Series comparison

-[Qemu-devel] [PULL 00/21] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-Arm queue built up to a point where it seems worth sending:
+The following changes since commit adf2e451f357e993f173ba9b4176dbf3e65fee7e:
 various bug fixes, plus RTH's refactoring in preparation for SVE.
-thanks
+  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2019-02-26 19:04:47 +0000)
 -- PMM
 The following changes since commit 0f79bfe38a2cf0f43c7ea4959da7f8ebd7858f3d:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging (2018-01-25 09:53:53 +0000)
+are available in the Git repository at:
-are available in the git repository at:
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190228-1
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180125
+for you to fetch changes up to 1c9af3a9e05c1607a36df4943f8f5393d7621a91:
-for you to fetch changes up to 24da047af0e99a83fcc0d50b86c0f2627f7418b3:
+  linux-user: Enable HWCAP_ASIMDFHM, HWCAP_JSCVT (2019-02-28 11:03:05 +0000)
   pl110: Implement vertical compare/next base interrupts (2018-01-25 11:45:30 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * target/arm: Fix address truncation in 64-bit pagetable walks
+ * add MHU and dual-core support to Musca boards
- * i.MX: Fix FEC/ENET receive functions
+ * refactor some VFP insns to be gated by ID registers
- * target/arm: preparatory refactoring for SVE emulation
+ * Revert "arm: Allow system registers for KVM guests to be changed by QEMU code"
- * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
+ * Implement ARMv8.2-FHM extension
- * hw/intc/arm_gic: Fix C_RPR value on idle priority
+ * Advertise JSCVT via HWCAP for linux-user
  * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
  * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
  * hw/arm/virt: Check that the CPU realize method succeeded
  * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object
  * xilinx_spips: Correct usage of an uninitialized local variable
  * pl110: Implement vertical compare/next base interrupts
 ----------------------------------------------------------------
-Ard Biesheuvel (1):
+Peter Maydell (11):
-      target/arm: Fix 32-bit address truncation
+      hw/misc/armsse-mhu.c: Model the SSE-200 Message Handling Unit
       hw/arm/armsse: Wire up the MHUs
       target/arm/cpu: Allow init-svtor property to be set after realize
       target/arm/arm-powerctl: Add new arm_set_cpu_on_and_reset()
       hw/misc/iotkit-sysctl: Correct typo in INITSVTOR0 register name
       hw/arm/iotkit-sysctl: Add SSE-200 registers
       hw/arm/iotkit-sysctl: Implement CPUWAIT and INITSVTOR*
       hw/arm/armsse: Unify init-svtor and cpuwait handling
       target/arm: Use MVFR1 feature bits to gate A32/T32 FP16 instructions
       target/arm: Gate "miscellaneous FP" insns by ID register field
       Revert "arm: Allow system registers for KVM guests to be changed by QEMU code"
-Francisco Iglesias (1):
+Richard Henderson (5):
-      xilinx_spips: Correct usage of an uninitialized local variable
+      target/arm: Add helpers for FMLAL
       target/arm: Implement FMLAL and FMLSL for aarch64
       target/arm: Implement VFMAL and VFMSL for aarch32
       target/arm: Enable ARMv8.2-FHM for -cpu max
       linux-user: Enable HWCAP_ASIMDFHM, HWCAP_JSCVT
-Jean-Christophe Dubois (1):
+ hw/misc/Makefile.objs           |   1 +
-      i.MX: Fix FEC/ENET receive funtions
+ include/hw/arm/armsse.h         |   3 +-
  include/hw/misc/armsse-mhu.h    |  44 ++++++
  include/hw/misc/iotkit-sysctl.h |  25 +++-
  target/arm/arm-powerctl.h       |  16 +++
  target/arm/cpu.h                |  76 +++++++++--
  target/arm/helper.h             |   9 ++
  hw/arm/armsse.c                 |  91 +++++++++----
  hw/misc/armsse-mhu.c            | 198 +++++++++++++++++++++++++++
  hw/misc/iotkit-sysctl.c         | 294 ++++++++++++++++++++++++++++++++++++++--
  linux-user/elfload.c            |   2 +
  target/arm/arm-powerctl.c       |  56 ++++++++
  target/arm/cpu.c                |  32 ++++-
  target/arm/cpu64.c              |   2 +
  target/arm/helper.c             |  27 +---
  target/arm/kvm32.c              |  23 +++-
  target/arm/kvm64.c              |   2 -
  target/arm/machine.c            |   2 +-
  target/arm/translate-a64.c      |  49 ++++++-
  target/arm/translate.c          | 180 ++++++++++++++++--------
  target/arm/vec_helper.c         | 148 ++++++++++++++++++++
  MAINTAINERS                     |   2 +
  default-configs/arm-softmmu.mak |   1 +
  hw/misc/trace-events            |   4 +
 files changed, 1139 insertions(+), 148 deletions(-)
  create mode 100644 include/hw/misc/armsse-mhu.h
  create mode 100644 hw/misc/armsse-mhu.c
-Linus Walleij (1):
-      pl110: Implement vertical compare/next base interrupts
-Luc MICHEL (4):
-      hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
-      hw/intc/arm_gic: Fix C_RPR value on idle priority
-      hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
-      hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
-Peter Maydell (1):
-      hw/arm/virt: Check that the CPU realize method succeeded
-Philippe Mathieu-Daudé (1):
-      sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object
-Richard Henderson (11):
-      target/arm: Mark disas_set_insn_syndrome inline
-      target/arm: Use pointers in crypto helpers
-      target/arm: Use pointers in neon zip/uzp helpers
-      target/arm: Use pointers in neon tbl helper
-      target/arm: Change the type of vfp.regs
-      target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
-      vmstate: Add VMSTATE_UINT64_SUB_ARRAY
-      target/arm: Add ARM_FEATURE_SVE
-      target/arm: Move cpu_get_tb_cpu_state out of line
-      target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
-      target/arm: Simplify fp_exception_el for user-only
- include/hw/sd/sdhci.h       |   1 +
- include/migration/vmstate.h |   9 ++-
- target/arm/cpu.h            | 157 ++++++++-----------------------------
- target/arm/helper.h         |  46 +++++------
- target/arm/translate.h      |   2 +-
- hw/arm/virt.c               |   2 +-
- hw/display/pl110.c          |  30 +++++++-
- hw/intc/arm_gic.c           |  25 +++++-
- hw/net/imx_fec.c            |   8 +-
- hw/sd/sdhci.c               |   1 +
- hw/ssi/xilinx_spips.c       |  18 ++++-
- linux-user/signal.c         |  22 +++---
- target/arm/arch_dump.c      |   8 +-
- target/arm/crypto_helper.c  | 184 +++++++++++++++++---------------------------
- target/arm/helper-a64.c     |   5 +-
- target/arm/helper.c         | 164 +++++++++++++++++++++++++++++++++++----
- target/arm/kvm32.c          |   4 +-
- target/arm/kvm64.c          |  31 +++-----
- target/arm/machine.c        |   2 +-
- target/arm/neon_helper.c    | 162 ++++++++++++++++++++------------------
- target/arm/op_helper.c      |  17 ++--
- target/arm/translate-a64.c  | 100 ++++++++++++------------
- target/arm/translate.c      | 134 +++++++++++++++++---------------
-files changed, 607 insertions(+), 525 deletions(-)

-[Qemu-devel] [PULL 01/21] target/arm: Fix 32-bit address truncation
+Deleted patch
-From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Commit ("3b39d734141a target/arm: Handle page table walk load failures
-correctly") modified both versions of the page table walking code (i.e.,
-arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
-a temporary 'data' variable so that it can be inspected before being
-returned. However, arm_ldq_ptw() returns an uint64_t, and using a
-temporary uint32_t variable truncates the upper bits, corrupting the
-result. This causes problems when using more than 4 GB of memory in
-a TCG guest. So use a uint64_t instead.
-Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
-     MemTxAttrs attrs = {};
-     MemTxResult result = MEMTX_OK;
-     AddressSpace *as;
--    uint32_t data;
-+    uint64_t data;
-     attrs.secure = is_secure;
-     as = arm_addressspace(cs, attrs);
---
-.7.4

-[Qemu-devel] [PULL 02/21] i.MX: Fix FEC/ENET receive funtions
+Deleted patch
-From: Jean-Christophe Dubois <jcd@tribudubois.net>
-The actual imx_eth_enable_rx() function is buggy.
-It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets().
-qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself
-is going to call imx_eth_enable_rx().
-By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets()
-we end up updating the register with an outdated value which might
-lead to disabling the receive function in the i.MX FEC/ENET device.
-This patch change the place where the register update is done so that the
-register value stays up to date and the receive function can keep
-running.
-Reported-by: Fyleo <fyleo45@gmail.com>
-Tested-by: Fyleo  <fyleo45@gmail.com>
-Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
-Message-id: 20180113113445.2705-1-jcd@tribudubois.net
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/net/imx_fec.c | 8 ++------
-file changed, 2 insertions(+), 6 deletions(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
- static void imx_eth_enable_rx(IMXFECState *s, bool flush)
- {
-     IMXFECBufDesc bd;
--    bool rx_ring_full;
-     imx_fec_read_bd(&bd, s->rx_descriptor);
--    rx_ring_full = !(bd.flags & ENET_BD_E);
-+    s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0;
--    if (rx_ring_full) {
-+    if (!s->regs[ENET_RDAR]) {
-         FEC_PRINTF("RX buffer full\n");
-     } else if (flush) {
-         qemu_flush_queued_packets(qemu_get_queue(s->nic));
-     }
--
--    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
- }
- static void imx_eth_reset(DeviceState *d)
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
-     case ENET_RDAR:
-         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
-             if (!s->regs[index]) {
--                s->regs[index] = ENET_RDAR_RDAR;
-                 imx_eth_enable_rx(s, true);
-             }
-         } else {
---
-.7.4

-[Qemu-devel] [PULL 20/21] xilinx_spips: Correct usage of an uninitialized local variable
+[Qemu-devel] [PULL 01/16] hw/misc/armsse-mhu.c: Model the SSE-200 Message Handling Unit
-From: Francisco Iglesias <frasse.iglesias@gmail.com>
+Implement a model of the Message Handling Unit (MHU) found in
 the Arm SSE-200. This is a simple device which just contains
 some registers which allow the two cores of the SSE-200
 to raise interrupts on each other.
-Coverity found that the variable tx_rx in the function
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-patch corrects this by always initializing tx_rx to zeros.
+Message-id: 20190219125808.25174-2-peter.maydell@linaro.org
 ---
  hw/misc/Makefile.objs           |   1 +
  include/hw/misc/armsse-mhu.h    |  44 +++++++
  hw/misc/armsse-mhu.c            | 198 ++++++++++++++++++++++++++++++++
  MAINTAINERS                     |   2 +
  default-configs/arm-softmmu.mak |   1 +
  hw/misc/trace-events            |   4 +
 files changed, 250 insertions(+)
  create mode 100644 include/hw/misc/armsse-mhu.h
  create mode 100644 hw/misc/armsse-mhu.c
-Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
 Message-id: 20180124215708.30400-1-frasse.iglesias@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ssi/xilinx_spips.c | 18 +++++++++++++++++-
 file changed, 17 insertions(+), 1 deletion(-)
 diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spips.c
+--- a/hw/misc/Makefile.objs
-+++ b/hw/ssi/xilinx_spips.c
++++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IOTKIT_SECCTL) += iotkit-secctl.o
  obj-$(CONFIG_IOTKIT_SYSCTL) += iotkit-sysctl.o
  obj-$(CONFIG_IOTKIT_SYSINFO) += iotkit-sysinfo.o
  obj-$(CONFIG_ARMSSE_CPUID) += armsse-cpuid.o
 +obj-$(CONFIG_ARMSSE_MHU) += armsse-mhu.o
  obj-$(CONFIG_PVPANIC) += pvpanic.o
  obj-$(CONFIG_AUX) += auxbus.o
 diff --git a/include/hw/misc/armsse-mhu.h b/include/hw/misc/armsse-mhu.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/armsse-mhu.h
 @@ -XXX,XX +XXX,XX @@
- #define SNOOP_NONE 0xEE
++/*
- #define SNOOP_STRIPING 0
++ * ARM SSE-200 Message Handling Unit (MHU)
++ *
-+#define MIN_NUM_BUSSES 1
++ * Copyright (c) 2019 Linaro Limited
-+#define MAX_NUM_BUSSES 2
++ * Written by Peter Maydell
-+
++ *
- static inline int num_effective_busses(XilinxSPIPS *s)
++ *  This program is free software; you can redistribute it and/or modify
- {
++ *  it under the terms of the GNU General Public License version 2 or
-     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
++ *  (at your option) any later version.
-@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
++ */
-     for (;;) {
++
-         int i;
++/*
-         uint8_t tx = 0;
++ * This is a model of the Message Handling Unit (MHU) which is part of the
--        uint8_t tx_rx[num_effective_busses(s)];
++ * Arm SSE-200 and documented in
-+        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
++ * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
-         uint8_t dummy_cycles = 0;
++ *
-         uint8_t addr_length;
++ * QEMU interface:
++ *  + sysbus MMIO region 0: the system information register bank
-@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
++ *  + sysbus IRQ 0: interrupt for CPU 0
++ *  + sysbus IRQ 1: interrupt for CPU 1
-     DB_PRINT_L(0, "realized spips\n");
++ */
++
-+    if (s->num_busses > MAX_NUM_BUSSES) {
++#ifndef HW_MISC_SSE_MHU_H
-+        error_setg(errp,
++#define HW_MISC_SSE_MHU_H
-+                   "requested number of SPI busses %u exceeds maximum %d",
++
-+                   s->num_busses, MAX_NUM_BUSSES);
++#include "hw/sysbus.h"
-+        return;
++
 +#define TYPE_ARMSSE_MHU "armsse-mhu"
 +#define ARMSSE_MHU(obj) OBJECT_CHECK(ARMSSEMHU, (obj), TYPE_ARMSSE_MHU)
 +
 +typedef struct ARMSSEMHU {
 +    /*< private >*/
 +    SysBusDevice parent_obj;
 +
 +    /*< public >*/
 +    MemoryRegion iomem;
 +    qemu_irq cpu0irq;
 +    qemu_irq cpu1irq;
 +
 +    uint32_t cpu0intr;
 +    uint32_t cpu1intr;
 +} ARMSSEMHU;
 +
 +#endif
 diff --git a/hw/misc/armsse-mhu.c b/hw/misc/armsse-mhu.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/armsse-mhu.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM SSE-200 Message Handling Unit (MHU)
 + *
 + * Copyright (c) 2019 Linaro Limited
 + * Written by Peter Maydell
 + *
 + *  This program is free software; you can redistribute it and/or modify
 + *  it under the terms of the GNU General Public License version 2 or
 + *  (at your option) any later version.
