp3 = tcg_temp_new_i32();
+                     tcg_gen_ext16u_i32(tmp3, tmp2);
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
+-                    tcg_gen_shri_i32(tmp3, tmp2, 16);
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
+-                    tcg_temp_free_i32(tmp2);
+-                    tcg_temp_free_i32(tmp3);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
++                    neon_store_reg(rd, 2, tmp3);
++                    tcg_gen_shri_i32(tmp2, tmp2, 16);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
++                    neon_store_reg(rd, 3, tmp2);
+                     tcg_temp_free_i32(ahp);
+                     tcg_temp_free_ptr(fpst);
+                     break;
+--
+.20.1

-[Qemu-devel] [PULL 6/7] hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
+[Qemu-devel] [PULL 22/24] target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
-From: Shanker Donthineni <shankerd@codeaurora.org>
+Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.
-The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
+cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
-/restore") breaks the backward compatibility with the older kernels
+cpu_V1 are used by both iwmmxt and Neon.
 where vITS save/restore support is not available. The vmstate function
 vm_change_state_handler() should not be registered if the running kernel
 doesn't support ITS save/restore feature. Otherwise VM instance will be
 killed whenever vmstate callback function is invoked.
-Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-13-peter.maydell@linaro.org
 ---
  target/arm/translate.c | 12 ++----------
 file changed, 2 insertions(+), 10 deletions(-)
-KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/intc/arm_gicv3_its_kvm.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its_kvm.c
+--- a/target/arm/translate.c
-+++ b/hw/intc/arm_gicv3_its_kvm.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
-             error_free(s->migration_blocker);
+ TCGv_i64 cpu_exclusive_addr;
-             return;
+ TCGv_i64 cpu_exclusive_val;
-         }
-+    } else {
+-/* FIXME:  These should be removed.  */
-+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+-static TCGv_i32 cpu_F0s, cpu_F1s;
 -static TCGv_i64 cpu_F0d, cpu_F1d;
 -
  #include "exec/gen-icount.h"
  static const char * const regnames[] =
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
          dc->base.max_insns = MIN(dc->base.max_insns, bound);
      }
-     kvm_msi_use_devid = true;
+-    cpu_F0s = tcg_temp_new_i32();
-     kvm_gsi_direct_mapping = false;
+-    cpu_F1s = tcg_temp_new_i32();
-     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+-    cpu_F0d = tcg_temp_new_i64();
--
+-    cpu_F1d = tcg_temp_new_i64();
--    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+-    cpu_V0 = cpu_F0d;
 -    cpu_V1 = cpu_F1d;
 +    cpu_V0 = tcg_temp_new_i64();
 +    cpu_V1 = tcg_temp_new_i64();
      /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
      cpu_M0 = tcg_temp_new_i64();
  }
- /**
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 1/7] arm: implement cache/shareability attribute bits for PAR registers
+[Qemu-devel] [PULL 23/24] target/arm: Fix typos in trans function prototypes
-From: Andrew Baumann <Andrew.Baumann@microsoft.com>
+In several places cut and paste errors meant we were using the wrong
 type for the 'arg' struct in trans_ functions called by the
 decodetree decoder, because we were using the _sp version of the
 struct in the _dp function.  These were harmless, because the two
 structs were identical and so decodetree made them typedefs of the
 same underlying structure (and we'd have had a compile error if they
 were not harmless), but we should clean them up anyway.
-On a successful address translation instruction, PAR is supposed to
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-contain cacheability and shareability attributes determined by the
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-translation. We previously returned 0 for these bits (in line with the
+Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
-general strategy of ignoring caches and memory attributes), but some
+---
-guest OSes may depend on them.
+ target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
 file changed, 14 insertions(+), 14 deletions(-)
-This patch collects the attribute bits in the page-table walk, and
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 updates PAR with the correct attributes for all LPAE translations.
 Short descriptor formats still return 0 for these bits, as in the
 prior implementation.
 Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
 file changed, 164 insertions(+), 14 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
  #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
  #ifndef CONFIG_USER_ONLY
 +/* Cacheability and shareability attributes for a memory access */
 +typedef struct ARMCacheAttrs {
 +    unsigned int attrs:8; /* as in the MAIR register encoding */
 +    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
 +} ARMCacheAttrs;
 +
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi);
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
 -                               ARMMMUFaultInfo *fi);
 +                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
  /* Security attributes for an address, as returned by v8m_security_lookup. */
  typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
      uint64_t par64;
      MemTxAttrs attrs = {};
      ARMMMUFaultInfo fi = {};
 +    ARMCacheAttrs cacheattrs = {};
 -    ret = get_phys_addr(env, value, access_type, mmu_idx,
 -                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
 +    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
 +                        &prot, &page_size, &fsr, &fi, &cacheattrs);
      if (extended_addresses_enabled(env)) {
          /* fsr is a DFSR/IFSR value for the long descriptor
           * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
              if (!attrs.secure) {
                  par64 |= (1 << 9); /* NS */
              }
 -            /* We don't set the ATTR or SH fields in the PAR. */
 +            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
 +            par64 |= cacheattrs.shareability << 7; /* SH */
          } else {
              par64 |= 1; /* F */
              par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
          return false;
      }
      if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
 -                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
 +                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
          /* the MPU lookup failed */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
          int ret;
          ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
 -                                 &txattrs, &s2prot, &s2size, fsr, fi);
 +                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
          if (ret) {
              fi->s2addr = addr;
              fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
      return true;
  }
-+/* Translate from the 4-bit stage 2 representation of
+-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
-+ * memory attributes (without cache-allocation hints) to
++static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
 + * the 8-bit representation of the stage 1 MAIR registers
 + * (which includes allocation hints).
 + *
 + * ref: shared/translation/attrs/S2AttrDecode()
 + *      .../S2ConvertAttrsHints()
 + */
 +static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
 +{
 +    uint8_t hiattr = extract32(s2attrs, 2, 2);
 +    uint8_t loattr = extract32(s2attrs, 0, 2);
 +    uint8_t hihint = 0, lohint = 0;
 +
 +    if (hiattr != 0) { /* normal memory */
 +        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
 +            hiattr = loattr = 1; /* non-cacheable */
 +        } else {
 +            if (hiattr != 1) { /* Write-through or write-back */
 +                hihint = 3; /* RW allocate */
 +            }
 +            if (loattr != 1) { /* Write-through or write-back */
 +                lohint = 3; /* RW allocate */
 +            }
 +        }
 +    }
 +
 +    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
 +}
 +
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
 -                               ARMMMUFaultInfo *fi)
 +                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+     TCGv_i32 tmp;
-     CPUState *cs = CPU(cpu);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-          */
+     return true;
          txattrs->secure = false;
      }
 +
 +    if (cacheattrs != NULL) {
 +        if (mmu_idx == ARMMMUIdx_S2NS) {
 +            cacheattrs->attrs = convert_stage2_attrs(env,
 +                                                     extract32(attrs, 0, 4));
 +        } else {
 +            /* Index into MAIR registers for cache attributes */
 +            uint8_t attrindx = extract32(attrs, 0, 3);
 +            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
 +            assert(attrindx <= 7);
 +            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
 +        }
 +        cacheattrs->shareability = extract32(attrs, 6, 2);
 +    }
 +
      *phys_ptr = descaddr;
      *page_size_ptr = page_size;
      return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
      return false;
  }
-+/* Combine either inner or outer cacheability attributes for normal
+-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-+ * memory, according to table D4-42 and pseudocode procedure
++static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
 + * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
 + *
 + * NB: only stage 1 includes allocation hints (RW bits), leading to
 + * some asymmetry.
 + */
 +static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
 +{
 +    if (s1 == 4 || s2 == 4) {
 +        /* non-cacheable has precedence */
 +        return 4;
 +    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
 +        /* stage 1 write-through takes precedence */
 +        return s1;
 +    } else if (extract32(s2, 2, 2) == 2) {
 +        /* stage 2 write-through takes precedence, but the allocation hint
 +         * is still taken from stage 1
 +         */
 +        return (2 << 2) | extract32(s1, 0, 2);
 +    } else { /* write-back */
 +        return s1;
 +    }
 +}
 +
 +/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
 + * and CombineS1S2Desc()
 + *
 + * @s1:      Attributes from stage 1 walk
 + * @s2:      Attributes from stage 2 walk
 + */
 +static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
 +{
 +    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
 +    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
 +    ARMCacheAttrs ret;
 +
 +    /* Combine shareability attributes (table D4-43) */
 +    if (s1.shareability == 2 || s2.shareability == 2) {
 +        /* if either are outer-shareable, the result is outer-shareable */
 +        ret.shareability = 2;
 +    } else if (s1.shareability == 3 || s2.shareability == 3) {
 +        /* if either are inner-shareable, the result is inner-shareable */
 +        ret.shareability = 3;
 +    } else {
 +        /* both non-shareable */
 +        ret.shareability = 0;
 +    }
 +
 +    /* Combine memory type and cacheability attributes */
 +    if (s1hi == 0 || s2hi == 0) {
 +        /* Device has precedence over normal */
 +        if (s1lo == 0 || s2lo == 0) {
 +            /* nGnRnE has precedence over anything */
 +            ret.attrs = 0;
 +        } else if (s1lo == 4 || s2lo == 4) {
 +            /* non-Reordering has precedence over Reordering */
 +            ret.attrs = 4;  /* nGnRE */
 +        } else if (s1lo == 8 || s2lo == 8) {
 +            /* non-Gathering has precedence over Gathering */
 +            ret.attrs = 8;  /* nGRE */
 +        } else {
 +            ret.attrs = 0xc; /* GRE */
 +        }
 +
 +        /* Any location for which the resultant memory type is any
 +         * type of Device memory is always treated as Outer Shareable.
 +         */
 +        ret.shareability = 2;
 +    } else { /* Normal memory */
 +        /* Outer/inner cacheability combine independently */
 +        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
 +                  | combine_cacheattr_nibble(s1lo, s2lo);
 +
 +        if (ret.attrs == 0x44) {
 +            /* Any location for which the resultant memory type is Normal
 +             * Inner Non-cacheable, Outer Non-cacheable is always treated
 +             * as Outer Shareable.
 +             */
 +            ret.shareability = 2;
 +        }
 +    }
 +
 +    return ret;
 +}
 +
 +
  /* get_phys_addr - get the physical address for this virtual address
   *
   * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
   * @prot: set to the permissions for the page containing phys_ptr
   * @page_size: set to the size of the page containing phys_ptr
   * @fsr: set to the DFSR/IFSR value on failure
 + * @fi: set to fault info if the translation fails
 + * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
   */
  static bool get_phys_addr(CPUARMState *env, target_ulong address,
                            MMUAccessType access_type, ARMMMUIdx mmu_idx,
                            hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                            target_ulong *page_size, uint32_t *fsr,
 -                          ARMMMUFaultInfo *fi)
 +                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
  {
-     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
+     uint32_t offset;
-         /* Call ourselves recursively to do the stage 1 and then stage 2
+     TCGv_i32 addr;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-             hwaddr ipa;
+     tcg_temp_free_i64(tmp);
-             int s2_prot;
+ }
-             int ret;
-+            ARMCacheAttrs cacheattrs2 = {};
+-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
++static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
-             ret = get_phys_addr(env, address, access_type,
+ {
-                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
+     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
--                                prot, page_size, fsr, fi);
+ }
-+                                prot, page_size, fsr, fi, cacheattrs);
+@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+     tcg_temp_free_i64(tmp);
-             /* If S1 fails or S2 is disabled, return early.  */
+ }
-             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
+-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
-             /* S1 is done. Now do S2 translation.  */
++static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
-             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
+ {
-                                      phys_ptr, attrs, &s2_prot,
+     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
--                                     page_size, fsr, fi);
+ }
-+                                     page_size, fsr, fi,
+@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
+     tcg_temp_free_i64(tmp);
-             fi->s2addr = ipa;
+ }
-             /* Combine the S1 and S2 perms.  */
-             *prot &= s2_prot;
+-static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
-+
++static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
-+            /* Combine the S1 and S2 cache attributes, if needed */
+ {
-+            if (!ret && cacheattrs != NULL) {
+     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
-+                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+ }
-+            }
+@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+
+     tcg_temp_free_i64(tmp);
-             return ret;
+ }
-         } else {
-             /*
+-static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
++static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
+ {
-     if (regime_using_lpae_format(env, mmu_idx)) {
+     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
-         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
+ }
--                                  attrs, prot, page_size, fsr, fi);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
-+                                  attrs, prot, page_size, fsr, fi, cacheattrs);
+     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
-     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
+ }
-         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
-                                 attrs, prot, page_size, fsr, fi);
+-static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
-@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
++static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
+ {
-     ret = get_phys_addr(env, address, access_type,
+     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
-                         core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
+ }
--                        &attrs, &prot, &page_size, fsr, fi);
+@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+                        &attrs, &prot, &page_size, fsr, fi, NULL);
+     gen_helper_vfp_negd(vd, vd);
-     if (!ret) {
+ }
-         /* Map a single [sub]page.  */
-         phys_addr &= TARGET_PAGE_MASK;
+-static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
++static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
-     *attrs = (MemTxAttrs) {};
+ {
+     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
-     ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
+ }
--                        attrs, &prot, &page_size, &fsr, &fi);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
-+                        attrs, &prot, &page_size, &fsr, &fi, NULL);
+     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
+ }
-     if (ret) {
-         return -1;
+-static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
 +static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
 +static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
 +static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
      return true;
  }
 -static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
 +static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
  {
      /*
       * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
      return true;
  }
 -static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
 +static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
      return true;
  }
 -static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
 +static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 --
-.7.4
+.20.1