 + */
 +
 +/*
 + * This is a model of the Message Handling Unit (MHU) which is part of the
 + * Arm SSE-200 and documented in
 + * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "trace.h"
 +#include "qapi/error.h"
 +#include "sysemu/sysemu.h"
 +#include "hw/sysbus.h"
 +#include "hw/registerfields.h"
 +#include "hw/misc/armsse-mhu.h"
 +
 +REG32(CPU0INTR_STAT, 0x0)
 +REG32(CPU0INTR_SET, 0x4)
 +REG32(CPU0INTR_CLR, 0x8)
 +REG32(CPU1INTR_STAT, 0x10)
 +REG32(CPU1INTR_SET, 0x14)
 +REG32(CPU1INTR_CLR, 0x18)
 +REG32(PID4, 0xfd0)
 +REG32(PID5, 0xfd4)
 +REG32(PID6, 0xfd8)
 +REG32(PID7, 0xfdc)
 +REG32(PID0, 0xfe0)
 +REG32(PID1, 0xfe4)
 +REG32(PID2, 0xfe8)
 +REG32(PID3, 0xfec)
 +REG32(CID0, 0xff0)
 +REG32(CID1, 0xff4)
 +REG32(CID2, 0xff8)
 +REG32(CID3, 0xffc)
 +
 +/* Valid bits in the interrupt registers. If any are set the IRQ is raised */
 +#define INTR_MASK 0xf
 +
 +/* PID/CID values */
 +static const int armsse_mhu_id[] = {
 +    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
 +    0x56, 0xb8, 0x0b, 0x00, /* PID0..PID3 */
 +    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 +};
 +
 +static void armsse_mhu_update(ARMSSEMHU *s)
 +{
 +    qemu_set_irq(s->cpu0irq, s->cpu0intr != 0);
 +    qemu_set_irq(s->cpu1irq, s->cpu1intr != 0);
 +}
 +
 +static uint64_t armsse_mhu_read(void *opaque, hwaddr offset, unsigned size)
 +{
 +    ARMSSEMHU *s = ARMSSE_MHU(opaque);
 +    uint64_t r;
 +
 +    switch (offset) {
 +    case A_CPU0INTR_STAT:
 +        r = s->cpu0intr;
 +        break;
 +
 +    case A_CPU1INTR_STAT:
 +        r = s->cpu1intr;
 +        break;
 +
 +    case A_PID4 ... A_CID3:
 +        r = armsse_mhu_id[(offset - A_PID4) / 4];
 +        break;
 +
 +    case A_CPU0INTR_SET:
 +    case A_CPU0INTR_CLR:
 +    case A_CPU1INTR_SET:
 +    case A_CPU1INTR_CLR:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SSE MHU: read of write-only register at offset 0x%x\n",
 +                      (int)offset);
 +        r = 0;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SSE MHU read: bad offset 0x%x\n", (int)offset);
 +        r = 0;
 +        break;
 +    }
-+    if (s->num_busses < MIN_NUM_BUSSES) {
++    trace_armsse_mhu_read(offset, r, size);
-+        error_setg(errp,
++    return r;
-+                   "requested number of SPI busses %u is below minimum %d",
++}
-+                   s->num_busses, MIN_NUM_BUSSES);
++
-+        return;
++static void armsse_mhu_write(void *opaque, hwaddr offset,
 +                             uint64_t value, unsigned size)
 +{
 +    ARMSSEMHU *s = ARMSSE_MHU(opaque);
 +
 +    trace_armsse_mhu_write(offset, value, size);
 +
 +    switch (offset) {
 +    case A_CPU0INTR_SET:
 +        s->cpu0intr |= (value & INTR_MASK);
 +        break;
 +    case A_CPU0INTR_CLR:
 +        s->cpu0intr &= ~(value & INTR_MASK);
 +        break;
 +    case A_CPU1INTR_SET:
 +        s->cpu1intr |= (value & INTR_MASK);
 +        break;
 +    case A_CPU1INTR_CLR:
 +        s->cpu1intr &= ~(value & INTR_MASK);
 +        break;
 +
 +    case A_CPU0INTR_STAT:
 +    case A_CPU1INTR_STAT:
 +    case A_PID4 ... A_CID3:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SSE MHU: write to read-only register at offset 0x%x\n",
 +                      (int)offset);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SSE MHU write: bad offset 0x%x\n", (int)offset);
 +        break;
 +    }
 +
-     s->spi = g_new(SSIBus *, s->num_busses);
++    armsse_mhu_update(s);
-     for (i = 0; i < s->num_busses; ++i) {
++}
-         char bus_name[16];
++
 +static const MemoryRegionOps armsse_mhu_ops = {
 +    .read = armsse_mhu_read,
 +    .write = armsse_mhu_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 4,
 +    .valid.max_access_size = 4,
 +};
 +
 +static void armsse_mhu_reset(DeviceState *dev)
 +{
 +    ARMSSEMHU *s = ARMSSE_MHU(dev);
 +
 +    s->cpu0intr = 0;
 +    s->cpu1intr = 0;
 +}
 +
 +static const VMStateDescription armsse_mhu_vmstate = {
 +    .name = "armsse-mhu",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(cpu0intr, ARMSSEMHU),
 +        VMSTATE_UINT32(cpu1intr, ARMSSEMHU),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
 +static void armsse_mhu_init(Object *obj)
 +{
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    ARMSSEMHU *s = ARMSSE_MHU(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &armsse_mhu_ops,
 +                          s, "armsse-mhu", 0x1000);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->cpu0irq);
 +    sysbus_init_irq(sbd, &s->cpu1irq);
 +}
 +
 +static void armsse_mhu_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = armsse_mhu_reset;
 +    dc->vmsd = &armsse_mhu_vmstate;
 +}
 +
 +static const TypeInfo armsse_mhu_info = {
 +    .name = TYPE_ARMSSE_MHU,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(ARMSSEMHU),
 +    .instance_init = armsse_mhu_init,
 +    .class_init = armsse_mhu_class_init,
 +};
 +
 +static void armsse_mhu_register_types(void)
 +{
 +    type_register_static(&armsse_mhu_info);
 +}
 +
 +type_init(armsse_mhu_register_types);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/misc/iotkit-sysinfo.c
  F: include/hw/misc/iotkit-sysinfo.h
  F: hw/misc/armsse-cpuid.c
  F: include/hw/misc/armsse-cpuid.h
 +F: hw/misc/armsse-mhu.c
 +F: include/hw/misc/armsse-mhu.h
  Musca
  M: Peter Maydell <peter.maydell@linaro.org>
 diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/default-configs/arm-softmmu.mak
 +++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_IOTKIT_SECCTL=y
  CONFIG_IOTKIT_SYSCTL=y
  CONFIG_IOTKIT_SYSINFO=y
  CONFIG_ARMSSE_CPUID=y
 +CONFIG_ARMSSE_MHU=y
  CONFIG_VERSATILE=y
  CONFIG_VERSATILE_PCI=y
 diff --git a/hw/misc/trace-events b/hw/misc/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/trace-events
 +++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ iotkit_sysctl_reset(void) "IoTKit SysCtl: reset"
  # hw/misc/armsse-cpuid.c
  armsse_cpuid_read(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
  armsse_cpuid_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 +
 +# hw/misc/armsse-mhu.c
 +armsse_mhu_read(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 +armsse_mhu_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 05/21] target/arm: Use pointers in neon zip/uzp helpers
+[Qemu-devel] [PULL 02/16] hw/arm/armsse: Wire up the MHUs
-From: Richard Henderson <richard.henderson@linaro.org>
+Create and connect the MHUs in the SSE-200.
-Rather than passing regnos to the helpers, pass pointers to the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-vector registers directly.  This eliminates the need to pass in
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-the environment pointer and reduces the number of places that
+Message-id: 20190219125808.25174-3-peter.maydell@linaro.org
-directly access env->vfp.regs[].
+---
  include/hw/arm/armsse.h |  3 ++-
  hw/arm/armsse.c         | 40 ++++++++++++++++++++++++++++++----------
 files changed, 32 insertions(+), 11 deletions(-)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180119045438.28582-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.h      |  20 +++---
  target/arm/neon_helper.c | 162 +++++++++++++++++++++++++----------------------
  target/arm/translate.c   |  42 ++++++------
 files changed, 120 insertions(+), 104 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/include/hw/arm/armsse.h
-+++ b/target/arm/helper.h
++++ b/include/hw/arm/armsse.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
+@@ -XXX,XX +XXX,XX @@
- DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
+ #include "hw/misc/iotkit-sysctl.h"
- DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
+ #include "hw/misc/iotkit-sysinfo.h"
+ #include "hw/misc/armsse-cpuid.h"
--DEF_HELPER_3(neon_unzip8, void, env, i32, i32)
++#include "hw/misc/armsse-mhu.h"
--DEF_HELPER_3(neon_unzip16, void, env, i32, i32)
+ #include "hw/misc/unimp.h"
--DEF_HELPER_3(neon_qunzip8, void, env, i32, i32)
+ #include "hw/or-irq.h"
--DEF_HELPER_3(neon_qunzip16, void, env, i32, i32)
+ #include "hw/core/split-irq.h"
--DEF_HELPER_3(neon_qunzip32, void, env, i32, i32)
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
--DEF_HELPER_3(neon_zip8, void, env, i32, i32)
+     IoTKitSysCtl sysctl;
--DEF_HELPER_3(neon_zip16, void, env, i32, i32)
+     IoTKitSysCtl sysinfo;
--DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
--DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
+-    UnimplementedDeviceState mhu[2];
--DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
++    ARMSSEMHU mhu[2];
-+DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+     UnimplementedDeviceState ppu[NUM_PPUS];
-+DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+     UnimplementedDeviceState cachectrl[SSE_MAX_CPUS];
-+DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+     UnimplementedDeviceState cpusecctrl[SSE_MAX_CPUS];
-+DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 +DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
  DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
  DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/neon_helper.c
+--- a/hw/arm/armsse.c
-+++ b/target/arm/neon_helper.c
++++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_acgt_f64)(uint64_t a, uint64_t b, void *fpstp)
+@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
+                           sizeof(s->sysinfo), TYPE_IOTKIT_SYSINFO);
- #define ELEM(V, N, SIZE) (((V) >> ((N) * (SIZE))) & ((1ull << (SIZE)) - 1))
+     if (info->has_mhus) {
+         sysbus_init_child_obj(obj, "mhu0", &s->mhu[0], sizeof(s->mhu[0]),
--void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+-                              TYPE_UNIMPLEMENTED_DEVICE);
-+void HELPER(neon_qunzip8)(void *vd, void *vm)
++                              TYPE_ARMSSE_MHU);
- {
+         sysbus_init_child_obj(obj, "mhu1", &s->mhu[1], sizeof(s->mhu[1]),
--    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
+-                              TYPE_UNIMPLEMENTED_DEVICE);
--    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
++                              TYPE_ARMSSE_MHU);
--    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
+     }
--    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+     if (info->has_ppus) {
-+    uint64_t *rd = vd, *rm = vm;
+         for (i = 0; i < info->num_cpus; i++) {
-+    uint64_t zd0 = rd[0], zd1 = rd[1];
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+    uint64_t zm0 = rm[0], zm1 = rm[1];
+     }
      if (info->has_mhus) {
 -        for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
 -            char *name;
 -            char *port;
 +        /*
 +         * An SSE-200 with only one CPU should have only one MHU created,
 +         * with the region where the second MHU usually is being RAZ/WI.
 +         * We don't implement that SSE-200 config; if we want to support
 +         * it then this code needs to be enhanced to handle creating the
 +         * RAZ/WI region instead of the second MHU.
 +         */
 +        assert(info->num_cpus == ARRAY_SIZE(s->mhu));
 +
-     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zd0, 2, 8) << 8)
++        for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
-         | (ELEM(zd0, 4, 8) << 16) | (ELEM(zd0, 6, 8) << 24)
++            char *port;
-         | (ELEM(zd1, 0, 8) << 32) | (ELEM(zd1, 2, 8) << 40)
++            int cpunum;
-@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
++            SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]);
-         | (ELEM(zm0, 5, 8) << 16) | (ELEM(zm0, 7, 8) << 24)
-         | (ELEM(zm1, 1, 8) << 32) | (ELEM(zm1, 3, 8) << 40)
+-            name = g_strdup_printf("MHU%d", i);
-         | (ELEM(zm1, 5, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
+-            qdev_prop_set_string(DEVICE(&s->mhu[i]), "name", name);
--    env->vfp.regs[rm] = make_float64(m0);
+-            qdev_prop_set_uint64(DEVICE(&s->mhu[i]), "size", 0x1000);
--    env->vfp.regs[rm + 1] = make_float64(m1);
+             object_property_set_bool(OBJECT(&s->mhu[i]), true,
--    env->vfp.regs[rd] = make_float64(d0);
+                                      "realized", &err);
--    env->vfp.regs[rd + 1] = make_float64(d1);
+-            g_free(name);
              if (err) {
                  error_propagate(errp, err);
                  return;
              }
              port = g_strdup_printf("port[%d]", i + 3);
 -            mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->mhu[i]), 0);
 +            mr = sysbus_mmio_get_region(mhu_sbd, 0);
              object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr),
                                       port, &err);
              g_free(port);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                  error_propagate(errp, err);
                  return;
              }
 +
-+    rm[0] = m0;
++            /*
-+    rm[1] = m1;
++             * Each MHU has an irq line for each CPU:
-+    rd[0] = d0;
++             *  MHU 0 irq line 0 -> CPU 0 IRQ 6
-+    rd[1] = d1;
++             *  MHU 0 irq line 1 -> CPU 1 IRQ 6
- }
++             *  MHU 1 irq line 0 -> CPU 0 IRQ 7
++             *  MHU 1 irq line 1 -> CPU 1 IRQ 7
--void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
++             */
-+void HELPER(neon_qunzip16)(void *vd, void *vm)
++            for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
- {
++                DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
-     uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zd0, 2, 16) << 16)
++                sysbus_connect_irq(mhu_sbd, cpunum,
-         | (ELEM(zd1, 0, 16) << 32) | (ELEM(zd1, 2, 16) << 48);
++                                   qdev_get_gpio_in(cpudev, 6 + i));
-     uint64_t d1 = ELEM(zm0, 0, 16) | (ELEM(zm0, 2, 16) << 16)
++            }
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 1, 16) << 32) | (ELEM(zd1, 3, 16) << 48);
      uint64_t m1 = ELEM(zm0, 1, 16) | (ELEM(zm0, 3, 16) << 16)
          | (ELEM(zm1, 1, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qunzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qunzip32)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zd1, 0, 32) << 32);
      uint64_t d1 = ELEM(zm0, 0, 32) | (ELEM(zm1, 0, 32) << 32);
      uint64_t m0 = ELEM(zd0, 1, 32) | (ELEM(zd1, 1, 32) << 32);
      uint64_t m1 = ELEM(zm0, 1, 32) | (ELEM(zm1, 1, 32) << 32);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_unzip8)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zd, 2, 8) << 8)
          | (ELEM(zd, 4, 8) << 16) | (ELEM(zd, 6, 8) << 24)
          | (ELEM(zm, 0, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd, 5, 8) << 16) | (ELEM(zd, 7, 8) << 24)
          | (ELEM(zm, 1, 8) << 32) | (ELEM(zm, 3, 8) << 40)
          | (ELEM(zm, 5, 8) << 48) | (ELEM(zm, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_unzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_unzip16)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zd, 2, 16) << 16)
          | (ELEM(zm, 0, 16) << 32) | (ELEM(zm, 2, 16) << 48);
      uint64_t m0 = ELEM(zd, 1, 16) | (ELEM(zd, 3, 16) << 16)
          | (ELEM(zm, 1, 16) << 32) | (ELEM(zm, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip8)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zm0, 0, 8) << 8)
          | (ELEM(zd0, 1, 8) << 16) | (ELEM(zm0, 1, 8) << 24)
          | (ELEM(zd0, 2, 8) << 32) | (ELEM(zm0, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 5, 8) << 16) | (ELEM(zm1, 5, 8) << 24)
          | (ELEM(zd1, 6, 8) << 32) | (ELEM(zm1, 6, 8) << 40)
          | (ELEM(zd1, 7, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip16)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zm0, 0, 16) << 16)
          | (ELEM(zd0, 1, 16) << 32) | (ELEM(zm0, 1, 16) << 48);
      uint64_t d1 = ELEM(zd0, 2, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd1, 1, 16) << 32) | (ELEM(zm1, 1, 16) << 48);
      uint64_t m1 = ELEM(zd1, 2, 16) | (ELEM(zm1, 2, 16) << 16)
          | (ELEM(zd1, 3, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_qzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_qzip32)(void *vd, void *vm)
  {
 -    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
 -    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
 -    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
 -    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd0 = rd[0], zd1 = rd[1];
 +    uint64_t zm0 = rm[0], zm1 = rm[1];
 +
      uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zm0, 0, 32) << 32);
      uint64_t d1 = ELEM(zd0, 1, 32) | (ELEM(zm0, 1, 32) << 32);
      uint64_t m0 = ELEM(zd1, 0, 32) | (ELEM(zm1, 0, 32) << 32);
      uint64_t m1 = ELEM(zd1, 1, 32) | (ELEM(zm1, 1, 32) << 32);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rm + 1] = make_float64(m1);
 -    env->vfp.regs[rd] = make_float64(d0);
 -    env->vfp.regs[rd + 1] = make_float64(d1);
 +
 +    rm[0] = m0;
 +    rm[1] = m1;
 +    rd[0] = d0;
 +    rd[1] = d1;
  }
 -void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_zip8)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zm, 0, 8) << 8)
          | (ELEM(zd, 1, 8) << 16) | (ELEM(zm, 1, 8) << 24)
          | (ELEM(zd, 2, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
          | (ELEM(zd, 5, 8) << 16) | (ELEM(zm, 5, 8) << 24)
          | (ELEM(zd, 6, 8) << 32) | (ELEM(zm, 6, 8) << 40)
          | (ELEM(zd, 7, 8) << 48) | (ELEM(zm, 7, 8) << 56);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
 -void HELPER(neon_zip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(neon_zip16)(void *vd, void *vm)
  {
 -    uint64_t zm = float64_val(env->vfp.regs[rm]);
 -    uint64_t zd = float64_val(env->vfp.regs[rd]);
 +    uint64_t *rd = vd, *rm = vm;
 +    uint64_t zd = rd[0], zm = rm[0];
 +
      uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zm, 0, 16) << 16)
          | (ELEM(zd, 1, 16) << 32) | (ELEM(zm, 1, 16) << 48);
      uint64_t m0 = ELEM(zd, 2, 16) | (ELEM(zm, 2, 16) << 16)
          | (ELEM(zd, 3, 16) << 32) | (ELEM(zm, 3, 16) << 48);
 -    env->vfp.regs[rm] = make_float64(m0);
 -    env->vfp.regs[rd] = make_float64(d0);
 +
 +    rm[0] = m0;
 +    rd[0] = d0;
  }
  /* Helper function for 64 bit polynomial multiply case:
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 neon_get_scalar(int size, int reg)
  static int gen_neon_unzip(int rd, int rm, int size, int q)
  {
 -    TCGv_i32 tmp, tmp2;
 +    TCGv_ptr pd, pm;
 +
      if (!q && size == 2) {
          return 1;
      }
 -    tmp = tcg_const_i32(rd);
 -    tmp2 = tcg_const_i32(rm);
 +    pd = vfp_reg_ptr(true, rd);
 +    pm = vfp_reg_ptr(true, rm);
      if (q) {
          switch (size) {
          case 0:
 -            gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip16(pd, pm);
              break;
          case 2:
 -            gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
 +            gen_helper_neon_qunzip32(pd, pm);
              break;
          default:
              abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_unzip(int rd, int rm, int size, int q)
      } else {
          switch (size) {
          case 0:
 -            gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
 +            gen_helper_neon_unzip8(pd, pm);
              break;
          case 1:
 -            gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
 +            gen_helper_neon_unzip16(pd, pm);
              break;
          default:
              abort();
          }
      }
--    tcg_temp_free_i32(tmp);
--    tcg_temp_free_i32(tmp2);
-+    tcg_temp_free_ptr(pd);
-+    tcg_temp_free_ptr(pm);
-     return 0;
- }
- static int gen_neon_zip(int rd, int rm, int size, int q)
- {
--    TCGv_i32 tmp, tmp2;
-+    TCGv_ptr pd, pm;
-+
-     if (!q && size == 2) {
-         return 1;
-     }
--    tmp = tcg_const_i32(rd);
--    tmp2 = tcg_const_i32(rm);
-+    pd = vfp_reg_ptr(true, rd);
-+    pm = vfp_reg_ptr(true, rm);
-     if (q) {
-         switch (size) {
-         case 0:
--            gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
-+            gen_helper_neon_qzip8(pd, pm);
-             break;
-         case 1:
--            gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
-+            gen_helper_neon_qzip16(pd, pm);
-             break;
-         case 2:
--            gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
-+            gen_helper_neon_qzip32(pd, pm);
-             break;
-         default:
-             abort();
-@@ -XXX,XX +XXX,XX @@ static int gen_neon_zip(int rd, int rm, int size, int q)
-     } else {
-         switch (size) {
-         case 0:
--            gen_helper_neon_zip8(cpu_env, tmp, tmp2);
-+            gen_helper_neon_zip8(pd, pm);
-             break;
-         case 1:
--            gen_helper_neon_zip16(cpu_env, tmp, tmp2);
-+            gen_helper_neon_zip16(pd, pm);
-             break;
-         default:
-             abort();
-         }
-     }
--    tcg_temp_free_i32(tmp);
--    tcg_temp_free_i32(tmp2);
-+    tcg_temp_free_ptr(pd);
-+    tcg_temp_free_ptr(pm);
-     return 0;
- }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 19/21] sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object
+[Qemu-devel] [PULL 03/16] target/arm/cpu: Allow init-svtor property to be set after realize
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Make the M-profile "init-svtor" property be settable after realize.
 This matches the hardware, where this is a config signal which
 is sampled on CPU reset and can thus be changed between one
 reset and another. To do this we have to change the API we
 use to add the property.
-missed in 60765b6ceeb4.
+(We will need this capability for the SSE-200.)
-  Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-        as->root = root;
+Message-id: 20190219125808.25174-4-peter.maydell@linaro.org
-  (gdb) bt
+---
-  #0  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
+ target/arm/cpu.c | 29 ++++++++++++++++++++++++-----
-  #1  0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564
+file changed, 24 insertions(+), 5 deletions(-)
   #2  0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151
   #3  0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966
   #4  0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20,
       errp=0x7fff7f931270) at qom/object.c:1906
   #5  0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60,
       name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180123132051.24448-1-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/sd/sdhci.h | 1 +
  hw/sd/sdhci.c         | 1 +
 files changed, 2 insertions(+)
 diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/sd/sdhci.h
+--- a/target/arm/cpu.c
-+++ b/include/hw/sd/sdhci.h
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
+@@ -XXX,XX +XXX,XX @@
-     /*< public >*/
+ #include "target/arm/idau.h"
-     SDBus sdbus;
+ #include "qemu/error-report.h"
-     MemoryRegion iomem;
+ #include "qapi/error.h"
-+    AddressSpace sysbus_dma_as;
++#include "qapi/visitor.h"
-     AddressSpace *dma_as;
+ #include "cpu.h"
-     MemoryRegion *dma_mr;
+ #include "internals.h"
+ #include "qemu-common.h"
-diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
-index XXXXXXX..XXXXXXX 100644
+                                            pmsav7_dregion,
---- a/hw/sd/sdhci.c
+                                            qdev_prop_uint32, uint32_t);
-+++ b/hw/sd/sdhci.c
-@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
+-/* M profile: initial value of the Secure VTOR */
 -static Property arm_cpu_initsvtor_property =
 -            DEFINE_PROP_UINT32("init-svtor", ARMCPU, init_svtor, 0);
 +static void arm_get_init_svtor(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    visit_type_uint32(v, name, &cpu->init_svtor, errp);
 +}
 +
 +static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    visit_type_uint32(v, name, &cpu->init_svtor, errp);
 +}
  void arm_cpu_post_init(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                   qdev_prop_allow_set_link_before_realize,
                                   OBJ_PROP_LINK_STRONG,
                                   &error_abort);
 -        qdev_property_add_static(DEVICE(obj), &arm_cpu_initsvtor_property,
 -                                 &error_abort);
 +        /*
 +         * M profile: initial value of the Secure VTOR. We can't just use
 +         * a simple DEFINE_PROP_UINT32 for this because we want to permit
 +         * the property to be set after realize.
 +         */
 +        object_property_add(obj, "init-svtor", "uint32",
 +                            arm_get_init_svtor, arm_set_init_svtor,
 +                            NULL, NULL, &error_abort);
      }
-     if (s->dma_mr) {
+     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
 +        s->dma_as = &s->sysbus_dma_as;
          address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
      } else {
          /* use system_memory() if property "dma" not set */
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 15/21] hw/intc/arm_gic: Fix C_RPR value on idle priority
+[Qemu-devel] [PULL 04/16] target/arm/arm-powerctl: Add new arm_set_cpu_on_and_reset()
-From: Luc MICHEL <luc.michel@git.antfield.fr>
+Currently the Arm arm-powerctl.h APIs allow:
  * arm_set_cpu_on(), which powers on a CPU and sets its
    initial PC and other startup state
  * arm_reset_cpu(), which resets a CPU which is already on
    (and fails if the CPU is powered off)
-When there is no active interrupts in the GIC, a read to the C_RPR
+but there is no way to say "power on a CPU as if it had
-register should return the value of the "Idle priority", which is either
+just come out of reset and don't do anything else to it".
 the maximum value an IRQ priority field can be set to, or 0xff.
-Since the QEMU GIC model implements all the 8 priority bits, the Idle
+Add a new function arm_set_cpu_on_and_reset(), which does this.
 priority is 0xff.
-Internally, when there is no active interrupt, the running priority
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-value is 0x100. The gic_get_running_priority function returns an uint8_t
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-and thus, truncate this value to 0x00 when returning it. This is wrong since
+Message-id: 20190219125808.25174-5-peter.maydell@linaro.org
-a value of 0x00 correspond to the maximum possible priority.
+---
  target/arm/arm-powerctl.h | 16 +++++++++++
  target/arm/arm-powerctl.c | 56 +++++++++++++++++++++++++++++++++++++++
 files changed, 72 insertions(+)
-This commit fixes the returned value when the internal value is 0x100.
+diff --git a/target/arm/arm-powerctl.h b/target/arm/arm-powerctl.h
 Note that it is correct for the Non-Secure view to return 0xff even
 though from the NS world point of view, only 7 priority bits are
 implemented. The specification states that the Idle priority can be 0xff
 even when not all the 8 priority bits are implemented. This has been
 verified against a real GICv2 hardware on a Xilinx ZynqMP based board.
 Regarding the ARM11MPCore version of the GIC, the specification is not
 clear on that point, so this commit does not alter its behavior.
 Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
 Message-id: 20180119145756.7629-4-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/intc/arm_gic.c | 5 +++++
 file changed, 5 insertions(+)
 diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/target/arm/arm-powerctl.h
-+++ b/hw/intc/arm_gic.c
++++ b/target/arm/arm-powerctl.h
-@@ -XXX,XX +XXX,XX @@ static void gic_set_cpu_control(GICState *s, int cpu, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ int arm_set_cpu_off(uint64_t cpuid);
+  */
- static uint8_t gic_get_running_priority(GICState *s, int cpu, MemTxAttrs attrs)
+ int arm_reset_cpu(uint64_t cpuid);
- {
-+    if ((s->revision != REV_11MPCORE) && (s->running_priority[cpu] > 0xff)) {
++/*
-+        /* Idle priority */
++ * arm_set_cpu_on_and_reset:
-+        return 0xff;
++ * @cpuid: the id of the CPU we want to star
 + *
 + * Start the cpu designated by @cpuid and put it through its normal
 + * CPU reset process. The CPU will start in the way it is architected
 + * to start after a power-on reset.
 + *
 + * Returns: QEMU_ARM_POWERCTL_RET_SUCCESS on success.
 + * QEMU_ARM_POWERCTL_INVALID_PARAM if there is no CPU with that ID.
 + * QEMU_ARM_POWERCTL_ALREADY_ON if the CPU is already on.
 + * QEMU_ARM_POWERCTL_ON_PENDING if the CPU is already partway through
 + * powering on.
 + */
 +int arm_set_cpu_on_and_reset(uint64_t cpuid);
 +
  #endif
 diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arm-powerctl.c
 +++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ int arm_set_cpu_on(uint64_t cpuid, uint64_t entry, uint64_t context_id,
      return QEMU_ARM_POWERCTL_RET_SUCCESS;
  }
 +static void arm_set_cpu_on_and_reset_async_work(CPUState *target_cpu_state,
 +                                                run_on_cpu_data data)
 +{
 +    ARMCPU *target_cpu = ARM_CPU(target_cpu_state);
 +
 +    /* Initialize the cpu we are turning on */
 +    cpu_reset(target_cpu_state);
 +    target_cpu_state->halted = 0;
 +
 +    /* Finally set the power status */
 +    assert(qemu_mutex_iothread_locked());
 +    target_cpu->power_state = PSCI_ON;
 +}
 +
 +int arm_set_cpu_on_and_reset(uint64_t cpuid)
 +{
 +    CPUState *target_cpu_state;
 +    ARMCPU *target_cpu;
 +
 +    assert(qemu_mutex_iothread_locked());
 +
 +    /* Retrieve the cpu we are powering up */
 +    target_cpu_state = arm_get_cpu_by_id(cpuid);
 +    if (!target_cpu_state) {
 +        /* The cpu was not found */
 +        return QEMU_ARM_POWERCTL_INVALID_PARAM;
 +    }
 +
-     if (s->security_extn && !attrs.secure) {
++    target_cpu = ARM_CPU(target_cpu_state);
-         if (s->running_priority[cpu] & 0x80) {
++    if (target_cpu->power_state == PSCI_ON) {
-             /* Running priority in upper half of range: return the Non-secure
++        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "[ARM]%s: CPU %" PRId64 " is already on\n",
 +                      __func__, cpuid);
 +        return QEMU_ARM_POWERCTL_ALREADY_ON;
 +    }
 +
 +    /*
 +     * If another CPU has powered the target on we are in the state
 +     * ON_PENDING and additional attempts to power on the CPU should
 +     * fail (see 6.6 Implementation CPU_ON/CPU_OFF races in the PSCI
 +     * spec)
 +     */
 +    if (target_cpu->power_state == PSCI_ON_PENDING) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "[ARM]%s: CPU %" PRId64 " is already powering on\n",
 +                      __func__, cpuid);
 +        return QEMU_ARM_POWERCTL_ON_PENDING;
 +    }
 +
 +    async_run_on_cpu(target_cpu_state, arm_set_cpu_on_and_reset_async_work,
 +                     RUN_ON_CPU_NULL);
 +
 +    /* We are good to go */
 +    return QEMU_ARM_POWERCTL_RET_SUCCESS;
 +}
 +
  static void arm_set_cpu_off_async_work(CPUState *target_cpu_state,
                                         run_on_cpu_data data)
  {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 12/21] target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
+[Qemu-devel] [PULL 05/16] hw/misc/iotkit-sysctl: Correct typo in INITSVTOR0 register name
-From: Richard Henderson <richard.henderson@linaro.org>
+The iotkit-sysctl device has a register it names INITSVRTOR0.
 This is actually a typo present in the IoTKit documentation
 and also in part of the SSE-200 documentation:  it should be
 INITSVTOR0 because it is specifying the initial value of the
 Secure VTOR register in the CPU. Correct the typo.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-15-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190219125808.25174-6-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 35 +++++++++++++++++++----------------
+ include/hw/misc/iotkit-sysctl.h |  2 +-
-file changed, 19 insertions(+), 16 deletions(-)
+ hw/misc/iotkit-sysctl.c         | 16 ++++++++--------
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/misc/iotkit-sysctl.h
-+++ b/target/arm/helper.c
++++ b/include/hw/misc/iotkit-sysctl.h
-@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
      uint32_t reset_syndrome;
      uint32_t reset_mask;
      uint32_t gretreg;
 -    uint32_t initsvrtor0;
 +    uint32_t initsvtor0;
      uint32_t cpuwait;
      uint32_t wicctrl;
  } IoTKitSysCtl;
 diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/iotkit-sysctl.c
 +++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@ REG32(RESET_MASK, 0x104)
  REG32(SWRESET, 0x108)
      FIELD(SWRESET, SWRESETREQ, 9, 1)
  REG32(GRETREG, 0x10c)
 -REG32(INITSVRTOR0, 0x110)
 +REG32(INITSVTOR0, 0x110)
  REG32(CPUWAIT, 0x118)
  REG32(BUSWAIT, 0x11c)
  REG32(WICCTRL, 0x120)
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
      case A_GRETREG:
          r = s->gretreg;
          break;
 -    case A_INITSVRTOR0:
 -        r = s->initsvrtor0;
 +    case A_INITSVTOR0:
 +        r = s->initsvtor0;
          break;
      case A_CPUWAIT:
          r = s->cpuwait;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
           */
          s->gretreg = value;
          break;
 -    case A_INITSVRTOR0:
 -        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVRTOR0 unimplemented\n");
 -        s->initsvrtor0 = value;
 +    case A_INITSVTOR0:
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR0 unimplemented\n");
 +        s->initsvtor0 = value;
          break;
      case A_CPUWAIT:
          qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CPUWAIT unimplemented\n");
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
      s->reset_syndrome = 1;
      s->reset_mask = 0;
      s->gretreg = 0;
 -    s->initsvrtor0 = 0x10000000;
 +    s->initsvtor0 = 0x10000000;
      s->cpuwait = 0;
      s->wicctrl = 0;
  }
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
- void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+         VMSTATE_UINT32(reset_syndrome, IoTKitSysCtl),
--                          target_ulong *cs_base, uint32_t *flags)
+         VMSTATE_UINT32(reset_mask, IoTKitSysCtl),
-+                          target_ulong *cs_base, uint32_t *pflags)
+         VMSTATE_UINT32(gretreg, IoTKitSysCtl),
- {
+-        VMSTATE_UINT32(initsvrtor0, IoTKitSysCtl),
-     ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
++        VMSTATE_UINT32(initsvtor0, IoTKitSysCtl),
-+    uint32_t flags;
+         VMSTATE_UINT32(cpuwait, IoTKitSysCtl),
-+
+         VMSTATE_UINT32(wicctrl, IoTKitSysCtl),
-     if (is_a64(env)) {
+         VMSTATE_END_OF_LIST()
          *pc = env->pc;
 -        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
 +        flags = ARM_TBFLAG_AARCH64_STATE_MASK;
          /* Get control bits for tagged addresses */
 -        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
 -        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
 +        flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
 +        flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
      } else {
          *pc = env->regs[15];
 -        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
 +        flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
              | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
              | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
              | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
              | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
          if (!(access_secure_reg(env))) {
 -            *flags |= ARM_TBFLAG_NS_MASK;
 +            flags |= ARM_TBFLAG_NS_MASK;
          }
          if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
              || arm_el_is_aa64(env, 1)) {
 -            *flags |= ARM_TBFLAG_VFPEN_MASK;
 +            flags |= ARM_TBFLAG_VFPEN_MASK;
          }
 -        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 -                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 +        flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 +                  << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
      }
 -    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 +    flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
      /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
       * states defined in the ARM ARM for software singlestep:
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
       *     1            1       Active-not-pending
       */
      if (arm_singlestep_active(env)) {
 -        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
 +        flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
          if (is_a64(env)) {
              if (env->pstate & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
              }
          } else {
              if (env->uncached_cpsr & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
              }
          }
      }
      if (arm_cpu_data_is_big_endian(env)) {
 -        *flags |= ARM_TBFLAG_BE_DATA_MASK;
 +        flags |= ARM_TBFLAG_BE_DATA_MASK;
      }
 -    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
 +    flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
      if (arm_v7m_is_handler_mode(env)) {
 -        *flags |= ARM_TBFLAG_HANDLER_MASK;
 +        flags |= ARM_TBFLAG_HANDLER_MASK;
      }
 +    *pflags = flags;
      *cs_base = 0;
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 21/21] pl110: Implement vertical compare/next base interrupts
+[Qemu-devel] [PULL 06/16] hw/arm/iotkit-sysctl: Add SSE-200 registers
-From: Linus Walleij <linus.walleij@linaro.org>
+The SYSCTL block in the SSE-200 has some extra registers that
 are not present in the IoTKit version. Add these registers
 (as reads-as-written stubs), enabled by a new QOM property.
-This implements rudimentary support for interrupt generation on the
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-PL110. I am working on a new DRI/KMS driver for Linux and since that
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-uses the blanking interrupt, we need something to fire here. Without
+Message-id: 20190219125808.25174-7-peter.maydell@linaro.org
-any interrupt support Linux waits for a while and then gives ugly
+---
-messages about the vblank not working in the console (it does not
+ include/hw/misc/iotkit-sysctl.h |  20 +++
-hang perpetually or anything though, DRI is pretty forgiving).
+ hw/arm/armsse.c                 |   2 +
  hw/misc/iotkit-sysctl.c         | 245 +++++++++++++++++++++++++++++++-
 files changed, 262 insertions(+), 5 deletions(-)
-I solved it for now by setting up a timer to fire at 60Hz and pull
+diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
 the interrupts for "vertical compare" and "next memory base"
 at this interval. This works fine and fires roughly the same number
 of IRQs on QEMU as on the hardware and leaves the console clean
 and nice.
 People who want to create more accurate emulation can probably work
 on top of this if need be. It is certainly closer to the hardware
 behaviour than what we have today anyway.
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
 Message-id: 20180123225654.5764-1-linus.walleij@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: folded long lines]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/display/pl110.c | 30 +++++++++++++++++++++++++++++-
 file changed, 29 insertions(+), 1 deletion(-)
 diff --git a/hw/display/pl110.c b/hw/display/pl110.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/display/pl110.c
+--- a/include/hw/misc/iotkit-sysctl.h
-+++ b/hw/display/pl110.c
++++ b/include/hw/misc/iotkit-sysctl.h
 @@ -XXX,XX +XXX,XX @@
- #include "ui/console.h"
+  * "system control register" blocks.