-New patch
+[Qemu-devel] [PULL 24/24] target/arm: Only implement doubles if the FPU supports them
+The architecture permits FPUs which have only single-precision
 support, not double-precision; Cortex-M4 and Cortex-M33 are
 both like that. Add the necessary checks on the MVFR0 FPDP
 field so that we UNDEF any double-precision instructions on
 CPUs like this.
 Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
 VLDM/VSTM, VLDR/VSTR which take double precision registers
 still exist.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
 ---
  target/arm/cpu.h               |  6 +++
  target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
 files changed, 90 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
      return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
  }
 +static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
 +{
 +    /* Return true if CPU supports double precision floating point */
 +    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
 +}
 +
  /*
   * We always set the FP and SIMD FP16 fields to indicate identical
   * levels of support (assuming SIMD is implemented at all), so
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          ((a->vm | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
      if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

A small set of arm bugfixes for rc0.

The following changes since commit 5853e92207193e967abf5e4c25b4a551c7604725:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-cocoa-20171107' into staging (2017-11-07 12:19:48 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171107

for you to fetch changes up to 8a7348b5d62d7ea16807e6bea54b448a0184bb0f:

hw/intc/arm_gicv3_its: Don't abort on table save failure (2017-11-07 13:03:52 +0000)

----------------------------------------------------------------
target-arm queue:
 * arm_gicv3_its: Don't abort on table save failure
 * arm_gicv3_its: Fix the VM termination in vm_change_state_handler()
 * translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD
 * hw/arm: Mark the "fsl,imx31/25/6" devices with user_creatable = false
 * arm: implement cache/shareability attribute bits for PAR registers

----------------------------------------------------------------
Andrew Baumann (1):
      arm: implement cache/shareability attribute bits for PAR registers

Eric Auger (1):
      hw/intc/arm_gicv3_its: Don't abort on table save failure

Peter Maydell (1):
      translate.c: Fix usermode big-endian AArch32 LDREXD and STREXD

Shanker Donthineni (1):
      hw/intc/arm_gicv3_its: Fix the VM termination in vm_change_state_handler()

Thomas Huth (3):
      hw/arm: Mark the "fsl,imx6" device with user_creatable = false
      hw/arm: Mark the "fsl,imx25" device with user_creatable = false
      hw/arm: Mark the "fsl,imx31" device with user_creatable = false

From: Andrew Baumann <Andrew.Baumann@microsoft.com>

On a successful address translation instruction, PAR is supposed to
contain cacheability and shareability attributes determined by the
translation. We previously returned 0 for these bits (in line with the
general strategy of ignoring caches and memory attributes), but some
guest OSes may depend on them.