- #include "framebuffer.h"
+  *
- #include "ui/pixel_ops.h"
+  * QEMU interface:
-+#include "qemu/timer.h"
++ *  + QOM property "SYS_VERSION": value of the SYS_VERSION register of the
 + *    system information block of the SSE
 + *    (used to identify whether to provide SSE-200-only registers)
   *  + sysbus MMIO region 0: the system information register bank
   *  + sysbus MMIO region 1: the system control register bank
   */
@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
      uint32_t initsvtor0;
      uint32_t cpuwait;
      uint32_t wicctrl;
 +    uint32_t scsecctrl;
 +    uint32_t fclk_div;
 +    uint32_t sysclk_div;
 +    uint32_t clock_force;
 +    uint32_t initsvtor1;
 +    uint32_t nmi_enable;
 +    uint32_t ewctrl;
 +    uint32_t pdcm_pd_sys_sense;
 +    uint32_t pdcm_pd_sram0_sense;
 +    uint32_t pdcm_pd_sram1_sense;
 +    uint32_t pdcm_pd_sram2_sense;
 +    uint32_t pdcm_pd_sram3_sense;
 +
 +    /* Properties */
 +    uint32_t sys_version;
 +
 +    bool is_sse200;
  } IoTKitSysCtl;
  #endif
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* System information registers */
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000);
      /* System control registers */
 +    object_property_set_int(OBJECT(&s->sysctl), info->sys_version,
 +                            "SYS_VERSION", &err);
      object_property_set_bool(OBJECT(&s->sysctl), true, "realized", &err);
      if (err) {
          error_propagate(errp, err);
 diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/iotkit-sysctl.c
 +++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qemu/bitops.h"
  #include "qemu/log.h"
+ #include "trace.h"
- #define PL110_CR_EN   0x001
+ #include "qapi/error.h"
 @@ -XXX,XX +XXX,XX @@
- #define PL110_CR_BEBO 0x200
+ REG32(SECDBGSTAT, 0x0)
- #define PL110_CR_BEPO 0x400
+ REG32(SECDBGSET, 0x4)
- #define PL110_CR_PWR  0x800
+ REG32(SECDBGCLR, 0x8)
-+#define PL110_IE_NB   0x004
++REG32(SCSECCTRL, 0xc)
-+#define PL110_IE_VC   0x008
++REG32(FCLK_DIV, 0x10)
++REG32(SYSCLK_DIV, 0x14)
- enum pl110_bppmode
++REG32(CLOCK_FORCE, 0x18)
- {
+ REG32(RESET_SYNDROME, 0x100)
-@@ -XXX,XX +XXX,XX @@ typedef struct PL110State {
+ REG32(RESET_MASK, 0x104)
-     MemoryRegion iomem;
+ REG32(SWRESET, 0x108)
-     MemoryRegionSection fbsection;
+     FIELD(SWRESET, SWRESETREQ, 9, 1)
-     QemuConsole *con;
+ REG32(GRETREG, 0x10c)
-+    QEMUTimer *vblank_timer;
+ REG32(INITSVTOR0, 0x110)
++REG32(INITSVTOR1, 0x114)
-     int version;
+ REG32(CPUWAIT, 0x118)
-     uint32_t timing[4];
+-REG32(BUSWAIT, 0x11c)
-@@ -XXX,XX +XXX,XX @@ static void pl110_resize(PL110State *s, int width, int height)
++REG32(NMI_ENABLE, 0x11c) /* BUSWAIT in IoTKit */
- /* Update interrupts.  */
+ REG32(WICCTRL, 0x120)
- static void pl110_update(PL110State *s)
++REG32(EWCTRL, 0x124)
- {
++REG32(PDCM_PD_SYS_SENSE, 0x200)
--  /* TODO: Implement interrupts.  */
++REG32(PDCM_PD_SRAM0_SENSE, 0x20c)
-+    /* Raise IRQ if enabled and any status bit is 1 */
++REG32(PDCM_PD_SRAM1_SENSE, 0x210)
-+    if (s->int_status & s->int_mask) {
++REG32(PDCM_PD_SRAM2_SENSE, 0x214)
-+        qemu_irq_raise(s->irq);
++REG32(PDCM_PD_SRAM3_SENSE, 0x218)
-+    } else {
+ REG32(PID4, 0xfd0)
-+        qemu_irq_lower(s->irq);
+ REG32(PID5, 0xfd4)
  REG32(PID6, 0xfd8)
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
      case A_SECDBGSTAT:
          r = s->secure_debug;
          break;
 +    case A_SCSECCTRL:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->scsecctrl;
 +        break;
 +    case A_FCLK_DIV:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->fclk_div;
 +        break;
 +    case A_SYSCLK_DIV:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->sysclk_div;
 +        break;
 +    case A_CLOCK_FORCE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->clock_force;
 +        break;
      case A_RESET_SYNDROME:
          r = s->reset_syndrome;
          break;
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
      case A_INITSVTOR0:
          r = s->initsvtor0;
          break;
 +    case A_INITSVTOR1:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->initsvtor1;
 +        break;
      case A_CPUWAIT:
          r = s->cpuwait;
          break;
 -    case A_BUSWAIT:
 -        /* In IoTKit BUSWAIT is reserved, R/O, zero */
 -        r = 0;
 +    case A_NMI_ENABLE:
 +        /* In IoTKit this is named BUSWAIT but is marked reserved, R/O, zero */
 +        if (!s->is_sse200) {
 +            r = 0;
 +            break;
 +        }
 +        r = s->nmi_enable;
          break;
      case A_WICCTRL:
          r = s->wicctrl;
          break;
 +    case A_EWCTRL:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->ewctrl;
 +        break;
 +    case A_PDCM_PD_SYS_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->pdcm_pd_sys_sense;
 +        break;
 +    case A_PDCM_PD_SRAM0_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->pdcm_pd_sram0_sense;
 +        break;
 +    case A_PDCM_PD_SRAM1_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->pdcm_pd_sram1_sense;
 +        break;
 +    case A_PDCM_PD_SRAM2_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->pdcm_pd_sram2_sense;
 +        break;
 +    case A_PDCM_PD_SRAM3_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        r = s->pdcm_pd_sram3_sense;
 +        break;
      case A_PID4 ... A_CID3:
          r = sysctl_id[(offset - A_PID4) / 4];
          break;
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
          r = 0;
          break;
      default:
 +    bad_offset:
          qemu_log_mask(LOG_GUEST_ERROR,
                        "IoTKit SysCtl read: bad offset %x\n", (int)offset);
          r = 0;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
              qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
          }
          break;
 -    case A_BUSWAIT:        /* In IoTKit BUSWAIT is reserved, R/O, zero */
 +    case A_SCSECCTRL:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n");
 +        s->scsecctrl = value;
 +        break;
 +    case A_FCLK_DIV:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n");
 +        s->fclk_div = value;
 +        break;
 +    case A_SYSCLK_DIV:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n");
 +        s->sysclk_div = value;
 +        break;
 +    case A_CLOCK_FORCE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n");
 +        s->clock_force = value;
 +        break;
 +    case A_INITSVTOR1:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR1 unimplemented\n");
 +        s->initsvtor1 = value;
 +        break;
 +    case A_EWCTRL:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl EWCTRL unimplemented\n");
 +        s->ewctrl = value;
 +        break;
 +    case A_PDCM_PD_SYS_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n");
 +        s->pdcm_pd_sys_sense = value;
 +        break;
 +    case A_PDCM_PD_SRAM0_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SysCtl PDCM_PD_SRAM0_SENSE unimplemented\n");
 +        s->pdcm_pd_sram0_sense = value;
 +        break;
 +    case A_PDCM_PD_SRAM1_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SysCtl PDCM_PD_SRAM1_SENSE unimplemented\n");
 +        s->pdcm_pd_sram1_sense = value;
 +        break;
 +    case A_PDCM_PD_SRAM2_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SysCtl PDCM_PD_SRAM2_SENSE unimplemented\n");
 +        s->pdcm_pd_sram2_sense = value;
 +        break;
 +    case A_PDCM_PD_SRAM3_SENSE:
 +        if (!s->is_sse200) {
 +            goto bad_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP,
 +                      "IoTKit SysCtl PDCM_PD_SRAM3_SENSE unimplemented\n");
 +        s->pdcm_pd_sram3_sense = value;
 +        break;
 +    case A_NMI_ENABLE:
 +        /* In IoTKit this is BUSWAIT: reserved, R/O, zero */
 +        if (!s->is_sse200) {
 +            goto ro_offset;
 +        }
 +        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n");
 +        s->nmi_enable = value;
 +        break;
      case A_SECDBGSTAT:
      case A_PID4 ... A_CID3:
 +    ro_offset:
          qemu_log_mask(LOG_GUEST_ERROR,
                        "IoTKit SysCtl write: write of RO offset %x\n",
                        (int)offset);
          break;
      default:
 +    bad_offset:
          qemu_log_mask(LOG_GUEST_ERROR,
                        "IoTKit SysCtl write: bad offset %x\n", (int)offset);
          break;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
      s->reset_mask = 0;
      s->gretreg = 0;
      s->initsvtor0 = 0x10000000;
 +    s->initsvtor1 = 0x10000000;
      s->cpuwait = 0;
      s->wicctrl = 0;
 +    s->scsecctrl = 0;
 +    s->fclk_div = 0;
 +    s->sysclk_div = 0;
 +    s->clock_force = 0;
 +    s->nmi_enable = 0;
 +    s->ewctrl = 0;
 +    s->pdcm_pd_sys_sense = 0x7f;
 +    s->pdcm_pd_sram0_sense = 0;
 +    s->pdcm_pd_sram1_sense = 0;
 +    s->pdcm_pd_sram2_sense = 0;
 +    s->pdcm_pd_sram3_sense = 0;
  }
  static void iotkit_sysctl_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_init(Object *obj)
      sysbus_init_mmio(sbd, &s->iomem);
  }
 +static void iotkit_sysctl_realize(DeviceState *dev, Error **errp)
 +{
 +    IoTKitSysCtl *s = IOTKIT_SYSCTL(dev);
 +
 +    /* The top 4 bits of the SYS_VERSION register tell us if we're an SSE-200 */
 +    if (extract32(s->sys_version, 28, 4) == 2) {
 +        s->is_sse200 = true;
 +    }
 +}
 +
-+static void pl110_vblank_interrupt(void *opaque)
++static bool sse200_needed(void *opaque)
 +{
-+    PL110State *s = opaque;
++    IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque);
 +
-+    /* Fire the vertical compare and next base IRQs and re-arm */
++    return s->is_sse200;
-+    s->int_status |= (PL110_IE_NB | PL110_IE_VC);
++}
-+    timer_mod(s->vblank_timer,
++
-+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
++static const VMStateDescription iotkit_sysctl_sse200_vmstate = {
-+                                NANOSECONDS_PER_SECOND / 60);
++    .name = "iotkit-sysctl/sse-200",
-+    pl110_update(s);
++    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = sse200_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(scsecctrl, IoTKitSysCtl),
 +        VMSTATE_UINT32(fclk_div, IoTKitSysCtl),
 +        VMSTATE_UINT32(sysclk_div, IoTKitSysCtl),
 +        VMSTATE_UINT32(clock_force, IoTKitSysCtl),
 +        VMSTATE_UINT32(initsvtor1, IoTKitSysCtl),
 +        VMSTATE_UINT32(nmi_enable, IoTKitSysCtl),
 +        VMSTATE_UINT32(pdcm_pd_sys_sense, IoTKitSysCtl),
 +        VMSTATE_UINT32(pdcm_pd_sram0_sense, IoTKitSysCtl),
 +        VMSTATE_UINT32(pdcm_pd_sram1_sense, IoTKitSysCtl),
 +        VMSTATE_UINT32(pdcm_pd_sram2_sense, IoTKitSysCtl),
 +        VMSTATE_UINT32(pdcm_pd_sram3_sense, IoTKitSysCtl),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription iotkit_sysctl_vmstate = {
      .name = "iotkit-sysctl",
      .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
          VMSTATE_UINT32(cpuwait, IoTKitSysCtl),
          VMSTATE_UINT32(wicctrl, IoTKitSysCtl),
          VMSTATE_END_OF_LIST()
 +    },
 +    .subsections = (const VMStateDescription*[]) {
 +        &iotkit_sysctl_sse200_vmstate,
 +        NULL
      }
  };
 +static Property iotkit_sysctl_props[] = {
 +    DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysCtl, sys_version, 0),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
  static void iotkit_sysctl_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      dc->vmsd = &iotkit_sysctl_vmstate;
      dc->reset = iotkit_sysctl_reset;
 +    dc->props = iotkit_sysctl_props;
 +    dc->realize = iotkit_sysctl_realize;
  }
- static uint64_t pl110_read(void *opaque, hwaddr offset,
+ static const TypeInfo iotkit_sysctl_info = {
@@ -XXX,XX +XXX,XX @@ static void pl110_write(void *opaque, hwaddr offset,
          s->bpp = (val >> 1) & 7;
          if (pl110_enabled(s)) {
              qemu_console_resize(s->con, s->cols, s->rows);
 +            timer_mod(s->vblank_timer,
 +                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +                                        NANOSECONDS_PER_SECOND / 60);
 +        } else {
 +            timer_del(s->vblank_timer);
          }
          break;
      case 10: /* LCDICR */
@@ -XXX,XX +XXX,XX @@ static void pl110_realize(DeviceState *dev, Error **errp)
      memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
      sysbus_init_mmio(sbd, &s->iomem);
      sysbus_init_irq(sbd, &s->irq);
 +    s->vblank_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
 +                                   pl110_vblank_interrupt, s);
      qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
      s->con = graphic_console_init(dev, 0, &pl110_gfx_ops, s);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 18/21] hw/arm/virt: Check that the CPU realize method succeeded
+[Qemu-devel] [PULL 07/16] hw/arm/iotkit-sysctl: Implement CPUWAIT and INITSVTOR*
-We were passing a NULL error pointer to the object_property_set_bool()
+The CPUWAIT register acts as a sort of power-control: if a bit
-call that realizes the CPU object. This meant that we wouldn't detect
+in it is 1 then the CPU will have been forced into waiting
-failure, and would plough blindly on to crash later trying to use a
+when the system was reset (which in QEMU we model as the
-NULL CPU object pointer. Detect errors and fail instead.
+CPU starting powered off). Writing a 0 to the register will
 allow the CPU to boot (for QEMU, we model this as powering
 it on). Note that writing 0 to the register does not power
 off a CPU.
-In particular, this will be necessary to detect the user error
+For this to work correctly we need to also honour the
-of using "-cpu host" without "-enable-kvm" once we make the host
+INITSVTOR* registers, which let the guest control where the
-CPU type be registered unconditionally rather than only in
+CPU will load its SP and PC from when it comes out of reset.
 kvm_arch_init().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190219125808.25174-8-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 2 +-
+ hw/misc/iotkit-sysctl.c | 41 +++++++++++++++++++++++++++++++++++++----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 37 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/hw/misc/iotkit-sysctl.c
-+++ b/hw/arm/virt.c
++++ b/hw/misc/iotkit-sysctl.c
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@
-                                      "secure-memory", &error_abort);
+ #include "hw/sysbus.h"
  #include "hw/registerfields.h"
  #include "hw/misc/iotkit-sysctl.h"
 +#include "target/arm/arm-powerctl.h"
 +#include "target/arm/cpu.h"
  REG32(SECDBGSTAT, 0x0)
  REG32(SECDBGSET, 0x4)
@@ -XXX,XX +XXX,XX @@ static const int sysctl_id[] = {
 x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
  };
 +/*
 + * Set the initial secure vector table offset address for the core.
 + * This will take effect when the CPU next resets.
 + */
 +static void set_init_vtor(uint64_t cpuid, uint32_t vtor)
 +{
 +    Object *cpuobj = OBJECT(arm_get_cpu_by_id(cpuid));
 +
 +    if (cpuobj) {
 +        if (object_property_find(cpuobj, "init-svtor", NULL)) {
 +            object_property_set_uint(cpuobj, vtor, "init-svtor", &error_abort);
 +        }
 +    }
 +}
 +
  static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
                                      unsigned size)
  {
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
          s->gretreg = value;
          break;
      case A_INITSVTOR0:
 -        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR0 unimplemented\n");
          s->initsvtor0 = value;
 +        set_init_vtor(0, s->initsvtor0);
          break;
      case A_CPUWAIT:
 -        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CPUWAIT unimplemented\n");
 +        if ((s->cpuwait & 1) && !(value & 1)) {
 +            /* Powering up CPU 0 */
 +            arm_set_cpu_on_and_reset(0);
 +        }
 +        if ((s->cpuwait & 2) && !(value & 2)) {
 +            /* Powering up CPU 1 */
 +            arm_set_cpu_on_and_reset(1);
 +        }
          s->cpuwait = value;
          break;
      case A_WICCTRL:
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
          if (!s->is_sse200) {
              goto bad_offset;
          }
+-        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR1 unimplemented\n");
--        object_property_set_bool(cpuobj, true, "realized", NULL);
+         s->initsvtor1 = value;
-+        object_property_set_bool(cpuobj, true, "realized", &error_fatal);
++        set_init_vtor(1, s->initsvtor1);
-         object_unref(cpuobj);
+         break;
-     }
+     case A_EWCTRL:
-     fdt_add_timer_nodes(vms);
+         if (!s->is_sse200) {
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
      s->gretreg = 0;
      s->initsvtor0 = 0x10000000;
      s->initsvtor1 = 0x10000000;
 -    s->cpuwait = 0;
 +    if (s->is_sse200) {
 +        /*
 +         * CPU 0 starts on, CPU 1 starts off. In real hardware this is
 +         * configurable by the SoC integrator as a verilog parameter.