This patch collects the attribute bits in the page-table walk, and
updates PAR with the correct attributes for all LPAE translations.
Short descriptor formats still return 0 for these bits, as in the
prior implementation.

Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Message-id: 20171031223830.4608-1-Andrew.Baumann@microsoft.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 178 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 164 insertions(+), 14 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
 
 #ifndef CONFIG_USER_ONLY
+/* Cacheability and shareability attributes for a memory access */
+typedef struct ARMCacheAttrs {
+    unsigned int attrs:8; /* as in the MAIR register encoding */
+    unsigned int shareability:2; /* as in the SH field of the VMSAv8-64 PTEs */
+} ARMCacheAttrs;
+
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi);
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi);
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
 
 /* Security attributes for an address, as returned by v8m_security_lookup. */
 typedef struct V8M_SAttributes {
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
     uint64_t par64;
     MemTxAttrs attrs = {};
     ARMMMUFaultInfo fi = {};
+    ARMCacheAttrs cacheattrs = {};
 
-    ret = get_phys_addr(env, value, access_type, mmu_idx,
-                        &phys_addr, &attrs, &prot, &page_size, &fsr, &fi);
+    ret = get_phys_addr(env, value, access_type, mmu_idx, &phys_addr, &attrs,
+                        &prot, &page_size, &fsr, &fi, &cacheattrs);
     if (extended_addresses_enabled(env)) {
         /* fsr is a DFSR/IFSR value for the long descriptor
          * translation table format, but with WnR always clear.
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
             if (!attrs.secure) {
                 par64 |= (1 << 9); /* NS */
             }
-            /* We don't set the ATTR or SH fields in the PAR. */
+            par64 |= (uint64_t)cacheattrs.attrs << 56; /* ATTR */
+            par64 |= cacheattrs.shareability << 7; /* SH */
         } else {
             par64 |= 1; /* F */
             par64 |= (fsr & 0x3f) << 1; /* FS */
@@ -XXX,XX +XXX,XX @@ static bool v7m_read_half_insn(ARMCPU *cpu, ARMMMUIdx mmu_idx,
         return false;
     }
     if (get_phys_addr(env, addr, MMU_INST_FETCH, mmu_idx,
-                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi)) {
+                      &physaddr, &attrs, &prot, &page_size, &fsr, &fi, NULL)) {
         /* the MPU lookup failed */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_IACCVIOL_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_MEM, env->v7m.secure);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         int ret;
 
         ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_S2NS, &s2pa,
-                                 &txattrs, &s2prot, &s2size, fsr, fi);
+                                 &txattrs, &s2prot, &s2size, fsr, fi, NULL);
         if (ret) {
             fi->s2addr = addr;
             fi->stage2 = true;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
     return true;
 }
 
+/* Translate from the 4-bit stage 2 representation of
+ * memory attributes (without cache-allocation hints) to
+ * the 8-bit representation of the stage 1 MAIR registers
+ * (which includes allocation hints).
+ *
+ * ref: shared/translation/attrs/S2AttrDecode()
+ *      .../S2ConvertAttrsHints()
+ */
+static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
+{
+    uint8_t hiattr = extract32(s2attrs, 2, 2);
+    uint8_t loattr = extract32(s2attrs, 0, 2);
+    uint8_t hihint = 0, lohint = 0;
+
+    if (hiattr != 0) { /* normal memory */
+        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
+            hiattr = loattr = 1; /* non-cacheable */
+        } else {
+            if (hiattr != 1) { /* Write-through or write-back */
+                hihint = 3; /* RW allocate */
+            }
+            if (loattr != 1) { /* Write-through or write-back */
+                lohint = 3; /* RW allocate */
+            }
+        }
+    }
+
+    return (hiattr << 6) | (hihint << 4) | (loattr << 2) | lohint;
+}
+
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr, uint32_t *fsr,
-                               ARMMMUFaultInfo *fi)
+                               ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
          */
         txattrs->secure = false;
     }
+
+    if (cacheattrs != NULL) {
+        if (mmu_idx == ARMMMUIdx_S2NS) {
+            cacheattrs->attrs = convert_stage2_attrs(env,
+                                                     extract32(attrs, 0, 4));
+        } else {
+            /* Index into MAIR registers for cache attributes */
+            uint8_t attrindx = extract32(attrs, 0, 3);
+            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
+            assert(attrindx <= 7);
+            cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
+        }
+        cacheattrs->shareability = extract32(attrs, 6, 2);
+    }
+
     *phys_ptr = descaddr;
     *page_size_ptr = page_size;
     return false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
     return false;
 }
 
+/* Combine either inner or outer cacheability attributes for normal
+ * memory, according to table D4-42 and pseudocode procedure
+ * CombineS1S2AttrHints() of ARM DDI 0487B.b (the ARMv8 ARM).
+ *
+ * NB: only stage 1 includes allocation hints (RW bits), leading to
+ * some asymmetry.
+ */
+static uint8_t combine_cacheattr_nibble(uint8_t s1, uint8_t s2)
+{
+    if (s1 == 4 || s2 == 4) {
+        /* non-cacheable has precedence */
+        return 4;
+    } else if (extract32(s1, 2, 2) == 0 || extract32(s1, 2, 2) == 2) {
+        /* stage 1 write-through takes precedence */
+        return s1;
+    } else if (extract32(s2, 2, 2) == 2) {
+        /* stage 2 write-through takes precedence, but the allocation hint
+         * is still taken from stage 1
+         */
+        return (2 << 2) | extract32(s1, 0, 2);
+    } else { /* write-back */
+        return s1;
+    }
+}
+
+/* Combine S1 and S2 cacheability/shareability attributes, per D4.5.4
+ * and CombineS1S2Desc()
+ *
+ * @s1:      Attributes from stage 1 walk
+ * @s2:      Attributes from stage 2 walk
+ */
+static ARMCacheAttrs combine_cacheattrs(ARMCacheAttrs s1, ARMCacheAttrs s2)
+{
+    uint8_t s1lo = extract32(s1.attrs, 0, 4), s2lo = extract32(s2.attrs, 0, 4);
+    uint8_t s1hi = extract32(s1.attrs, 4, 4), s2hi = extract32(s2.attrs, 4, 4);
+    ARMCacheAttrs ret;
+
+    /* Combine shareability attributes (table D4-43) */
+    if (s1.shareability == 2 || s2.shareability == 2) {
+        /* if either are outer-shareable, the result is outer-shareable */
+        ret.shareability = 2;
+    } else if (s1.shareability == 3 || s2.shareability == 3) {
+        /* if either are inner-shareable, the result is inner-shareable */
+        ret.shareability = 3;
+    } else {
+        /* both non-shareable */
+        ret.shareability = 0;
+    }
+
+    /* Combine memory type and cacheability attributes */
+    if (s1hi == 0 || s2hi == 0) {
+        /* Device has precedence over normal */
+        if (s1lo == 0 || s2lo == 0) {
+            /* nGnRnE has precedence over anything */
+            ret.attrs = 0;
+        } else if (s1lo == 4 || s2lo == 4) {
+            /* non-Reordering has precedence over Reordering */
+            ret.attrs = 4;  /* nGnRE */
+        } else if (s1lo == 8 || s2lo == 8) {
+            /* non-Gathering has precedence over Gathering */
+            ret.attrs = 8;  /* nGRE */
+        } else {
+            ret.attrs = 0xc; /* GRE */
+        }
+
+        /* Any location for which the resultant memory type is any
+         * type of Device memory is always treated as Outer Shareable.
+         */
+        ret.shareability = 2;
+    } else { /* Normal memory */
+        /* Outer/inner cacheability combine independently */
+        ret.attrs = combine_cacheattr_nibble(s1hi, s2hi) << 4
+                  | combine_cacheattr_nibble(s1lo, s2lo);
+
+        if (ret.attrs == 0x44) {
+            /* Any location for which the resultant memory type is Normal
+             * Inner Non-cacheable, Outer Non-cacheable is always treated
+             * as Outer Shareable.
+             */
+            ret.shareability = 2;
+        }
+    }
+
+    return ret;
+}
+
+
 /* get_phys_addr - get the physical address for this virtual address
  *
  * Find the physical address corresponding to the given virtual address,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav5(CPUARMState *env, uint32_t address,
  * @prot: set to the permissions for the page containing phys_ptr
  * @page_size: set to the size of the page containing phys_ptr
  * @fsr: set to the DFSR/IFSR value on failure
+ * @fi: set to fault info if the translation fails
+ * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
  */
 static bool get_phys_addr(CPUARMState *env, target_ulong address,
                           MMUAccessType access_type, ARMMMUIdx mmu_idx,
                           hwaddr *phys_ptr, MemTxAttrs *attrs, int *prot,
                           target_ulong *page_size, uint32_t *fsr,
-                          ARMMMUFaultInfo *fi)
+                          ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
     if (mmu_idx == ARMMMUIdx_S12NSE0 || mmu_idx == ARMMMUIdx_S12NSE1) {
         /* Call ourselves recursively to do the stage 1 and then stage 2
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            ARMCacheAttrs cacheattrs2 = {};
 
             ret = get_phys_addr(env, address, access_type,
                                 stage_1_mmu_idx(mmu_idx), &ipa, attrs,
-                                prot, page_size, fsr, fi);
+                                prot, page_size, fsr, fi, cacheattrs);
 