 +         */
 +        s->cpuwait = 2;
 +    } else {
 +        /* CPU 0 starts on */
 +        s->cpuwait = 0;
 +    }
      s->wicctrl = 0;
      s->scsecctrl = 0;
      s->fclk_div = 0;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 09/21] vmstate: Add VMSTATE_UINT64_SUB_ARRAY
+[Qemu-devel] [PULL 08/16] hw/arm/armsse: Unify init-svtor and cpuwait handling
-From: Richard Henderson <richard.henderson@linaro.org>
+At the moment the handling of init-svtor and cpuwait initial
 values is split between armsse.c and iotkit-sysctl.c:
 the code in armsse.c sets the initial state of the CPU
 object by setting the init-svtor and start-powered-off
 properties, but the iotkit-sysctl.c code has its own
 code setting the reset values of its registers (which are
 then used when updating the CPU when the guest makes
 runtime changes).
-At the same time, move VMSTATE_UINT32_SUB_ARRAY
+Clean this up by making the armsse.c code set properties on the
-beside the other UINT32 definitions.
+iotkit-sysctl object to define the initial values of the
 registers, so they always match the initial CPU state,
 and update the comments in armsse.c accordingly.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-8-richard.henderson@linaro.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190219125808.25174-9-peter.maydell@linaro.org
 ---
- include/migration/vmstate.h | 9 ++++++---
+ include/hw/misc/iotkit-sysctl.h |  3 ++
-file changed, 6 insertions(+), 3 deletions(-)
+ hw/arm/armsse.c                 | 49 +++++++++++++++++++++------------
  hw/misc/iotkit-sysctl.c         | 20 ++++++--------
 files changed, 42 insertions(+), 30 deletions(-)
-diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/migration/vmstate.h
+--- a/include/hw/misc/iotkit-sysctl.h
-+++ b/include/migration/vmstate.h
++++ b/include/hw/misc/iotkit-sysctl.h
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
- #define VMSTATE_UINT32_ARRAY(_f, _s, _n)                              \
-     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, 0)
+     /* Properties */
+     uint32_t sys_version;
-+#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
++    uint32_t cpuwait_rst;
-+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
++    uint32_t initsvtor0_rst;
-+
++    uint32_t initsvtor1_rst;
- #define VMSTATE_UINT32_2DARRAY(_f, _s, _n1, _n2)                      \
-     VMSTATE_UINT32_2DARRAY_V(_f, _s, _n1, _n2, 0)
+     bool is_sse200;
+ } IoTKitSysCtl;
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
- #define VMSTATE_UINT64_ARRAY(_f, _s, _n)                              \
+index XXXXXXX..XXXXXXX 100644
-     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, 0)
+--- a/hw/arm/armsse.c
++++ b/hw/arm/armsse.c
-+#define VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)                \
+@@ -XXX,XX +XXX,XX @@
-+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint64, uint64_t)
-+
+ #include "qemu/osdep.h"
- #define VMSTATE_UINT64_2DARRAY(_f, _s, _n1, _n2)                      \
+ #include "qemu/log.h"
-     VMSTATE_UINT64_2DARRAY_V(_f, _s, _n1, _n2, 0)
++#include "qemu/bitops.h"
+ #include "qapi/error.h"
-@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
+ #include "trace.h"
- #define VMSTATE_INT32_ARRAY(_f, _s, _n)                               \
+ #include "hw/sysbus.h"
-     VMSTATE_INT32_ARRAY_V(_f, _s, _n, 0)
+@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
+     int sram_banks;
--#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
+     int num_cpus;
--    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
+     uint32_t sys_version;
--
++    uint32_t cpuwait_rst;
- #define VMSTATE_INT64_ARRAY_V(_f, _s, _n, _v)                         \
+     SysConfigFormat sys_config_format;
-     VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_int64, int64_t)
+     bool has_mhus;
      bool has_ppus;
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
          .sram_banks = 1,
          .num_cpus = 1,
          .sys_version = 0x41743,
 +        .cpuwait_rst = 0,
          .sys_config_format = IoTKitFormat,
          .has_mhus = false,
          .has_ppus = false,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
          .sram_banks = 4,
          .num_cpus = 2,
          .sys_version = 0x22041743,
 +        .cpuwait_rst = 2,
          .sys_config_format = SSE200Format,
          .has_mhus = true,
          .has_ppus = true,
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
          qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + 32);
          /*
 -         * In real hardware the initial Secure VTOR is set from the INITSVTOR0
 -         * register in the IoT Kit System Control Register block, and the
 -         * initial value of that is in turn specifiable by the FPGA that
 -         * instantiates the IoT Kit. In QEMU we don't implement this wrinkle,
 -         * and simply set the CPU's init-svtor to the IoT Kit default value.
 -         * In SSE-200 the situation is similar, except that the default value
 -         * is a reset-time signal input. Typically a board using the SSE-200
 -         * will have a system control processor whose boot firmware initializes
 -         * the INITSVTOR* registers before powering up the CPUs in any case,
 -         * so the hardware's default value doesn't matter. QEMU doesn't emulate
 +         * In real hardware the initial Secure VTOR is set from the INITSVTOR*
 +         * registers in the IoT Kit System Control Register block. In QEMU
 +         * we set the initial value here, and also the reset value of the
 +         * sysctl register, from this object's QOM init-svtor property.
 +         * If the guest changes the INITSVTOR* registers at runtime then the
 +         * code in iotkit-sysctl.c will update the CPU init-svtor property
 +         * (which will then take effect on the next CPU warm-reset).
 +         *
 +         * Note that typically a board using the SSE-200 will have a system
 +         * control processor whose boot firmware initializes the INITSVTOR*
 +         * registers before powering up the CPUs. QEMU doesn't emulate
           * the control processor, so instead we behave in the way that the
 -         * firmware does. The initial value is configurable by the board code
 -         * to match whatever its firmware does.
 +         * firmware does: the initial value should be set by the board code
 +         * (using the init-svtor property on the ARMSSE object) to match
 +         * whatever its firmware does.
           */
          qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor);
          /*
 -         * Start all CPUs except CPU0 powered down. In real hardware it is
 -         * a configurable property of the SSE-200 which CPUs start powered up
 -         * (via the CPUWAIT0_RST and CPUWAIT1_RST parameters), but since all
 -         * the boards we care about start CPU0 and leave CPU1 powered off,
 -         * we hard-code that for now. We can add QOM properties for this
 +         * CPUs start powered down if the corresponding bit in the CPUWAIT
 +         * register is 1. In real hardware the CPUWAIT register reset value is
 +         * a configurable property of the SSE-200 (via the CPUWAIT0_RST and
 +         * CPUWAIT1_RST parameters), but since all the boards we care about
 +         * start CPU0 and leave CPU1 powered off, we hard-code that in
 +         * info->cpuwait_rst for now. We can add QOM properties for this
           * later if necessary.
           */
 -        if (i > 0) {
 +        if (extract32(info->cpuwait_rst, i, 1)) {
              object_property_set_bool(cpuobj, true, "start-powered-off", &err);
              if (err) {
                  error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
      /* System control registers */
      object_property_set_int(OBJECT(&s->sysctl), info->sys_version,
                              "SYS_VERSION", &err);
 +    object_property_set_int(OBJECT(&s->sysctl), info->cpuwait_rst,
 +                            "CPUWAIT_RST", &err);
 +    object_property_set_int(OBJECT(&s->sysctl), s->init_svtor,
 +                            "INITSVTOR0_RST", &err);
 +    object_property_set_int(OBJECT(&s->sysctl), s->init_svtor,
 +                            "INITSVTOR1_RST", &err);
      object_property_set_bool(OBJECT(&s->sysctl), true, "realized", &err);
      if (err) {
          error_propagate(errp, err);
 diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/iotkit-sysctl.c
 +++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
      s->reset_syndrome = 1;
      s->reset_mask = 0;
      s->gretreg = 0;
 -    s->initsvtor0 = 0x10000000;
 -    s->initsvtor1 = 0x10000000;
 -    if (s->is_sse200) {
 -        /*
 -         * CPU 0 starts on, CPU 1 starts off. In real hardware this is
 -         * configurable by the SoC integrator as a verilog parameter.
 -         */
 -        s->cpuwait = 2;
 -    } else {
 -        /* CPU 0 starts on */
 -        s->cpuwait = 0;
 -    }
 +    s->initsvtor0 = s->initsvtor0_rst;
 +    s->initsvtor1 = s->initsvtor1_rst;
 +    s->cpuwait = s->cpuwait_rst;
      s->wicctrl = 0;
      s->scsecctrl = 0;
      s->fclk_div = 0;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
  static Property iotkit_sysctl_props[] = {
      DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysCtl, sys_version, 0),
 +    DEFINE_PROP_UINT32("CPUWAIT_RST", IoTKitSysCtl, cpuwait_rst, 0),
 +    DEFINE_PROP_UINT32("INITSVTOR0_RST", IoTKitSysCtl, initsvtor0_rst,
 +                       0x10000000),
 +    DEFINE_PROP_UINT32("INITSVTOR1_RST", IoTKitSysCtl, initsvtor1_rst,
 +                       0x10000000),
      DEFINE_PROP_END_OF_LIST()
  };
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/21] target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
+[Qemu-devel] [PULL 09/16] target/arm: Use MVFR1 feature bits to gate A32/T32 FP16 instructions
-From: Richard Henderson <richard.henderson@linaro.org>
+Instead of gating the A32/T32 FP16 conversion instructions on
 the ARM_FEATURE_VFP_FP16 flag, switch to our new approach of
 looking at ID register bits. In this case MVFR1 fields FPHP
 and SIMDHP indicate the presence of these insns.
-Helpers that return a pointer into env->vfp.regs so that we isolate
+This change doesn't alter behaviour for any of our CPUs.
 the logic of how to index the regs array for different cpu modes.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-7-richard.henderson@linaro.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190222170936.13268-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h           | 27 +++++++++++++++++++++++++++
+ target/arm/cpu.h       | 37 ++++++++++++++++++++++++++++++++++++-
- linux-user/signal.c        | 22 ++++++++++++----------
+ target/arm/cpu.c       |  2 --
- target/arm/arch_dump.c     |  8 +++++---
+ target/arm/kvm32.c     |  3 ---
- target/arm/helper-a64.c    |  5 +++--
+ target/arm/translate.c | 26 ++++++++++++++++++--------
- target/arm/helper.c        | 32 ++++++++++++++++++++------------
+files changed, 54 insertions(+), 14 deletions(-)
  target/arm/kvm32.c         |  4 ++--
  target/arm/kvm64.c         | 31 ++++++++++---------------------
  target/arm/translate-a64.c | 25 ++++++++-----------------
  target/arm/translate.c     | 16 +++++++++-------
 files changed, 96 insertions(+), 74 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ FIELD(ID_DFR0, MPROFDBG, 20, 4)
-     return cpu->el_change_hook_opaque;
+ FIELD(ID_DFR0, PERFMON, 24, 4)
  FIELD(ID_DFR0, TRACEFILT, 28, 4)
 +FIELD(MVFR0, SIMDREG, 0, 4)
 +FIELD(MVFR0, FPSP, 4, 4)
 +FIELD(MVFR0, FPDP, 8, 4)
 +FIELD(MVFR0, FPTRAP, 12, 4)
 +FIELD(MVFR0, FPDIVIDE, 16, 4)
 +FIELD(MVFR0, FPSQRT, 20, 4)
 +FIELD(MVFR0, FPSHVEC, 24, 4)
 +FIELD(MVFR0, FPROUND, 28, 4)
 +
 +FIELD(MVFR1, FPFTZ, 0, 4)
 +FIELD(MVFR1, FPDNAN, 4, 4)
 +FIELD(MVFR1, SIMDLS, 8, 4)
 +FIELD(MVFR1, SIMDINT, 12, 4)
 +FIELD(MVFR1, SIMDSP, 16, 4)
 +FIELD(MVFR1, SIMDHP, 20, 4)
 +FIELD(MVFR1, FPHP, 24, 4)
 +FIELD(MVFR1, SIMDFMAC, 28, 4)
 +
 +FIELD(MVFR2, SIMDMISC, 0, 4)
 +FIELD(MVFR2, FPMISC, 4, 4)
 +
  QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
  /* If adding a feature bit which corresponds to a Linux ELF
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_THUMB2,
      ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
      ARM_FEATURE_VFP3,
 -    ARM_FEATURE_VFP_FP16,
      ARM_FEATURE_NEON,
      ARM_FEATURE_M, /* Microcontroller profile.  */
      ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
  }
-+/**
++/*
-+ * aa32_vfp_dreg:
++ * We always set the FP and SIMD FP16 fields to indicate identical
-+ * Return a pointer to the Dn register within env in 32-bit mode.
++ * levels of support (assuming SIMD is implemented at all), so
 + * we only need one set of accessors.
 + */
-+static inline uint64_t *aa32_vfp_dreg(CPUARMState *env, unsigned regno)
++static inline bool isar_feature_aa32_fp16_spconv(const ARMISARegisters *id)
 +{
-+    return &env->vfp.regs[regno];
++    return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 0;
 +}
 +
-+/**
++static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
 + * aa32_vfp_qreg:
 + * Return a pointer to the Qn register within env in 32-bit mode.
 + */
 +static inline uint64_t *aa32_vfp_qreg(CPUARMState *env, unsigned regno)
 +{
-+    return &env->vfp.regs[2 * regno];
++    return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 1;
 +}
 +
-+/**
+ /*
-+ * aa64_vfp_qreg:
+  * 64-bit feature tests via id registers.
-+ * Return a pointer to the Qn register within env in 64-bit mode.
+  */
-+ */
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 +static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
 +{
 +    return &env->vfp.regs[2 * regno];
 +}
 +
  #endif
 diff --git a/linux-user/signal.c b/linux-user/signal.c
 index XXXXXXX..XXXXXXX 100644
---- a/linux-user/signal.c
+--- a/target/arm/cpu.c
-+++ b/linux-user/signal.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static int target_setup_sigframe(struct target_rt_sigframe *sf,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      }
+     if (arm_feature(env, ARM_FEATURE_VFP4)) {
-     for (i = 0; i < 32; i++) {
+         set_feature(env, ARM_FEATURE_VFP3);
-+        uint64_t *q = aa64_vfp_qreg(env, i);
+-        set_feature(env, ARM_FEATURE_VFP_FP16);
  #ifdef TARGET_WORDS_BIGENDIAN
 -        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
 -        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
 +        __put_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __put_user(q[1], &aux->fpsimd.vregs[i * 2]);
  #else
 -        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
 -        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __put_user(q[0], &aux->fpsimd.vregs[i * 2]);
 +        __put_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
  #endif
      }
-     __put_user(vfp_get_fpsr(env), &aux->fpsimd.fpsr);
+     if (arm_feature(env, ARM_FEATURE_VFP3)) {
-@@ -XXX,XX +XXX,XX @@ static int target_restore_sigframe(CPUARMState *env,
+         set_feature(env, ARM_FEATURE_VFP);
-     }
+@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
+     cpu->dtb_compatible = "arm,cortex-a9";
-     for (i = 0; i < 32; i++) {
+     set_feature(&cpu->env, ARM_FEATURE_V7);
-+        uint64_t *q = aa64_vfp_qreg(env, i);
+     set_feature(&cpu->env, ARM_FEATURE_VFP3);
- #ifdef TARGET_WORDS_BIGENDIAN
+-    set_feature(&cpu->env, ARM_FEATURE_VFP_FP16);
--        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
+     set_feature(&cpu->env, ARM_FEATURE_NEON);
--        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
+     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
-+        __get_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
+     set_feature(&cpu->env, ARM_FEATURE_EL3);
 +        __get_user(q[1], &aux->fpsimd.vregs[i * 2]);
  #else
 -        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
 -        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
 +        __get_user(q[0], &aux->fpsimd.vregs[i * 2]);
 +        __get_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
  #endif
      }
      __get_user(fpsr, &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *setup_sigframe_v2_vfp(abi_ulong *regspace, CPUARMState *env)
      __put_user(TARGET_VFP_MAGIC, &vfpframe->magic);
      __put_user(sizeof(*vfpframe), &vfpframe->size);
      for (i = 0; i < 32; i++) {
 -        __put_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
 +        __put_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
      }
      __put_user(vfp_get_fpscr(env), &vfpframe->ufp.fpscr);
      __put_user(env->vfp.xregs[ARM_VFP_FPEXC], &vfpframe->ufp_exc.fpexc);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *restore_sigframe_v2_vfp(CPUARMState *env, abi_ulong *regspace)
          return 0;
      }
      for (i = 0; i < 32; i++) {
 -        __get_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
 +        __get_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
      }
      __get_user(fpscr, &vfpframe->ufp.fpscr);
      vfp_set_fpscr(env, fpscr);
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arch_dump.c
 +++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
      aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 -    for (i = 0; i < 64; ++i) {
 -        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
 +    for (i = 0; i < 32; ++i) {
 +        uint64_t *q = aa64_vfp_qreg(env, i);
 +        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
 +        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
      }
      if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
      arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
      for (i = 0; i < 32; ++i) {
 -        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
 +        note.vfp.vregs[i] = cpu_to_dump64(s, *aa32_vfp_dreg(env, i));
      }
      note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(simd_tbl)(CPUARMState *env, uint64_t result, uint64_t indices,
          if (index < 16 * numregs) {
              /* Convert index (a byte offset into the virtual table
               * which is a series of 128-bit vectors concatenated)
 -             * into the correct vfp.regs[] element plus a bit offset
 +             * into the correct register element plus a bit offset
               * into that element, bearing in mind that the table
               * can wrap around from V31 to V0.