             /* If S1 fails or S2 is disabled, return early.  */
             if (ret || regime_translation_disabled(env, ARMMMUIdx_S2NS)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
             /* S1 is done. Now do S2 translation.  */
             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_S2NS,
                                      phys_ptr, attrs, &s2_prot,
-                                     page_size, fsr, fi);
+                                     page_size, fsr, fi,
+                                     cacheattrs != NULL ? &cacheattrs2 : NULL);
             fi->s2addr = ipa;
             /* Combine the S1 and S2 perms.  */
             *prot &= s2_prot;
+
+            /* Combine the S1 and S2 cache attributes, if needed */
+            if (!ret && cacheattrs != NULL) {
+                *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+            }
+
             return ret;
         } else {
             /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
 
     if (regime_using_lpae_format(env, mmu_idx)) {
         return get_phys_addr_lpae(env, address, access_type, mmu_idx, phys_ptr,
-                                  attrs, prot, page_size, fsr, fi);
+                                  attrs, prot, page_size, fsr, fi, cacheattrs);
     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, address, access_type, mmu_idx, phys_ptr,
                                 attrs, prot, page_size, fsr, fi);
@@ -XXX,XX +XXX,XX @@ bool arm_tlb_fill(CPUState *cs, vaddr address,
 
     ret = get_phys_addr(env, address, access_type,
                         core_to_arm_mmu_idx(env, mmu_idx), &phys_addr,
-                        &attrs, &prot, &page_size, fsr, fi);
+                        &attrs, &prot, &page_size, fsr, fi, NULL);
     if (!ret) {
         /* Map a single [sub]page.  */
         phys_addr &= TARGET_PAGE_MASK;
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
     *attrs = (MemTxAttrs) {};
 
     ret = get_phys_addr(env, addr, 0, mmu_idx, &phys_addr,
-                        attrs, &prot, &page_size, &fsr, &fi);
+                        attrs, &prot, &page_size, &fsr, &fi, NULL);
 
     if (ret) {
         return -1;
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

This device causes QEMU to abort if the user tries to instantiate it:

$ qemu-system-aarch64 -M sabrelite -smp 1,maxcpus=2 -device fsl,,imx6
Unexpected error in qemu_chr_fe_init() at chardev/char-fe.c:222:
qemu-system-aarch64: -device fsl,,imx6: Device 'serial0' is in use
Aborted (core dumped)

The device uses serial_hds[] directly in its realize function, so it
can not be instantiated again by the user.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-2-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx6_realize;
-
     dc->desc = "i.MX6 SOC";
+    /* Reason: Uses serial_hds[] in the realize() function */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx6_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx25
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -S -M imx25-pdk -device fsl,,imx25
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)

The imx25-pdk board (which is the one that uses this CPU type) only
supports one CPU, and the realize function of the "fsl,imx25" device
also uses serial_hds[] directly, so this device clearly can not be
instantiated twice and thus we should mark it with user_creatable = 0.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-3-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx25.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx25.c b/hw/arm/fsl-imx25.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx25.c
+++ b/hw/arm/fsl-imx25.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx25_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx25_realize;
-
     dc->desc = "i.MX25 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the imx25 board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx25_type_info = {
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU currently crashes when the user tries to instantiate the fsl,imx31
device manually:

$ aarch64-softmmu/qemu-system-aarch64 -M kzm -device fsl,,imx31
**
ERROR:/home/thuth/devel/qemu/tcg/tcg.c:538:tcg_register_thread:
 assertion failed: (n < max_cpus)
Aborted (core dumped)

The kzm board (which is the one that uses this CPU type) only supports
one CPU, and the realize function of the "fsl,imx31" device also uses
serial_hds[] directly, so this device clearly can not be instantiated
twice and thus we should mark it with user_creatable = false.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1509519537-6964-4-git-send-email-thuth@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/fsl-imx31.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/arm/fsl-imx31.c b/hw/arm/fsl-imx31.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx31.c
+++ b/hw/arm/fsl-imx31.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx31_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
 
     dc->realize = fsl_imx31_realize;
-
     dc->desc = "i.MX31 SOC";
+    /*
+     * Reason: uses serial_hds in realize and the kzm board does not
+     * support multiple CPUs
+     */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo fsl_imx31_type_info = {
-- 
2.7.4

For AArch32 LDREXD and STREXD, architecturally the 32-bit word at the
lowest address is always Rt and the one at addr+4 is Rt2, even if the
CPU is big-endian. Our implementation does these with a single
64-bit store, so if we're big-endian then we need to put the two
32-bit halves together in the opposite order to little-endian,
so that they end up in the right places. We were trying to do
this with the gen_aa32_frob64() function, but that is not correct
for the usermode emulator, because there there is a distinction
between "load a 64 bit value" (which does a BE 64-bit access
and doesn't need swapping) and "load two 32 bit values as one
64 bit access" (where we still need to do the swapping, like
system mode BE32).

Fixes: https://bugs.launchpad.net/qemu/+bug/1725267
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1509622400-13351-1-git-send-email-peter.maydell@linaro.org
---
 target/arm/translate.c | 39 ++++++++++++++++++++++++++++++++++-----
 1 file changed, 34 insertions(+), 5 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_load_exclusive(DisasContext *s, int rt, int rt2,
         TCGv_i32 tmp2 = tcg_temp_new_i32();
         TCGv_i64 t64 = tcg_temp_new_i64();
 
-        gen_aa32_ld_i64(s, t64, addr, get_mem_index(s), opc);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. That means we don't want to do a
+         * gen_aa32_ld_i64(), which invokes gen_aa32_frob64() as if
+         * for an architecturally 64-bit access, but instead do a
+         * 64-bit access using MO_BE if appropriate and then split
+         * the two halves.
+         * This only makes a difference for BE32 user-mode, where
+         * frob64() must not flip the two halves of the 64-bit data
+         * but this code must treat BE32 user-mode like BE32 system.
+         */
+        TCGv taddr = gen_aa32_addr(s, addr, opc);
+
+        tcg_gen_qemu_ld_i64(t64, taddr, get_mem_index(s), opc);
+        tcg_temp_free(taddr);
         tcg_gen_mov_i64(cpu_exclusive_val, t64);
-        tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        if (s->be_data == MO_BE) {
+            tcg_gen_extr_i64_i32(tmp2, tmp, t64);
+        } else {
+            tcg_gen_extr_i64_i32(tmp, tmp2, t64);
+        }
         tcg_temp_free_i64(t64);
 
         store_reg(s, rt2, tmp2);
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         TCGv_i64 n64 = tcg_temp_new_i64();
 
         t2 = load_reg(s, rt2);
-        tcg_gen_concat_i32_i64(n64, t1, t2);
+        /* For AArch32, architecturally the 32-bit word at the lowest
+         * address is always Rt and the one at addr+4 is Rt2, even if
+         * the CPU is big-endian. Since we're going to treat this as a
+         * single 64-bit BE store, we need to put the two halves in the
+         * opposite order for BE to LE, so that they end up in the right
+         * places.
+         * We don't want gen_aa32_frob64() because that does the wrong
+         * thing for BE32 usermode.
+         */
+        if (s->be_data == MO_BE) {
+            tcg_gen_concat_i32_i64(n64, t2, t1);
+        } else {
+            tcg_gen_concat_i32_i64(n64, t1, t2);
+        }
         tcg_temp_free_i32(t2);
-        gen_aa32_frob64(s, n64);
 
         tcg_gen_atomic_cmpxchg_i64(o64, taddr, cpu_exclusive_val, n64,
                                    get_mem_index(s), opc);
         tcg_temp_free_i64(n64);
 
-        gen_aa32_frob64(s, o64);
         tcg_gen_setcond_i64(TCG_COND_NE, o64, o64, cpu_exclusive_val);
         tcg_gen_extrl_i64_i32(t0, o64);
 
-- 
2.7.4

From: Shanker Donthineni <shankerd@codeaurora.org>

The commit cddafd8f353d ("hw/intc/arm_gicv3_its: Implement state save
/restore") breaks the backward compatibility with the older kernels
where vITS save/restore support is not available. The vmstate function
vm_change_state_handler() should not be registered if the running kernel
doesn't support ITS save/restore feature. Otherwise VM instance will be
killed whenever vmstate callback function is invoked.

Observed a virtual machine shutdown with QEMU-2.10+linux-4.11 when testing
the reboot command "virsh reboot <domain> --mode acpi" instead of reboot.

KVM Error: 'KVM_SET_DEVICE_ATTR failed: Group 4 attr 0x00000000000001'

Signed-off-by: Shanker Donthineni <shankerd@codeaurora.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1509712671-16299-1-git-send-email-shankerd@codeaurora.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
             error_free(s->migration_blocker);
             return;
         }
+    } else {
+        qemu_add_vm_change_state_handler(vm_change_state_handler, s);
     }
 
     kvm_msi_use_devid = true;
     kvm_gsi_direct_mapping = false;
     kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
-
-    qemu_add_vm_change_state_handler(vm_change_state_handler, s);
 }
 
 /**
-- 
2.7.4

From: Eric Auger <eric.auger@redhat.com>

The ITS is not fully properly reset at the moment. Caches are
not emptied.

After a reset, in case we attempt to save the state before
the bound devices have registered their MSIs and after the
1st level table has been allocated by the ITS driver
(device BASER is valid), the first level entries are still
invalid. If the device cache is not empty (devices registered
before the reset), vgic_its_save_device_tables fails with -EINVAL.
This causes a QEMU abort().

Cc: qemu-stable@nongnu.org
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: wanghaibin <wanghaibin.wang@huawei.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its_kvm.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void vm_change_state_handler(void *opaque, int running,
 {
     GICv3ITSState *s = (GICv3ITSState *)opaque;
     Error *err = NULL;
-    int ret;
 
     if (running) {
         return;
     }
 
-    ret = kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
-                            KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
+    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                      KVM_DEV_ARM_ITS_SAVE_TABLES, NULL, true, &err);
     if (err) {
         error_report_err(err);
     }
-    if (ret < 0 && ret != -EFAULT) {
-        abort();
-    }
 }
 
 static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
-- 
2.7.4

Latest arm queue, half minor code cleanups and half minor
bug fixes.

-- PMM

The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617

for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:

target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)

----------------------------------------------------------------
target-arm queue:
 * support large kernel images in bootloader (by avoiding
   putting the initrd over the top of them)
 * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
 * arm_gicv3: Fix decoding of ID register range
 * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
 * some code cleanups following on from the VFP decodetree conversion
 * Only implement doubles if the FPU supports them
   (so we now correctly model Cortex-M4, -M33 as single precision only)

----------------------------------------------------------------
Peter Maydell (24):
      hw/arm/boot: Don't assume RAM starts at address zero
      hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
      hw/arm/boot: Avoid placing the initrd on top of the kernel
      hw/arm/boot: Honour image size field in AArch64 Image format kernels
      target/arm: Allow VFP and Neon to be disabled via a CPU property
      target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
      hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
      hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
      hw/intc/arm_gicv3: Fix decoding of ID register range
      hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
      target/arm: Move vfp_expand_imm() to translate.[ch]
      target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
      target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
      target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
      target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
      target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
      target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
      target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
      target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
      target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
      target/arm: Fix typos in trans function prototypes
      target/arm: Only implement doubles if the FPU supports them

In the Arm kernel/initrd loading code, in some places we make the
incorrect assumption that info->ram_size can be treated as the
address of the end of RAM, as for instance when we calculate the
available space for the initrd using "info->ram_size - info->initrd_start".
This is wrong, because many Arm boards (including "virt") specify
a non-zero info->loader_start to indicate that their RAM area
starts at a non-zero physical address.

Correct the places which make this incorrect assumption.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
+    uint64_t ram_end = info->loader_start + info->ram_size;
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         primary_loader = bootloader_aarch64;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
-                                             info->ram_size - KERNEL_LOAD_ADDR,
-                                             as);
+                                             ram_end - KERNEL_LOAD_ADDR, as);
         is_linux = 1;
     }
     if (kernel_size < 0) {
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         if (info->initrd_filename) {
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
-                                          info->ram_size - info->initrd_start,
-                                          as);
+                                          ram_end - info->initrd_start, as);
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys_as(info->initrd_filename,
                                                      info->initrd_start,
-                                                     info->ram_size -
+                                                     ram_end -
                                                      info->initrd_start,
                                                      as);
             }
-- 
2.20.1

We calculate the locations in memory where we want to put the
initrd and the DTB based on the size of the kernel, since they
come after it. Add some explicit checks that these aren't off the
end of RAM entirely.

(At the moment the way we calculate the initrd_start means that
it can't ever be off the end of RAM, but that will change with
the next commit.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         error_report("could not load kernel '%s'", info->kernel_filename);
         exit(1);
     }
+
+    if (kernel_size > info->ram_size) {
+        error_report("kernel '%s' is too large to fit in RAM "
+                     "(kernel size %d, RAM size %" PRId64 ")",
+                     info->kernel_filename, kernel_size, info->ram_size);
+        exit(1);
+    }
+
     info->entry = entry;
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
         if (info->initrd_filename) {
+
+            if (info->initrd_start >= ram_end) {
+                error_report("not enough space after kernel to load initrd");
+                exit(1);
+            }
+
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
                                           ram_end - info->initrd_start, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                              info->initrd_filename);
                 exit(1);
             }
+            if (info->initrd_start + initrd_size > info->ram_size) {
+                error_report("could not load initrd '%s': "
+                             "too big to fit into RAM after the kernel",
+                             info->initrd_filename);
+            }
         } else {
             initrd_size = 0;
         }
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
             /* Place the DTB after the initrd in memory with alignment. */
             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
                                            align);
+            if (info->dtb_start >= ram_end) {
+                error_report("Not enough space for DTB after kernel/initrd");
+                exit(1);
+            }
             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
         } else {
-- 
2.20.1

We currently put the initrd at the smaller of:
 * 128MB into RAM
 * halfway into the RAM
(with the dtb following it).

However for large kernels this might mean that the kernel
overlaps the initrd. For some kinds of kernel (self-decompressing
32-bit kernels, and ELF images with a BSS section at the end)
we don't know the exact size, but even there we have a
minimum size. Put the initrd at least further into RAM than
that. For image formats that can give us an exact kernel size, this
will mean that we definitely avoid overlaying kernel and initrd.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     if (info->nb_cpus == 0)
         info->nb_cpus = 1;
 
-    /*
-     * We want to put the initrd far enough into RAM that when the
-     * kernel is uncompressed it will not clobber the initrd. However
-     * on boards without much RAM we must ensure that we still leave
-     * enough room for a decent sized initrd, and on boards with large
-     * amounts of RAM we must avoid the initrd being so far up in RAM
-     * that it is outside lowmem and inaccessible to the kernel.
-     * So for boards with less  than 256MB of RAM we put the initrd
-     * halfway into RAM, and for boards with 256MB of RAM or more we put
-     * the initrd at 128MB.
-     */
-    info->initrd_start = info->loader_start +
-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
-
     /* Assume that raw images are linux kernels, and ELF images are not.  */
     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
                                &elf_high_addr, elf_machine, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
 
     info->entry = entry;
+
+    /*
+     * We want to put the initrd far enough into RAM that when the
+     * kernel is uncompressed it will not clobber the initrd. However
+     * on boards without much RAM we must ensure that we still leave
+     * enough room for a decent sized initrd, and on boards with large
+     * amounts of RAM we must avoid the initrd being so far up in RAM
+     * that it is outside lowmem and inaccessible to the kernel.
+     * So for boards with less  than 256MB of RAM we put the initrd
+     * halfway into RAM, and for boards with 256MB of RAM or more we put
+     * the initrd at 128MB.
+     * We also refuse to put the initrd somewhere that will definitely
+     * overlay the kernel we just loaded, though for kernel formats which
+     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
+     * we might still make a bad choice here.
+     */
+    info->initrd_start = info->loader_start +
+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
+
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
-- 
2.20.1

Since Linux v3.17, the kernel's Image header includes a field image_size,
which gives the total size of the kernel including unpopulated data
sections such as the BSS). If this is present, then return it from
load_aarch64_image() as the true size of the kernel rather than
just using the size of the Image file itself. This allows the code
which calculates where to put the initrd to avoid putting it in
the kernel's BSS area.