               */
              int elt = (rn * 2 + (index >> 3)) % 64;
              int bitidx = (index & 7) * 8;
 -            uint64_t val = extract64(env->vfp.regs[elt], bitidx, 8);
 +            uint64_t *q = aa64_vfp_qreg(env, elt >> 1);
 +            uint64_t val = extract64(q[elt & 1], bitidx, 8);
              result = deposit64(result, shift, 8, val);
          }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      /* VFP data registers are always little-endian.  */
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        stq_le_p(buf, env->vfp.regs[reg]);
 +        stq_le_p(buf, *aa32_vfp_dreg(env, reg));
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          /* Aliases for Q regs.  */
          nregs += 16;
          if (reg < nregs) {
 -            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
 -            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
 +            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
 +            stq_le_p(buf, q[0]);
 +            stq_le_p(buf + 8, q[1]);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
      if (reg < nregs) {
 -        env->vfp.regs[reg] = ldq_le_p(buf);
 +        *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
          return 8;
      }
      if (arm_feature(env, ARM_FEATURE_NEON)) {
          nregs += 16;
          if (reg < nregs) {
 -            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
 -            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
 +            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
 +            q[0] = ldq_le_p(buf);
 +            q[1] = ldq_le_p(buf + 8);
              return 16;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        stq_le_p(buf, env->vfp.regs[reg * 2]);
 -        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
 -        return 16;
 +        {
 +            uint64_t *q = aa64_vfp_qreg(env, reg);
 +            stq_le_p(buf, q[0]);
 +            stq_le_p(buf + 8, q[1]);
 +            return 16;
 +        }
      case 32:
          /* FPSR */
          stl_p(buf, vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        env->vfp.regs[reg * 2] = ldq_le_p(buf);
 -        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
 -        return 16;
 +        {
 +            uint64_t *q = aa64_vfp_qreg(env, reg);
 +            q[0] = ldq_le_p(buf);
 +            q[1] = ldq_le_p(buf + 8);
 +            return 16;
 +        }
      case 32:
          /* FPSR */
          vfp_set_fpsr(env, ldl_p(buf));
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     /* VFP registers */
+     if (extract32(id_pfr0, 12, 4) == 1) {
-     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
+         set_feature(&features, ARM_FEATURE_THUMB2EE);
      for (i = 0; i < 32; i++) {
 -        r.addr = (uintptr_t)(&env->vfp.regs[i]);
 +        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
          ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
          if (ret) {
              return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      /* VFP registers */
      r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
      for (i = 0; i < 32; i++) {
 -        r.addr = (uintptr_t)(&env->vfp.regs[i]);
 +        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
          ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
          if (ret) {
              return ret;
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          }
      }
+-    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
--    /* Advanced SIMD and FP registers
+-        set_feature(&features, ARM_FEATURE_VFP_FP16);
--     * We map Qn = regs[2n+1]:regs[2n]
+-    }
--     */
+     if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
-+    /* Advanced SIMD and FP registers. */
+         set_feature(&features, ARM_FEATURE_NEON);
      for (i = 0; i < 32; i++) {
 -        int rd = i << 1;
 -        uint64_t fp_val[2];
 +        uint64_t *q = aa64_vfp_qreg(env, i);
  #ifdef HOST_WORDS_BIGENDIAN
 -        fp_val[0] = env->vfp.regs[rd + 1];
 -        fp_val[1] = env->vfp.regs[rd];
 +        uint64_t fp_val[2] = { q[1], q[0] };
 +        reg.addr = (uintptr_t)fp_val;
  #else
 -        fp_val[1] = env->vfp.regs[rd + 1];
 -        fp_val[0] = env->vfp.regs[rd];
 +        reg.addr = (uintptr_t)q;
  #endif
          reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
 -        reg.addr = (uintptr_t)(&fp_val);
          ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
          if (ret) {
              return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          env->spsr = env->banked_spsr[i];
      }
--    /* Advanced SIMD and FP registers
--     * We map Qn = regs[2n+1]:regs[2n]
--     */
-+    /* Advanced SIMD and FP registers */
-     for (i = 0; i < 32; i++) {
--        uint64_t fp_val[2];
-+        uint64_t *q = aa64_vfp_qreg(env, i);
-         reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
--        reg.addr = (uintptr_t)(&fp_val);
-+        reg.addr = (uintptr_t)q;
-         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-         if (ret) {
-             return ret;
-         } else {
--            int rd = i << 1;
- #ifdef HOST_WORDS_BIGENDIAN
--            env->vfp.regs[rd + 1] = fp_val[0];
--            env->vfp.regs[rd] = fp_val[1];
--#else
--            env->vfp.regs[rd + 1] = fp_val[1];
--            env->vfp.regs[rd] = fp_val[0];
-+            uint64_t t;
-+            t = q[0], q[0] = q[1], q[1] = t;
- #endif
-         }
-     }
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
-     if (flags & CPU_DUMP_FPU) {
-         int numvfpregs = 32;
--        for (i = 0; i < numvfpregs; i += 2) {
--            uint64_t vlo = env->vfp.regs[i * 2];
--            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
--            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
--                        i, vhi, vlo);
--            vlo = env->vfp.regs[(i + 1) * 2];
--            vhi = env->vfp.regs[((i + 1) * 2) + 1];
--            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
--                        i + 1, vhi, vlo);
-+        for (i = 0; i < numvfpregs; i++) {
-+            uint64_t *q = aa64_vfp_qreg(env, i);
-+            uint64_t vlo = q[0];
-+            uint64_t vhi = q[1];
-+            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "%c",
-+                        i, vhi, vlo, (i & 1 ? '\n' : ' '));
-         }
-         cpu_fprintf(f, "FPCR: %08x  FPSR: %08x\n",
-                     vfp_get_fpcr(env), vfp_get_fpsr(env));
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
-  */
- static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
- {
--    int offs = offsetof(CPUARMState, vfp.regs[regno * 2]);
--#ifdef HOST_WORDS_BIGENDIAN
--    offs += (8 - (1 << size));
--#endif
--    assert_fp_access_checked(s);
--    return offs;
-+    return vec_reg_offset(s, regno, 0, size);
- }
- /* Offset of the high half of the 128 bit vector Qn */
- static inline int fp_reg_hi_offset(DisasContext *s, int regno)
- {
--    assert_fp_access_checked(s);
--    return offsetof(CPUARMState, vfp.regs[regno * 2 + 1]);
-+    return vec_reg_offset(s, regno, 1, MO_64);
- }
- /* Convenience accessors for reading and writing single and double
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
+@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
- static inline long
+                      * UNPREDICTABLE if bit 8 is set prior to ARMv8
- vfp_reg_offset (int dp, int reg)
+                      * (we choose to UNDEF)
- {
+                      */
--    if (dp)
+-                    if ((dp && !arm_dc_feature(s, ARM_FEATURE_V8)) ||
-+    if (dp) {
+-                        !arm_dc_feature(s, ARM_FEATURE_VFP_FP16)) {
-         return offsetof(CPUARMState, vfp.regs[reg]);
+-                        return 1;
--    else if (reg & 1) {
++                    if (dp) {
--        return offsetof(CPUARMState, vfp.regs[reg >> 1])
++                        if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
--          + offsetof(CPU_DoubleU, l.upper);
++                            return 1;
-     } else {
++                        }
--        return offsetof(CPUARMState, vfp.regs[reg >> 1])
++                    } else {
--          + offsetof(CPU_DoubleU, l.lower);
++                        if (!dc_isar_feature(aa32_fp16_spconv, s)) {
-+        long ofs = offsetof(CPUARMState, vfp.regs[reg >> 1]);
++                            return 1;
-+        if (reg & 1) {
++                        }
-+            ofs += offsetof(CPU_DoubleU, l.upper);
+                     }
-+        } else {
+                     rm_is_dp = false;
-+            ofs += offsetof(CPU_DoubleU, l.lower);
+                     break;
-+        }
+                 case 0x06: /* vcvtb.f16.f32, vcvtb.f16.f64 */
-+        return ofs;
+                 case 0x07: /* vcvtt.f16.f32, vcvtt.f16.f64 */
-     }
+-                    if ((dp && !arm_dc_feature(s, ARM_FEATURE_V8)) ||
- }
+-                        !arm_dc_feature(s, ARM_FEATURE_VFP_FP16)) {
+-                        return 1;
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
++                    if (dp) {
-             numvfpregs += 16;
++                        if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
-         }
++                            return 1;
-         for (i = 0; i < numvfpregs; i++) {
++                        }
--            uint64_t v = env->vfp.regs[i];
++                    } else {
-+            uint64_t v = *aa32_vfp_dreg(env, i);
++                        if (!dc_isar_feature(aa32_fp16_spconv, s)) {
-             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
++                            return 1;
-                         i * 2, (uint32_t)v,
++                        }
-                         i * 2 + 1, (uint32_t)(v >> 32),
+                     }
                      rd_is_dp = false;
                      break;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                      TCGv_ptr fpst;
                      TCGv_i32 ahp;
 -                    if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
 +                    if (!dc_isar_feature(aa32_fp16_spconv, s) ||
                          q || (rm & 1)) {
                          return 1;
                      }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                  {
                      TCGv_ptr fpst;
                      TCGv_i32 ahp;
 -                    if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
 +                    if (!dc_isar_feature(aa32_fp16_spconv, s) ||
                          q || (rd & 1)) {
                          return 1;
                      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 10/21] target/arm: Add ARM_FEATURE_SVE
+[Qemu-devel] [PULL 10/16] target/arm: Gate "miscellaneous FP" insns by ID register field
-From: Richard Henderson <richard.henderson@linaro.org>
+There is a set of VFP instructions which we implement in
 disas_vfp_v8_insn() and gate on the ARM_FEATURE_V8 bit.
 These were all first introduced in v8 for A-profile, but in
 M-profile they appeared in v7M. Gate them on the MVFR2
 FPMisc field instead, and rename the function appropriately.
-Not enabled anywhere so far.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-11-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190222170936.13268-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 1 +
+ target/arm/cpu.h       | 20 ++++++++++++++++++++
-file changed, 1 insertion(+)
+ target/arm/translate.c | 25 +++++++++++++------------
 files changed, 33 insertions(+), 12 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
-     ARM_FEATURE_VBAR, /* has cp15 VBAR */
+     return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 1;
-     ARM_FEATURE_M_SECURITY, /* M profile Security Extension */
+ }
-     ARM_FEATURE_JAZELLE, /* has (trivial) Jazelle implementation */
-+    ARM_FEATURE_SVE, /* has Scalable Vector Extension */
++static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 1;
 +}
 +
 +static inline bool isar_feature_aa32_vcvt_dr(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 2;
 +}
 +
 +static inline bool isar_feature_aa32_vrint(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 3;
 +}
 +
 +static inline bool isar_feature_aa32_vminmaxnm(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->mvfr2, MVFR2, FPMISC) >= 4;
 +}
 +
  /*
   * 64-bit feature tests via id registers.
   */
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t fp_decode_rm[] = {
      FPROUNDING_NEGINF,
  };
- static inline int arm_feature(CPUARMState *env, int feature)
+-static int disas_vfp_v8_insn(DisasContext *s, uint32_t insn)
 +static int disas_vfp_misc_insn(DisasContext *s, uint32_t insn)
  {
      uint32_t rd, rn, rm, dp = extract32(insn, 8, 1);
 -    if (!arm_dc_feature(s, ARM_FEATURE_V8)) {
 -        return 1;
 -    }
 -
      if (dp) {
          VFP_DREG_D(rd, insn);
          VFP_DREG_N(rn, insn);
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_v8_insn(DisasContext *s, uint32_t insn)
          rm = VFP_SREG_M(insn);
      }
 -    if ((insn & 0x0f800e50) == 0x0e000a00) {
 +    if ((insn & 0x0f800e50) == 0x0e000a00 && dc_isar_feature(aa32_vsel, s)) {
          return handle_vsel(insn, rd, rn, rm, dp);
 -    } else if ((insn & 0x0fb00e10) == 0x0e800a00) {
 +    } else if ((insn & 0x0fb00e10) == 0x0e800a00 &&
 +               dc_isar_feature(aa32_vminmaxnm, s)) {
          return handle_vminmaxnm(insn, rd, rn, rm, dp);
 -    } else if ((insn & 0x0fbc0ed0) == 0x0eb80a40) {
 +    } else if ((insn & 0x0fbc0ed0) == 0x0eb80a40 &&
 +               dc_isar_feature(aa32_vrint, s)) {
          /* VRINTA, VRINTN, VRINTP, VRINTM */
          int rounding = fp_decode_rm[extract32(insn, 16, 2)];
          return handle_vrint(insn, rd, rm, dp, rounding);
 -    } else if ((insn & 0x0fbc0e50) == 0x0ebc0a40) {
 +    } else if ((insn & 0x0fbc0e50) == 0x0ebc0a40 &&
 +               dc_isar_feature(aa32_vcvt_dr, s)) {
          /* VCVTA, VCVTN, VCVTP, VCVTM */
          int rounding = fp_decode_rm[extract32(insn, 16, 2)];
          return handle_vcvt(insn, rd, rm, dp, rounding);
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
      }
      if (extract32(insn, 28, 4) == 0xf) {
 -        /* Encodings with T=1 (Thumb) or unconditional (ARM):
 -         * only used in v8 and above.
 +        /*
 +         * Encodings with T=1 (Thumb) or unconditional (ARM):
 +         * only used for the "miscellaneous VFP features" added in v8A
 +         * and v7M (and gated on the MVFR2.FPMisc field).
           */
 -        return disas_vfp_v8_insn(s, insn);
 +        return disas_vfp_misc_insn(s, insn);
      }
      dp = ((insn & 0xf00) == 0xb00);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 07/21] target/arm: Change the type of vfp.regs
+[Qemu-devel] [PULL 11/16] Revert "arm: Allow system registers for KVM guests to be changed by QEMU code"
-From: Richard Henderson <richard.henderson@linaro.org>
+This reverts commit 823e1b3818f9b10b824ddcd756983b6e2fa68730,
 which introduces a regression running EDK2 guest firmware
 under KVM:
-All direct users of this field want an integral value.  Drop all
+error: kvm run failed Function not implemented
-of the extra casting between uint64_t and float64.
+ PC=000000013f5a6208 X00=00000000404003c4 X01=000000000000003a
 X02=0000000000000000 X03=00000000404003c4 X04=0000000000000000
 X05=0000000096000046 X06=000000013d2ef270 X07=000000013e3d1710
 X08=09010755ffaf8ba8 X09=ffaf8b9cfeeb5468 X10=feeb546409010756
 X11=09010757ffaf8b90 X12=feeb50680903068b X13=090306a1ffaf8bc0
 X14=0000000000000000 X15=0000000000000000 X16=000000013f872da0
 X17=00000000ffffa6ab X18=0000000000000000 X19=000000013f5a92d0
 X20=000000013f5a7a78 X21=000000000000003a X22=000000013f5a7ab2
 X23=000000013f5a92e8 X24=000000013f631090 X25=0000000000000010
 X26=0000000000000100 X27=000000013f89501b X28=000000013e3d14e0
 X29=000000013e3d12a0 X30=000000013f5a2518  SP=000000013b7be0b0
 PSTATE=404003c4 -Z-- EL1t
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+with
-Message-id: 20180119045438.28582-6-richard.henderson@linaro.org
+[ 3507.926571] kvm [35042]: load/store instruction decoding not implemented
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+in the host dmesg.
 Revert the change for the moment until we can investigate the
 cause of the regression.
 Reported-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h           |  2 +-
+ target/arm/cpu.h     |  9 +--------
- target/arm/arch_dump.c     |  4 ++--
+ target/arm/helper.c  | 27 ++-------------------------
- target/arm/helper.c        | 20 ++++++++++----------
+ target/arm/kvm32.c   | 20 ++++++++++++++++++--
- target/arm/machine.c       |  2 +-
+ target/arm/kvm64.c   |  2 --
- target/arm/translate-a64.c |  8 ++++----
+ target/arm/machine.c |  2 +-
- target/arm/translate.c     |  2 +-
+files changed, 22 insertions(+), 38 deletions(-)
 files changed, 19 insertions(+), 19 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
-          * the two execution states, and means we do not need to explicitly
+ /**
-          * map these registers when changing states.
+  * write_cpustate_to_list:
-          */
+  * @cpu: ARMCPU
--        float64 regs[64];
+- * @kvm_sync: true if this is for syncing back to KVM
-+        uint64_t regs[64];
+  *
+  * For each register listed in the ARMCPU cpreg_indexes list, write
-         uint32_t xregs[16];
+  * its value from the ARMCPUState structure into the cpreg_values list.
-         /* We store these fpcsr fields separately for convenience.  */
+  * This is used to copy info from TCG's working data structures into
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+  * KVM or for outbound migration.
-index XXXXXXX..XXXXXXX 100644
+  *
---- a/target/arm/arch_dump.c
+- * @kvm_sync is true if we are doing this in order to sync the
-+++ b/target/arm/arch_dump.c
+- * register state back to KVM. In this case we will only update
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+- * values in the list if the previous list->cpustate sync actually
-     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
+- * successfully wrote the CPU state. Otherwise we will keep the value
+- * that is in the list.
-     for (i = 0; i < 64; ++i) {
+- *
--        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+  * Returns: true if all register values were read correctly,
-+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+  * false if some register was unknown or could not be read.
-     }
+  * Note that we do not stop early on failure -- we will attempt
+  * reading all registers in the list.