This means that we should be able to reliably load kernel images
which are larger than 128MB without accidentally putting the
initrd or dtb in locations that clash with the kernel itself.

Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
---
 hw/arm/boot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
                                    hwaddr *entry, AddressSpace *as)
 {
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+    uint64_t kernel_size = 0;
     uint8_t *buffer;
     int size;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          * is only valid if the image_size is non-zero.
          */
         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
-        if (hdrvals[1] != 0) {
+
+        kernel_size = le64_to_cpu(hdrvals[1]);
+
+        if (kernel_size != 0) {
             kernel_load_offset = le64_to_cpu(hdrvals[0]);
 
             /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
         }
     }
 
+    /*
+     * Kernels before v3.17 don't populate the image_size field, and
+     * raw images have no header. For those our best guess at the size
+     * is the size of the Image file itself.
+     */
+    if (kernel_size == 0) {
+        kernel_size = size;
+    }
+
     *entry = mem_base + kernel_load_offset;
     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
 
     g_free(buffer);
 
-    return size;
+    return kernel_size;
 }
 
 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-- 
2.20.1

Allow VFP and neon to be disabled via a CPU property. As with
the "pmu" property, we only allow these features to be removed
from CPUs which have it by default, not added to CPUs which
don't have it.

The primary motivation here is to be able to optionally
create Cortex-M33 CPUs with no FPU, but we provide switches
for both VFP and Neon because the two interact:
 * AArch64 can't have one without the other
 * Some ID register fields only change if both are disabled

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
---
 target/arm/cpu.h |   4 ++
 target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 148 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_el3;
     /* CPU has PMU (Performance Monitor Unit) */
     bool has_pmu;
+    /* CPU has VFP */
+    bool has_vfp;
+    /* CPU has Neon */
+    bool has_neon;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
 static Property arm_cpu_has_pmu_property =
             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 
+static Property arm_cpu_has_vfp_property =
+            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
+
+static Property arm_cpu_has_neon_property =
+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
+    /* Similarly for the VFP feature bits */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP3);
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP);
+    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
+    /*
+     * Allow user to turn off VFP and Neon support, but only for TCG --
+     * KVM does not currently allow us to lie to the guest about its
+     * ID/feature registers, so the guest always sees what the host has.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        cpu->has_vfp = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
+                                     &error_abort);
+        }
+    }
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
+        cpu->has_neon = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
+                                     &error_abort);
+        }
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+        cpu->has_vfp != cpu->has_neon) {
+        /*
+         * This is an architectural requirement for AArch64; AArch32 is
+         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
+         */
+        error_setg(errp,
+                   "AArch64 CPUs must have both VFP and Neon or neither");
+        return;
+    }
+
+    if (!cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_VFP);
+        unset_feature(env, ARM_FEATURE_VFP3);
+        unset_feature(env, ARM_FEATURE_VFP4);
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, FPSP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDP, 0);
+        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
+        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
+        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
+        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
+        cpu->isar.mvfr0 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
+        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
+        u = FIELD_DP32(u, MVFR1, FPHP, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_NEON);
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar5;
+        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
+        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
+        cpu->isar.id_isar5 = u;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
+        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon && !cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
+        cpu->isar.mvfr0 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     if (arm_feature(env, ARM_FEATURE_V5)) {
         set_feature(env, ARM_FEATURE_V4T);
     }
-    if (arm_feature(env, ARM_FEATURE_VFP4)) {
-        set_feature(env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(env, ARM_FEATURE_VFP3)) {
-        set_feature(env, ARM_FEATURE_VFP);
-    }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
         set_feature(env, ARM_FEATURE_PXN);
-- 
2.20.1

Allow the DSP extension to be disabled via a CPU property for
M-profile CPUs. (A and R-profile CPUs don't have this extension
as a defined separate optional architecture extension, so
they don't need the property.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
---
 target/arm/cpu.h |  2 ++
 target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_vfp;
     /* CPU has Neon */
     bool has_neon;
+    /* CPU has M-profile DSP extension */
+    bool has_dsp;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
 static Property arm_cpu_has_neon_property =
             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 
+static Property arm_cpu_has_dsp_property =
+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
         }
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
+        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
+                                 &error_abort);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.mvfr0 = u;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
+
+        u = cpu->isar.id_isar1;
+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
+        cpu->isar.id_isar1 = u;
+
+        u = cpu->isar.id_isar2;
+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
+        cpu->isar.id_isar2 = u;
+
+        u = cpu->isar.id_isar3;
+        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
+        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
+        cpu->isar.id_isar3 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
-- 
2.20.1

Create "vfp" and "dsp" properties on the armv7m container object
which will be forwarded to its CPU object, so that SoCs can
configure whether the CPU has these features.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 ++++
 hw/arm/armv7m.c         | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  *   devices will be automatically layered on top of this view.)
  * + Property "idau": IDAU interface (forwarded to CPU object)
  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
+ * + Property "vfp": enable VFP (forwarded to CPU object)
+ * + Property "dsp": enable DSP (forwarded to CPU object)
  * + Property "enable-bitband": expose bitbanded IO
  */
 typedef struct ARMv7MState {
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     uint32_t init_svtor;
     bool enable_bitband;
     bool start_powered_off;
+    bool vfp;
+    bool dsp;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
+                                 "vfp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
+                                 "dsp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
 
     /*
      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
                      false),
+    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
+    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

The SSE-200 hardware has configurable integration settings which
determine whether its two CPUs have the FPU and DSP:
 * CPU0_FPU (default 0)
 * CPU0_DSP (default 0)
 * CPU1_FPU (default 1)
 * CPU1_DSP (default 1)

Similarly, the IoTKit has settings for its single CPU:
 * CPU0_FPU (default 1)
 * CPU0_DSP (default 1)

Of our four boards that use either the IoTKit or the SSE-200:
 * mps2-an505, mps2-an521 and musca-a use the default settings
 * musca-b1 enables FPU and DSP on both CPUs

Currently QEMU models all these boards using CPUs with
both FPU and DSP enabled. This means that we are incorrect
for mps2-an521 and musca-a, which should not have FPU or DSP
on CPU0.