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
+  */
-@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
+-bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
-     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
++bool write_cpustate_to_list(ARMCPU *cpu);
-     for (i = 0; i < 32; ++i) {
+ #define ARM_CPUID_TI915T      0x54029152
--        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+ #define ARM_CPUID_TI925T      0x54029252
 +        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
      }
      note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
+@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
-     /* VFP data registers are always little-endian.  */
+     return true;
-     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
+ }
-     if (reg < nregs) {
--        stfq_le_p(buf, env->vfp.regs[reg]);
+-bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
-+        stq_le_p(buf, env->vfp.regs[reg]);
++bool write_cpustate_to_list(ARMCPU *cpu)
-         return 8;
+ {
      /* Write the coprocessor state from cpu->env to the (index,value) list. */
      int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
      for (i = 0; i < cpu->cpreg_array_len; i++) {
          uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
          const ARMCPRegInfo *ri;
 -        uint64_t newval;
          ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
          if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
          if (ri->type & ARM_CP_NO_RAW) {
              continue;
          }
 -
 -        newval = read_raw_cp_reg(&cpu->env, ri);
 -        if (kvm_sync) {
 -            /*
 -             * Only sync if the previous list->cpustate sync succeeded.
 -             * Rather than tracking the success/failure state for every
 -             * item in the list, we just recheck "does the raw write we must
 -             * have made in write_list_to_cpustate() read back OK" here.
 -             */
 -            uint64_t oldval = cpu->cpreg_values[i];
 -
 -            if (oldval == newval) {
 -                continue;
 -            }
 -
 -            write_raw_cp_reg(&cpu->env, ri, oldval);
 -            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
 -                continue;
 -            }
 -
 -            write_raw_cp_reg(&cpu->env, ri, newval);
 -        }
 -        cpu->cpreg_values[i] = newval;
 +        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
      }
-     if (arm_feature(env, ARM_FEATURE_NEON)) {
+     return ok;
-         /* Aliases for Q regs.  */
+ }
-         nregs += 16;
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-         if (reg < nregs) {
+index XXXXXXX..XXXXXXX 100644
--            stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
+--- a/target/arm/kvm32.c
--            stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
++++ b/target/arm/kvm32.c
-+            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-+            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
+         return ret;
              return 16;
          }
      }
-@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
+-    write_cpustate_to_list(cpu, true);
-     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
+-
-     if (reg < nregs) {
++    /* Note that we do not call write_cpustate_to_list()
--        env->vfp.regs[reg] = ldfq_le_p(buf);
++     * here, so we are only writing the tuple list back to
-+        env->vfp.regs[reg] = ldq_le_p(buf);
++     * KVM. This is safe because nothing can change the
-         return 8;
++     * CPUARMState cp15 fields (in particular gdb accesses cannot)
 +     * and so there are no changes to sync. In fact syncing would
 +     * be wrong at this point: for a constant register where TCG and
 +     * KVM disagree about its value, the preceding write_list_to_cpustate()
 +     * would not have had any effect on the CPUARMState value (since the
 +     * register is read-only), and a write_cpustate_to_list() here would
 +     * then try to write the TCG value back into KVM -- this would either
 +     * fail or incorrectly change the value the guest sees.
 +     *
 +     * If we ever want to allow the user to modify cp15 registers via
 +     * the gdb stub, we would need to be more clever here (for instance
 +     * tracking the set of registers kvm_arch_get_registers() successfully
 +     * managed to update the CPUARMState with, and only allowing those
 +     * to be written back up into the kernel).
 +     */
      if (!write_list_to_kvmstate(cpu, level)) {
          return EINVAL;
      }
-     if (arm_feature(env, ARM_FEATURE_NEON)) {
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-         nregs += 16;
+index XXXXXXX..XXXXXXX 100644
-         if (reg < nregs) {
+--- a/target/arm/kvm64.c
--            env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
++++ b/target/arm/kvm64.c
--            env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-+            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
+         return ret;
 +            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
              return 16;
          }
      }
-@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
-     switch (reg) {
+-    write_cpustate_to_list(cpu, true);
-     case 0 ... 31:
+-
-         /* 128 bit FP register */
+     if (!write_list_to_kvmstate(cpu, level)) {
--        stfq_le_p(buf, env->vfp.regs[reg * 2]);
+         return EINVAL;
--        stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
+     }
 +        stq_le_p(buf, env->vfp.regs[reg * 2]);
 +        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
          return 16;
      case 32:
          /* FPSR */
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
      switch (reg) {
      case 0 ... 31:
          /* 128 bit FP register */
 -        env->vfp.regs[reg * 2] = ldfq_le_p(buf);
 -        env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
 +        env->vfp.regs[reg * 2] = ldq_le_p(buf);
 +        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
          return 16;
      case 32:
          /* FPSR */
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vfp = {
+@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
-     .minimum_version_id = 3,
+             abort();
      .needed = vfp_needed,
      .fields = (VMStateField[]) {
 -        VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 64),
 +        VMSTATE_UINT64_ARRAY(env.vfp.regs, ARMCPU, 64),
          /* The xregs array is a little awkward because element 1 (FPSCR)
           * requires a specific accessor, so we have to split it up in
           * the vmstate:
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
      if (flags & CPU_DUMP_FPU) {
          int numvfpregs = 32;
          for (i = 0; i < numvfpregs; i += 2) {
 -            uint64_t vlo = float64_val(env->vfp.regs[i * 2]);
 -            uint64_t vhi = float64_val(env->vfp.regs[(i * 2) + 1]);
 +            uint64_t vlo = env->vfp.regs[i * 2];
 +            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
              cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
                          i, vhi, vlo);
 -            vlo = float64_val(env->vfp.regs[(i + 1) * 2]);
 -            vhi = float64_val(env->vfp.regs[((i + 1) * 2) + 1]);
 +            vlo = env->vfp.regs[(i + 1) * 2];
 +            vhi = env->vfp.regs[((i + 1) * 2) + 1];
              cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
                          i + 1, vhi, vlo);
          }
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+     } else {
-index XXXXXXX..XXXXXXX 100644
+-        if (!write_cpustate_to_list(cpu, false)) {
---- a/target/arm/translate.c
++        if (!write_cpustate_to_list(cpu)) {
-+++ b/target/arm/translate.c
+             /* This should never fail. */
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
+             abort();
              numvfpregs += 16;
          }
-         for (i = 0; i < numvfpregs; i++) {
--            uint64_t v = float64_val(env->vfp.regs[i]);
-+            uint64_t v = env->vfp.regs[i];
-             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
-                         i * 2, (uint32_t)v,
-                         i * 2 + 1, (uint32_t)(v >> 32),
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 04/21] target/arm: Use pointers in crypto helpers
+[Qemu-devel] [PULL 12/16] target/arm: Add helpers for FMLAL
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than passing regnos to the helpers, pass pointers to the
+Note that float16_to_float32 rightly squashes SNaN to QNaN.
-vector registers directly.  This eliminates the need to pass in
+But of course pickNaNMulAdd, for ARM, selects SNaNs first.
-the environment pointer and reduces the number of places that
+So we have to preserve SNaN long enough for the correct NaN
-directly access env->vfp.regs[].
+to be selected.  Thus float16_to_float32_by_bits.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190219222952.22183-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180119045438.28582-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  18 ++---
+ target/arm/helper.h     |   9 +++
- target/arm/crypto_helper.c | 184 +++++++++++++++++----------------------------
+ target/arm/vec_helper.c | 148 ++++++++++++++++++++++++++++++++++++++++
- target/arm/translate-a64.c |  75 ++++++++++--------
+files changed, 157 insertions(+)
  target/arm/translate.c     |  68 +++++++++--------
 files changed, 161 insertions(+), 184 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
- DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
+ DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
- DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
+                    void, ptr, ptr, ptr, ptr, i32)
--DEF_HELPER_4(crypto_aese, void, env, i32, i32, i32)
++DEF_HELPER_FLAGS_5(gvec_fmlal_a32, TCG_CALL_NO_RWG,
--DEF_HELPER_4(crypto_aesmc, void, env, i32, i32, i32)
++                   void, ptr, ptr, ptr, ptr, i32)
-+DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
++DEF_HELPER_FLAGS_5(gvec_fmlal_a64, TCG_CALL_NO_RWG,
-+DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
++                   void, ptr, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a32, TCG_CALL_NO_RWG,
--DEF_HELPER_5(crypto_sha1_3reg, void, env, i32, i32, i32, i32)
++                   void, ptr, ptr, ptr, ptr, i32)
--DEF_HELPER_3(crypto_sha1h, void, env, i32, i32)
++DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a64, TCG_CALL_NO_RWG,
--DEF_HELPER_3(crypto_sha1su1, void, env, i32, i32)
++                   void, ptr, ptr, ptr, ptr, i32)
-+DEF_HELPER_FLAGS_4(crypto_sha1_3reg, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++
-+DEF_HELPER_FLAGS_2(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr)
+ #ifdef TARGET_AARCH64
-+DEF_HELPER_FLAGS_2(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr)
+ #include "helper-a64.h"
+ #include "helper-sve.h"
--DEF_HELPER_4(crypto_sha256h, void, env, i32, i32, i32)
+diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
 -DEF_HELPER_4(crypto_sha256h2, void, env, i32, i32, i32)
 -DEF_HELPER_3(crypto_sha256su0, void, env, i32, i32)
 -DEF_HELPER_4(crypto_sha256su1, void, env, i32, i32, i32)
 +DEF_HELPER_FLAGS_3(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 +DEF_HELPER_FLAGS_3(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 +DEF_HELPER_FLAGS_2(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr)
 +DEF_HELPER_FLAGS_3(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
  DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
  DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/crypto_helper.c
+--- a/target/arm/vec_helper.c
-+++ b/target/arm/crypto_helper.c
++++ b/target/arm/vec_helper.c
-@@ -XXX,XX +XXX,XX @@ union CRYPTO_STATE {
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_sqsub_d)(void *vd, void *vq, void *vn,
  #define CR_ST_WORD(state, i)   (state.words[i])
  #endif
 -void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
 -                         uint32_t decrypt)
 +void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
  {
      static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
      static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
 -
 -    union CRYPTO_STATE rk = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 -    union CRYPTO_STATE st = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
 +    union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
      int i;
      assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
          CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
      }
+     clear_tail(d, oprsz, simd_maxsz(desc));
 -    env->vfp.regs[rd] = make_float64(st.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
 +    rd[0] = st.l[0];
 +    rd[1] = st.l[1];
  }
--void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
--                          uint32_t decrypt)
-+void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t decrypt)
- {
-     static uint32_t const mc[][256] = { {
-         /* MixColumns lookup table */
-@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
-x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
-xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
-     } };
--    union CRYPTO_STATE st = { .l = {
--        float64_val(env->vfp.regs[rm]),
--        float64_val(env->vfp.regs[rm + 1])
--    } };
 +
-+    uint64_t *rd = vd;
++/*
-+    uint64_t *rm = vm;
++ * Convert float16 to float32, raising no exceptions and
-+    union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
++ * preserving exceptional values, including SNaN.
-     int i;
++ * This is effectively an unpack+repack operation.
++ */
-     assert(decrypt < 2);
++static float32 float16_to_float32_by_bits(uint32_t f16, bool fz16)
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
              rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
      }
 -    env->vfp.regs[rd] = make_float64(st.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
 +    rd[0] = st.l[0];
 +    rd[1] = st.l[1];
  }
  /*
@@ -XXX,XX +XXX,XX @@ static uint32_t maj(uint32_t x, uint32_t y, uint32_t z)
      return (x & y) | ((x | y) & z);
  }
 -void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                              uint32_t rm, uint32_t op)
 +void HELPER(crypto_sha1_3reg)(void *vd, void *vn, void *vm, uint32_t op)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      if (op == 3) { /* sha1su0 */
          d.l[0] ^= d.l[1] ^ m.l[0];
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
              CR_ST_WORD(d, 0) = t;
          }
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha1h)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(m, 0) = ror32(CR_ST_WORD(m, 0), 2);
      CR_ST_WORD(m, 1) = CR_ST_WORD(m, 2) = CR_ST_WORD(m, 3) = 0;
 -    env->vfp.regs[rd] = make_float64(m.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(m.l[1]);
 +    rd[0] = m.l[0];
 +    rd[1] = m.l[1];
  }
 -void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha1su1)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) = rol32(CR_ST_WORD(d, 0) ^ CR_ST_WORD(m, 1), 1);
      CR_ST_WORD(d, 1) = rol32(CR_ST_WORD(d, 1) ^ CR_ST_WORD(m, 2), 1);
      CR_ST_WORD(d, 2) = rol32(CR_ST_WORD(d, 2) ^ CR_ST_WORD(m, 3), 1);
      CR_ST_WORD(d, 3) = rol32(CR_ST_WORD(d, 3) ^ CR_ST_WORD(d, 0), 1);
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
  /*
@@ -XXX,XX +XXX,XX @@ static uint32_t s1(uint32_t x)
      return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
  }
 -void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                            uint32_t rm)
 +void HELPER(crypto_sha256h)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      int i;
      for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
          CR_ST_WORD(d, 0) = t;
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                             uint32_t rm)
 +void HELPER(crypto_sha256h2)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      int i;
      for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
          CR_ST_WORD(d, 0) = CR_ST_WORD(n, 3 - i) + t;
      }
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
 +void HELPER(crypto_sha256su0)(void *vd, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) += s0(CR_ST_WORD(d, 1));
      CR_ST_WORD(d, 1) += s0(CR_ST_WORD(d, 2));
      CR_ST_WORD(d, 2) += s0(CR_ST_WORD(d, 3));
      CR_ST_WORD(d, 3) += s0(CR_ST_WORD(m, 0));
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 -void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
 -                              uint32_t rm)
 +void HELPER(crypto_sha256su1)(void *vd, void *vn, void *vm)
  {
 -    union CRYPTO_STATE d = { .l = {
 -        float64_val(env->vfp.regs[rd]),
 -        float64_val(env->vfp.regs[rd + 1])
 -    } };
 -    union CRYPTO_STATE n = { .l = {
 -        float64_val(env->vfp.regs[rn]),
 -        float64_val(env->vfp.regs[rn + 1])
 -    } };
 -    union CRYPTO_STATE m = { .l = {
 -        float64_val(env->vfp.regs[rm]),
 -        float64_val(env->vfp.regs[rm + 1])
 -    } };
 +    uint64_t *rd = vd;
 +    uint64_t *rn = vn;
 +    uint64_t *rm = vm;
 +    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
 +    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
 +    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
      CR_ST_WORD(d, 0) += s1(CR_ST_WORD(m, 2)) + CR_ST_WORD(n, 1);
      CR_ST_WORD(d, 1) += s1(CR_ST_WORD(m, 3)) + CR_ST_WORD(n, 2);
      CR_ST_WORD(d, 2) += s1(CR_ST_WORD(d, 0)) + CR_ST_WORD(n, 3);
      CR_ST_WORD(d, 3) += s1(CR_ST_WORD(d, 1)) + CR_ST_WORD(m, 0);
 -    env->vfp.regs[rd] = make_float64(d.l[0]);
 -    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
 +    rd[0] = d.l[0];
 +    rd[1] = d.l[1];
  }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
  typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
  typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
  typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
 -typedef void CryptoTwoOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32);
 -typedef void CryptoThreeOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32, TCGv_i32);
 +typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
 +typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 +typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  /* initialize TCG globals.  */
  void a64_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static inline int vec_reg_offset(DisasContext *s, int regno,
      return offs;
  }
 +/* Return the offset info CPUARMState of the "whole" vector register Qn.  */
 +static inline int vec_full_reg_offset(DisasContext *s, int regno)
 +{
-+    assert_fp_access_checked(s);
++    const int f16_bias = 15;
-+    return offsetof(CPUARMState, vfp.regs[regno * 2]);
++    const int f32_bias = 127;
 +    uint32_t sign = extract32(f16, 15, 1);
 +    uint32_t exp = extract32(f16, 10, 5);
 +    uint32_t frac = extract32(f16, 0, 10);
 +
 +    if (exp == 0x1f) {
 +        /* Inf or NaN */
 +        exp = 0xff;
 +    } else if (exp == 0) {
 +        /* Zero or denormal.  */
 +        if (frac != 0) {
 +            if (fz16) {
 +                frac = 0;
 +            } else {
 +                /*
 +                 * Denormal; these are all normal float32.
 +                 * Shift the fraction so that the msb is at bit 11,
 +                 * then remove bit 11 as the implicit bit of the
 +                 * normalized float32.  Note that we still go through
 +                 * the shift for normal numbers below, to put the
 +                 * float32 fraction at the right place.
 +                 */
 +                int shift = clz32(frac) - 21;
 +                frac = (frac << shift) & 0x3ff;
 +                exp = f32_bias - f16_bias - shift + 1;
 +            }
 +        }
 +    } else {
 +        /* Normal number; adjust the bias.  */
 +        exp += f32_bias - f16_bias;
 +    }
 +    sign <<= 31;
 +    exp <<= 23;
 +    frac <<= 23 - 10;
 +
 +    return sign | exp | frac;
 +}
 +
-+/* Return a newly allocated pointer to the vector register.  */
++static uint64_t load4_f16(uint64_t *ptr, int is_q, int is_2)
 +static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
 +{
-+    TCGv_ptr ret = tcg_temp_new_ptr();
++    /*
-+    tcg_gen_addi_ptr(ret, cpu_env, vec_full_reg_offset(s, regno));
++     * Branchless load of u32[0], u64[0], u32[1], or u64[1].
-+    return ret;
++     * Load the 2nd qword iff is_q & is_2.
 +     * Shift to the 2nd dword iff !is_q & is_2.
 +     * For !is_q & !is_2, the upper bits of the result are garbage.
 +     */
 +    return ptr[is_q & is_2] >> ((is_2 & ~is_q) << 5);
 +}
 +
- /* Return the offset into CPUARMState of a slice (from
++/*
-  * the least significant end) of FP register Qn (ie
++ * Note that FMLAL requires oprsz == 8 or oprsz == 16,
-  * Dn, Sn, Hn or Bn).