Create QOM properties on the ARMSSE devices corresponding to the
default h/w integration settings, and make the Musca-B1 board
enable FPU and DSP on both CPUs. This fixes the mps2-an521
and musca-a behaviour, and leaves the musca-b1 and mps2-an505
behaviour unchanged.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h |  7 +++++
 hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
 hw/arm/musca.c          |  8 ++++++
 3 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *    address of each SRAM bank (and thus the total amount of internal SRAM)
  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
  *    (where it expects to load the PC and SP from the vector table on reset)
+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
+ *    set whether the CPUs have the FPU and DSP features present. The default
+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
  *    which are wired to its NVIC lines 32 .. n+32
  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
     uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
+    bool cpu_fpu[SSE_MAX_CPUS];
+    bool cpu_dsp[SSE_MAX_CPUS];
 } ARMSSE;
 
 typedef struct ARMSSEInfo ARMSSEInfo;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
     bool has_cachectrl;
     bool has_cpusecctrl;
     bool has_cpuid;
+    Property *props;
+};
+
+static Property iotkit_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static Property armsse_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
+    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
+    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
+    DEFINE_PROP_END_OF_LIST()
 };
 
 static const ARMSSEInfo armsse_variants[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = false,
         .has_cpusecctrl = false,
         .has_cpuid = false,
+        .props = iotkit_properties,
     },
     {
         .name = TYPE_SSE200,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = true,
         .has_cpusecctrl = true,
         .has_cpuid = true,
+        .props = armsse_properties,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 return;
             }
         }
+        if (!s->cpu_fpu[i]) {
+            object_property_set_bool(cpuobj, false, "vfp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
+        if (!s->cpu_dsp[i]) {
+            object_property_set_bool(cpuobj, false, "dsp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
 
         if (i > 0) {
             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
     }
 };
 
-static Property armsse_properties[] = {
-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-    DEFINE_PROP_END_OF_LIST()
-};
-
 static void armsse_reset(DeviceState *dev)
 {
     ARMSSE *s = ARMSSE(dev);
@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
     ARMSSEClass *asc = ARMSSE_CLASS(klass);
+    const ARMSSEInfo *info = data;
 
     dc->realize = armsse_realize;
     dc->vmsd = &armsse_vmstate;
-    dc->props = armsse_properties;
+    dc->props = info->props;
     dc->reset = armsse_reset;
     iic->check = armsse_idau_check;
-    asc->info = data;
+    asc->info = info;
 }
 
 static const TypeInfo armsse_info = {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    /*
+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+     */
+    if (mmc->type == MUSCA_B1) {
+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
+    }
     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
                              &error_fatal);
 
-- 
2.20.1

The GIC ID registers cover an area 0x30 bytes in size
(12 registers, 4 bytes each). We were incorrectly decoding
only the first 0x20 bytes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c   | 4 ++--
 hw/intc/arm_gicv3_redist.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
         }
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
         /* ID registers */
         *data = gicv3_idreg(offset - GICD_IDREGS);
         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
         gicd_write_irouter(s, attrs, irq, r);
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
     case GICD_TYPER:
     case GICD_IIDR:
         /* RO registers, ignore the write */
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
         }
         *data = cs->gicr_nsacr;
         return MEMTX_OK;
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         *data = gicv3_idreg(offset - GICR_IDREGS);
         return MEMTX_OK;
     default:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         return MEMTX_OK;
     case GICR_IIDR:
     case GICR_TYPER:
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         /* RO registers, ignore the write */
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest write to RO register at offset "
-- 
2.20.1

The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
if the security extension is unsupported. "Security extension
unsupported" always implies GICD_CTLR.DS == 1, but the guest can
also set DS on a GIC which does support the security extension.
Fix the condition to correctly check the GICD_CTLR.DS bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
          * ITLinesNumber == (num external irqs / 32) - 1
          */
         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+        /*
+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
+         * "security extensions not supported" always implies DS == 1,
+         * so we only need to check the DS bit.
+         */
+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
             (0xf << 19) | itlinesnumber;
         return MEMTX_OK;
     }
-- 
2.20.1

We want to use vfp_expand_imm() in the AArch32 VFP decode;
move it from the a64-only header/source file to the
AArch32 one (which is always compiled even for AArch64).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
---
 target/arm/translate-a64.h     |  1 -
 target/arm/translate.h         |  7 +++++++
 target/arm/translate-a64.c     | 32 --------------------------------
 target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 33 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
 TCGv_ptr get_fpstatus_ptr(bool);
 bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
                             unsigned int imms, unsigned int immr);
-uint64_t vfp_expand_imm(int size, uint8_t imm8);
 bool sve_access_check(DisasContext *s);
 
 /* We should have at some point before trying to access an FP register
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
+/*
+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
+ * instruction, expand it to the actual constant value of the specified
+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8);
+
 /* Vector operations shared between ARM and AArch64.  */
 extern const GVecGen3 mla_op[4];
 extern const GVecGen3 mls_op[4];
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
- */
-uint64_t vfp_expand_imm(int size, uint8_t imm8)
-{
-    uint64_t imm;
-
-    switch (size) {
-    case MO_64:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-        break;
-    case MO_32:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-        break;
-    case MO_16:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
-            (extract32(imm8, 0, 6) << 6);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    return imm;
-}
-
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.inc.c"
 #include "decode-vfp-uncond.inc.c"
 
+/*
+ * The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    case MO_16:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+            (extract32(imm8, 0, 6) << 6);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /*
  * Return the offset of a 16-bit half of the specified VFP single-precision
  * register. If top is true, returns the top 16 bits; otherwise the bottom
-- 
2.20.1

The AArch32 VMOV (immediate) instruction uses the same VFP encoded
immediate format we already handle in vfp_expand_imm().  Use that
function rather than hand-decoding it.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++------------------------
 target/arm/vfp.decode          | 10 ++++++----
 2 files changed, 10 insertions(+), 28 deletions(-)

Where Neon instructions are floating point operations, we
mostly use the old VFP utility functions like gen_vfp_abs()
which work on the TCG globals cpu_F0s and cpu_F1s. The
Neon for-each-element loop conditionally loads the inputs
into either a plain old TCG temporary for most operations
or into cpu_F0s for float operations, and similarly stores
back either cpu_F0s or the temporary.

Switch NEON_2RM_VABS_F away from using cpu_F0s, and
update neon_2rm_is_float_op() accordingly.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_abs(int dp)
-{
-    if (dp)
-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
-}
-
 static inline void gen_vfp_neg(int dp)
 {
     if (dp)
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 
 static int neon_2rm_is_float_op(int op)
 {
-    /* Return true if this neon 2reg-misc op is float-to-float */
-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
+    /*
+     * Return true if this neon 2reg-misc op is float-to-float.
+     * This is not a property of the operation but of our code --
+     * what we are asking here is "does the code for this case in
+     * the Neon for-each-pass loop use cpu_F0s?".
+     */
+    return (op == NEON_2RM_VNEG_F ||
             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VABS_F:
-                            gen_vfp_abs(0);
+                            gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
                             gen_vfp_neg(0);
-- 
2.20.1

Switch NEON_2RM_VABS_F away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_neg(int dp)
-{
-    if (dp)
-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
-}
-
 #define VFP_GEN_ITOF(name) \
 static inline void gen_vfp_##name(int dp, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return (op == NEON_2RM_VNEG_F ||
-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
-                            gen_vfp_neg(0);
+                            gen_helper_vfp_negs(tmp, tmp);
                             break;
                         case NEON_2RM_VSWP:
                             tmp2 = neon_load_reg(rd, pass);
-- 
2.20.1

Switch NEON_2RM_VRINT* away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-            op == NEON_2RM_VRINTM ||
-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
 }
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
-                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints(tmp, tmp, fpstatus);
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
                             tcg_temp_free_ptr(fpstatus);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRINTX:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-            op >= NEON_2RM_VRECPE_F);
+    return op >= NEON_2RM_VRECPE_F;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                                       cpu_env);
 
                             if (is_signed) {
-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_tosls(tmp, tmp,
                                                      tcg_shift, fpst);
                             } else {
-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_touls(tmp, tmp,
                                                      tcg_shift, fpst);
                             }
 
-- 
2.20.1

Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return op >= NEON_2RM_VRECPE_F;
+    return op >= NEON_2RM_VCVT_FS;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRECPE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
                         case NEON_2RM_VRSQRTE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
Since this is the last user of cpu_F0s in the Neon 2rm-op
loop, we can remove the handling code for it too.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_ITOF(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_ITOF(uito)
-VFP_GEN_ITOF(sito)
-#undef VFP_GEN_ITOF
-
-#define VFP_GEN_FTOI(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_FTOI(touiz)
-VFP_GEN_FTOI(tosiz)
-#undef VFP_GEN_FTOI
-
 #define VFP_GEN_FIX(name, round) \
 static inline void gen_vfp_##name(int dp, int shift, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 #define NEON_2RM_VCVT_SF 62
 #define NEON_2RM_VCVT_UF 63
 
-static int neon_2rm_is_float_op(int op)
-{
-    /*
-     * Return true if this neon 2reg-misc op is float-to-float.
-     * This is not a property of the operation but of our code --
-     * what we are asking here is "does the code for this case in
-     * the Neon for-each-pass loop use cpu_F0s?".
-     */
-    return op >= NEON_2RM_VCVT_FS;
-}
-
 static bool neon_2rm_is_v8_op(int op)
 {
     /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 default:
                 elementwise:
                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rm, pass));
-                            tmp = NULL;
-                        } else {
-                            tmp = neon_load_reg(rm, pass);
-                        }
+                        tmp = neon_load_reg(rm, pass);
                         switch (op) {
                         case NEON_2RM_VREV32:
                             switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
-                            gen_vfp_sito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
-                            gen_vfp_uito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
-                            gen_vfp_tosiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
-                            gen_vfp_touiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         default:
                             /* Reserved op values were caught by the
                              * neon_2rm_sizes[] check earlier.
                              */
                             abort();
                         }
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rd, pass));
-                        } else {
-                            neon_store_reg(rd, pass, tmp);
-                        }
+                        neon_store_reg(rd, pass, tmp);
                     }
                     break;
                 }
-- 
2.20.1

Stop using cpu_F0s in the Neon VCVT fixed-point operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
---
 target/arm/translate.c | 62 +++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
 /* Function prototypes for gen_ functions calling Neon helpers.  */
 typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
                                  TCGv_i32, TCGv_i32);
+/* Function prototypes for gen_ functions for fix point conversions */
+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_FIX(name, round) \
-static inline void gen_vfp_##name(int dp, int shift, int neon) \
-{ \
-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
-                                        statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
-                                        statusptr); \
-    } \
-    tcg_temp_free_i32(tmp_shift); \
-    tcg_temp_free_ptr(statusptr); \
-}
-VFP_GEN_FIX(tosl, _round_to_zero)
-VFP_GEN_FIX(toul, _round_to_zero)
-VFP_GEN_FIX(slto, )
-VFP_GEN_FIX(ulto, )
-#undef VFP_GEN_FIX
-
 static inline long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 }
             } else if (op >= 14) {
                 /* VCVT fixed-point.  */
+                TCGv_ptr fpst;
+                TCGv_i32 shiftv;
+                VFPGenFixPointFn *fn;
+
                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
                     return 1;
                 }
+
+                if (!(op & 1)) {
+                    if (u) {
+                        fn = gen_helper_vfp_ultos;
+                    } else {
+                        fn = gen_helper_vfp_sltos;
+                    }
+                } else {
+                    if (u) {
+                        fn = gen_helper_vfp_touls_round_to_zero;
+                    } else {
+                        fn = gen_helper_vfp_tosls_round_to_zero;
+                    }
+                }
+
                 /* We have already masked out the must-be-1 top bit of imm6,
                  * hence this 32-shift where the ARM ARM has 64-imm6.
                  */
                 shift = 32 - shift;
+                fpst = get_fpstatus_ptr(1);
+                shiftv = tcg_const_i32(shift);
                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
-                    if (!(op & 1)) {
-                        if (u)
-                            gen_vfp_ulto(0, shift, 1);
-                        else
-                            gen_vfp_slto(0, shift, 1);
-                    } else {
-                        if (u)
-                            gen_vfp_toul(0, shift, 1);
-                        else
-                            gen_vfp_tosl(0, shift, 1);
-                    }
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
+                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
+                    fn(tmpf, tmpf, shiftv, fpst);
+                    neon_store_reg(rd, pass, tmpf);
                 }
+                tcg_temp_free_ptr(fpst);
+                tcg_temp_free_i32(shiftv);
             } else {
                 return 1;
             }
-- 
2.20.1

Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
 * don't use cpu_F0s
 * don't use tcg_gen_ld_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_st_f32 tcg_gen_st_i32
 
 #define ARM_CP_RW_BIT   (1 << 20)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         q || (rm & 1)) {
                         return 1;
                     }
-                    tmp = tcg_temp_new_i32();
-                    tmp2 = tcg_temp_new_i32();
                     fpst = get_fpstatus_ptr(true);
                     ahp = get_ahp_flag();
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+                    tmp = neon_load_reg(rm, 0);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp2 = neon_load_reg(rm, 1);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
                     tcg_gen_shli_i32(tmp2, tmp2, 16);
                     tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
+                    tcg_temp_free_i32(tmp);
+                    tmp = neon_load_reg(rm, 2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp3 = neon_load_reg(rm, 3);
                     neon_store_reg(rd, 0, tmp2);
-                    tmp2 = tcg_temp_new_i32();
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
-                    tcg_gen_shli_i32(tmp2, tmp2, 16);
-                    tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    neon_store_reg(rd, 1, tmp2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
+                    neon_store_reg(rd, 1, tmp3);
                     tcg_temp_free_i32(tmp);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
-- 
2.20.1

Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
 * don't use CPU_F0s
 * don't use tcg_gen_st_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_st_f32 tcg_gen_st_i32
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP decoder */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp = neon_load_reg(rm, 0);
                     tmp2 = neon_load_reg(rm, 1);
                     tcg_gen_ext16u_i32(tmp3, tmp);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
-                    tcg_gen_shri_i32(tmp3, tmp, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
-                    tcg_temp_free_i32(tmp);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 0, tmp3);
+                    tcg_gen_shri_i32(tmp, tmp, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
+                    neon_store_reg(rd, 1, tmp);
+                    tmp3 = tcg_temp_new_i32();
                     tcg_gen_ext16u_i32(tmp3, tmp2);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
-                    tcg_gen_shri_i32(tmp3, tmp2, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
-                    tcg_temp_free_i32(tmp2);
-                    tcg_temp_free_i32(tmp3);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 2, tmp3);
+                    tcg_gen_shri_i32(tmp2, tmp2, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
+                    neon_store_reg(rd, 3, tmp2);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
                     break;
-- 
2.20.1

Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.

cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
cpu_V1 are used by both iwmmxt and Neon.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
 TCGv_i64 cpu_exclusive_addr;
 TCGv_i64 cpu_exclusive_val;
 
-/* FIXME:  These should be removed.  */
-static TCGv_i32 cpu_F0s, cpu_F1s;
-static TCGv_i64 cpu_F0d, cpu_F1d;
-
 #include "exec/gen-icount.h"
 
 static const char * const regnames[] =
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->base.max_insns = MIN(dc->base.max_insns, bound);
     }
 
-    cpu_F0s = tcg_temp_new_i32();
-    cpu_F1s = tcg_temp_new_i32();
-    cpu_F0d = tcg_temp_new_i64();
-    cpu_F1d = tcg_temp_new_i64();
-    cpu_V0 = cpu_F0d;
-    cpu_V1 = cpu_F1d;
+    cpu_V0 = tcg_temp_new_i64();
+    cpu_V1 = tcg_temp_new_i64();
     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
     cpu_M0 = tcg_temp_new_i64();
 }
-- 
2.20.1

In several places cut and paste errors meant we were using the wrong
type for the 'arg' struct in trans_ functions called by the
decodetree decoder, because we were using the _sp version of the
struct in the _dp function.  These were harmless, because the two
structs were identical and so decodetree made them typedefs of the
same underlying structure (and we'd have had a compile error if they
were not harmless), but we should clean them up anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
     return true;
 }
 
-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
 {
     TCGv_i32 tmp;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
     return true;
 }
 
-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
 {
     uint32_t offset;
     TCGv_i32 addr;
@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     gen_helper_vfp_negd(vd, vd);
 }
 
-static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
+static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
+static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
+static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
     return true;
 }
 
-static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
+static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 {
     /*
      * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
     return true;
 }
 
-static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
+static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
     return true;
 }
 
-static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
+static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
-- 
2.20.1

The architecture permits FPUs which have only single-precision
support, not double-precision; Cortex-M4 and Cortex-M33 are
both like that. Add the necessary checks on the MVFR0 FPDP
field so that we UNDEF any double-precision instructions on
CPUs like this.

Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
VLDM/VSTM, VLDR/VSTR which take double precision registers
still exist.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
---
 target/arm/cpu.h               |  6 +++
 target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
 }
 
+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
+{
+    /* Return true if CPU supports double precision floating point */
+    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
+}
+
 /*
  * We always set the FP and SIMD FP16 fields to indicate identical
  * levels of support (assuming SIMD is implemented at all), so
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         ((a->vm | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
-- 
2.20.1