++ * as there is not yet SVE versions that might use blocking.
-@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
++ */
-     int rn = extract32(insn, 5, 5);
++
-     int rd = extract32(insn, 0, 5);
++static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
-     int decrypt;
++                     uint32_t desc, bool fz16)
 -    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_decrypt;
 -    CryptoThreeOpEnvFn *genfn;
 +    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
 +    TCGv_i32 tcg_decrypt;
 +    CryptoThreeOpIntFn *genfn;
      if (!arm_dc_feature(s, ARM_FEATURE_V8_AES)
          || size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
          return;
      }
 -    /* Note that we convert the Vx register indexes into the
 -     * index within the vfp.regs[] array, so we can share the
 -     * helper with the AArch32 instructions.
 -     */
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
      tcg_decrypt = tcg_const_i32(decrypt);
 -    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_decrypt);
 +    genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_decrypt);
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
      tcg_temp_free_i32(tcg_decrypt);
  }
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
      int rm = extract32(insn, 16, 5);
      int rn = extract32(insn, 5, 5);
      int rd = extract32(insn, 0, 5);
 -    CryptoThreeOpEnvFn *genfn;
 -    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_rm_regno;
 +    CryptoThreeOpFn *genfn;
 +    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr;
      int feature = ARM_FEATURE_V8_SHA256;
      if (size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 -    tcg_rm_regno = tcg_const_i32(rm << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 +    tcg_rm_ptr = vec_full_reg_ptr(s, rm);
      if (genfn) {
 -        genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_rm_regno);
 +        genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr);
      } else {
          TCGv_i32 tcg_opcode = tcg_const_i32(opcode);
 -        gen_helper_crypto_sha1_3reg(cpu_env, tcg_rd_regno,
 -                                    tcg_rn_regno, tcg_rm_regno, tcg_opcode);
 +        gen_helper_crypto_sha1_3reg(tcg_rd_ptr, tcg_rn_ptr,
 +                                    tcg_rm_ptr, tcg_opcode);
          tcg_temp_free_i32(tcg_opcode);
      }
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 -    tcg_temp_free_i32(tcg_rm_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
 +    tcg_temp_free_ptr(tcg_rm_ptr);
  }
  /* Crypto two-reg SHA
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
      int opcode = extract32(insn, 12, 5);
      int rn = extract32(insn, 5, 5);
      int rd = extract32(insn, 0, 5);
 -    CryptoTwoOpEnvFn *genfn;
 +    CryptoTwoOpFn *genfn;
      int feature;
 -    TCGv_i32 tcg_rd_regno, tcg_rn_regno;
 +    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
      if (size != 0) {
          unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
          return;
      }
 -    tcg_rd_regno = tcg_const_i32(rd << 1);
 -    tcg_rn_regno = tcg_const_i32(rn << 1);
 +    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
 +    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 -    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno);
 +    genfn(tcg_rd_ptr, tcg_rn_ptr);
 -    tcg_temp_free_i32(tcg_rd_regno);
 -    tcg_temp_free_i32(tcg_rn_regno);
 +    tcg_temp_free_ptr(tcg_rd_ptr);
 +    tcg_temp_free_ptr(tcg_rn_ptr);
  }
  /* C3.6 Data processing - SIMD, inc Crypto
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void neon_store_reg64(TCGv_i64 var, int reg)
      tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
  }
 +static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 +{
-+    TCGv_ptr ret = tcg_temp_new_ptr();
++    intptr_t i, oprsz = simd_oprsz(desc);
-+    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
++    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-+    return ret;
++    int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 +    int is_q = oprsz == 16;
 +    uint64_t n_4, m_4;
 +
 +    /* Pre-load all of the f16 data, avoiding overlap issues.  */
 +    n_4 = load4_f16(vn, is_q, is_2);
 +    m_4 = load4_f16(vm, is_q, is_2);
 +
 +    /* Negate all inputs for FMLSL at once.  */
 +    if (is_s) {
 +        n_4 ^= 0x8000800080008000ull;
 +    }
 +
 +    for (i = 0; i < oprsz / 4; i++) {
 +        float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
 +        float32 m_1 = float16_to_float32_by_bits(m_4 >> (i * 16), fz16);
 +        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
 +    }
 +    clear_tail(d, oprsz, simd_maxsz(desc));
 +}
 +
- #define tcg_gen_ld_f32 tcg_gen_ld_i32
++void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
- #define tcg_gen_ld_f64 tcg_gen_ld_i64
++                            void *venv, uint32_t desc)
- #define tcg_gen_st_f32 tcg_gen_st_i32
++{
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
++    CPUARMState *env = venv;
-     int u;
++    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-     uint32_t imm, mask;
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
-     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
++}
-+    TCGv_ptr ptr1, ptr2, ptr3;
++
-     TCGv_i64 tmp64;
++void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
++                            void *venv, uint32_t desc)
-     /* FIXME: this access check should not take precedence over UNDEF
++{
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
++    CPUARMState *env = venv;
-                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
++    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
-                     return 1;
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
-                 }
++}
--                tmp = tcg_const_i32(rd);
++
--                tmp2 = tcg_const_i32(rn);
++static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
--                tmp3 = tcg_const_i32(rm);
++                         uint32_t desc, bool fz16)
-+                ptr1 = vfp_reg_ptr(true, rd);
++{
-+                ptr2 = vfp_reg_ptr(true, rn);
++    intptr_t i, oprsz = simd_oprsz(desc);
-+                ptr3 = vfp_reg_ptr(true, rm);
++    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-                 tmp4 = tcg_const_i32(size);
++    int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
--                gen_helper_crypto_sha1_3reg(cpu_env, tmp, tmp2, tmp3, tmp4);
++    int index = extract32(desc, SIMD_DATA_SHIFT + 2, 3);
-+                gen_helper_crypto_sha1_3reg(ptr1, ptr2, ptr3, tmp4);
++    int is_q = oprsz == 16;
-                 tcg_temp_free_i32(tmp4);
++    uint64_t n_4;
-             } else { /* SHA-256 */
++    float32 m_1;
-                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256) || size == 3) {
++
-                     return 1;
++    /* Pre-load all of the f16 data, avoiding overlap issues.  */
-                 }
++    n_4 = load4_f16(vn, is_q, is_2);
--                tmp = tcg_const_i32(rd);
++
--                tmp2 = tcg_const_i32(rn);
++    /* Negate all inputs for FMLSL at once.  */
--                tmp3 = tcg_const_i32(rm);
++    if (is_s) {
-+                ptr1 = vfp_reg_ptr(true, rd);
++        n_4 ^= 0x8000800080008000ull;
-+                ptr2 = vfp_reg_ptr(true, rn);
++    }
-+                ptr3 = vfp_reg_ptr(true, rm);
++
-                 switch (size) {
++    m_1 = float16_to_float32_by_bits(((float16 *)vm)[H2(index)], fz16);
-                 case 0:
++
--                    gen_helper_crypto_sha256h(cpu_env, tmp, tmp2, tmp3);
++    for (i = 0; i < oprsz / 4; i++) {
-+                    gen_helper_crypto_sha256h(ptr1, ptr2, ptr3);
++        float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
-                     break;
++        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
-                 case 1:
++    }
--                    gen_helper_crypto_sha256h2(cpu_env, tmp, tmp2, tmp3);
++    clear_tail(d, oprsz, simd_maxsz(desc));
-+                    gen_helper_crypto_sha256h2(ptr1, ptr2, ptr3);
++}
-                     break;
++
-                 case 2:
++void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
--                    gen_helper_crypto_sha256su1(cpu_env, tmp, tmp2, tmp3);
++                                void *venv, uint32_t desc)
-+                    gen_helper_crypto_sha256su1(ptr1, ptr2, ptr3);
++{
-                     break;
++    CPUARMState *env = venv;
-                 }
++    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-             }
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
--            tcg_temp_free_i32(tmp);
++}
--            tcg_temp_free_i32(tmp2);
++
--            tcg_temp_free_i32(tmp3);
++void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-+            tcg_temp_free_ptr(ptr1);
++                                void *venv, uint32_t desc)
-+            tcg_temp_free_ptr(ptr2);
++{
-+            tcg_temp_free_ptr(ptr3);
++    CPUARMState *env = venv;
-             return 0;
++    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
-         }
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
-         if (size == 3 && op != NEON_3R_LOGIC) {
++}
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          || ((rm | rd) & 1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
                       /* Bit 6 is the lowest opcode bit; it distinguishes between
                        * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                      tmp3 = tcg_const_i32(extract32(insn, 6, 1));
                      if (op == NEON_2RM_AESE) {
 -                        gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
 +                        gen_helper_crypto_aese(ptr1, ptr2, tmp3);
                      } else {
 -                        gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
 +                        gen_helper_crypto_aesmc(ptr1, ptr2, tmp3);
                      }
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      tcg_temp_free_i32(tmp3);
                      break;
                  case NEON_2RM_SHA1H:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                          || ((rm | rd) & 1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
 -                    gen_helper_crypto_sha1h(cpu_env, tmp, tmp2);
 +                    gen_helper_crypto_sha1h(ptr1, ptr2);
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      break;
                  case NEON_2RM_SHA1SU1:
                      if ((rm | rd) & 1) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                      } else if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                          return 1;
                      }
 -                    tmp = tcg_const_i32(rd);
 -                    tmp2 = tcg_const_i32(rm);
 +                    ptr1 = vfp_reg_ptr(true, rd);
 +                    ptr2 = vfp_reg_ptr(true, rm);
                      if (q) {
 -                        gen_helper_crypto_sha256su0(cpu_env, tmp, tmp2);
 +                        gen_helper_crypto_sha256su0(ptr1, ptr2);
                      } else {
 -                        gen_helper_crypto_sha1su1(cpu_env, tmp, tmp2);
 +                        gen_helper_crypto_sha1su1(ptr1, ptr2);
                      }
 -                    tcg_temp_free_i32(tmp);
 -                    tcg_temp_free_i32(tmp2);
 +                    tcg_temp_free_ptr(ptr1);
 +                    tcg_temp_free_ptr(ptr2);
                      break;
                  default:
                  elementwise:
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 11/21] target/arm: Move cpu_get_tb_cpu_state out of line
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMLAL and FMLSL for aarch64
 From: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-14-richard.henderson@linaro.org
+Message-id: 20190219222952.22183-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h    | 127 +---------------------------------------------------
+ target/arm/cpu.h           |  5 ++++
- target/arm/helper.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 49 +++++++++++++++++++++++++++++++++++++-
-files changed, 128 insertions(+), 125 deletions(-)
+files changed, 53 insertions(+), 1 deletion(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_dp(const ARMISARegisters *id)
- #endif
+     return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, DP) != 0;
  }
--/* Return the exception level to which FP-disabled exceptions should
++static inline bool isar_feature_aa64_fhm(const ARMISARegisters *id)
 - * be taken, or 0 if FP is enabled.
 - */
 -static inline int fp_exception_el(CPUARMState *env)
 -{
 -    int fpen;
 -    int cur_el = arm_current_el(env);
 -
 -    /* CPACR and the CPTR registers don't exist before v6, so FP is
 -     * always accessible
 -     */
 -    if (!arm_feature(env, ARM_FEATURE_V6)) {
 -        return 0;
 -    }
 -
 -    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
 -     * 0, 2 : trap EL0 and EL1/PL1 accesses
 -     * 1    : trap only EL0 accesses
 -     * 3    : trap no accesses
 -     */
 -    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
 -    switch (fpen) {
 -    case 0:
 -    case 2:
 -        if (cur_el == 0 || cur_el == 1) {
 -            /* Trap to PL1, which might be EL1 or EL3 */
 -            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 -                return 3;
 -            }
 -            return 1;
 -        }
 -        if (cur_el == 3 && !is_a64(env)) {
 -            /* Secure PL1 running at EL3 */
 -            return 3;
 -        }
 -        break;
 -    case 1:
 -        if (cur_el == 0) {
 -            return 1;
 -        }
 -        break;
 -    case 3:
 -        break;
 -    }
 -
 -    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
 -     * check because zero bits in the registers mean "don't trap".
 -     */
 -
 -    /* CPTR_EL2 : present in v7VE or v8 */
 -    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
 -        && !arm_is_secure_below_el3(env)) {
 -        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
 -        return 2;
 -    }
 -
 -    /* CPTR_EL3 : present in v8 */
 -    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
 -        /* Trap all FP ops to EL3 */
 -        return 3;
 -    }
 -
 -    return 0;
 -}
 -
  #ifdef CONFIG_USER_ONLY
  static inline bool arm_cpu_bswap_data(CPUARMState *env)
  {
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
  }
  #endif
 -static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
 -                                        target_ulong *cs_base, uint32_t *flags)
 -{
 -    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
 -    if (is_a64(env)) {
 -        *pc = env->pc;
 -        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
 -        /* Get control bits for tagged addresses */
 -        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
 -        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
 -    } else {
 -        *pc = env->regs[15];
 -        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
 -            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
 -            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
 -            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
 -            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
 -        if (!(access_secure_reg(env))) {
 -            *flags |= ARM_TBFLAG_NS_MASK;
 -        }
 -        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
 -            || arm_el_is_aa64(env, 1)) {
 -            *flags |= ARM_TBFLAG_VFPEN_MASK;
 -        }
 -        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
 -                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 -    }
 -
 -    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 -
 -    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
 -     * states defined in the ARM ARM for software singlestep:
 -     *  SS_ACTIVE   PSTATE.SS   State
 -     *     0            x       Inactive (the TB flag for SS is always 0)
 -     *     1            0       Active-pending
 -     *     1            1       Active-not-pending
 -     */
 -    if (arm_singlestep_active(env)) {
 -        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
 -        if (is_a64(env)) {
 -            if (env->pstate & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 -            }
 -        } else {
 -            if (env->uncached_cpsr & PSTATE_SS) {
 -                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 -            }
 -        }
 -    }
 -    if (arm_cpu_data_is_big_endian(env)) {
 -        *flags |= ARM_TBFLAG_BE_DATA_MASK;
 -    }
 -    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
 -
 -    if (arm_v7m_is_handler_mode(env)) {
 -        *flags |= ARM_TBFLAG_HANDLER_MASK;
 -    }
 -
 -    *cs_base = 0;
 -}
 +void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
 +                          target_ulong *cs_base, uint32_t *flags);
  enum {
      QEMU_PSCI_CONDUIT_DISABLED = 0,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
      /* Linux crc32c converts the output to one's complement.  */
      return crc32c(acc, buf, bytes) ^ 0xffffffff;
  }
 +
 +/* Return the exception level to which FP-disabled exceptions should
 + * be taken, or 0 if FP is enabled.
 + */
 +static inline int fp_exception_el(CPUARMState *env)
 +{
-+    int fpen;
++    return FIELD_EX64(id->id_aa64isar0, ID_AA64ISAR0, FHM) != 0;
 +    int cur_el = arm_current_el(env);
 +
 +    /* CPACR and the CPTR registers don't exist before v6, so FP is
 +     * always accessible
 +     */
 +    if (!arm_feature(env, ARM_FEATURE_V6)) {
 +        return 0;
 +    }
 +
 +    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
 +     * 0, 2 : trap EL0 and EL1/PL1 accesses
 +     * 1    : trap only EL0 accesses
 +     * 3    : trap no accesses
 +     */
 +    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
 +    switch (fpen) {
 +    case 0:
 +    case 2:
 +        if (cur_el == 0 || cur_el == 1) {
 +            /* Trap to PL1, which might be EL1 or EL3 */
 +            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 +                return 3;
 +            }
 +            return 1;
 +        }
 +        if (cur_el == 3 && !is_a64(env)) {
 +            /* Secure PL1 running at EL3 */
 +            return 3;
 +        }
 +        break;
 +    case 1:
 +        if (cur_el == 0) {
 +            return 1;
 +        }
 +        break;
 +    case 3:
 +        break;
 +    }
 +
 +    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
 +     * check because zero bits in the registers mean "don't trap".
 +     */
 +
 +    /* CPTR_EL2 : present in v7VE or v8 */
 +    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
 +        && !arm_is_secure_below_el3(env)) {
 +        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
 +        return 2;
 +    }
 +
 +    /* CPTR_EL3 : present in v8 */
 +    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
 +        /* Trap all FP ops to EL3 */
 +        return 3;
 +    }
 +
 +    return 0;
 +}
 +
-+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+ static inline bool isar_feature_aa64_jscvt(const ARMISARegisters *id)
-+                          target_ulong *cs_base, uint32_t *flags)
+ {
-+{
+     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, JSCVT) != 0;
-+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-+    if (is_a64(env)) {
+index XXXXXXX..XXXXXXX 100644
-+        *pc = env->pc;
+--- a/target/arm/translate-a64.c
-+        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
++++ b/target/arm/translate-a64.c
-+        /* Get control bits for tagged addresses */
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_float(DisasContext *s, uint32_t insn)
-+        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+         if (!fp_access_check(s)) {
-+        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+             return;
-+    } else {
+         }
-+        *pc = env->regs[15];
+-
-+        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+         handle_3same_float(s, size, elements, fpopcode, rd, rn, rm);
-+            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
+         return;
-+            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
++
-+            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
++    case 0x1d: /* FMLAL  */
-+            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
++    case 0x3d: /* FMLSL  */
-+        if (!(access_secure_reg(env))) {
++    case 0x59: /* FMLAL2 */
-+            *flags |= ARM_TBFLAG_NS_MASK;
++    case 0x79: /* FMLSL2 */
 +        if (size & 1 || !dc_isar_feature(aa64_fhm, s)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
-+        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
++        if (fp_access_check(s)) {
-+            || arm_el_is_aa64(env, 1)) {
++            int is_s = extract32(insn, 23, 1);
-+            *flags |= ARM_TBFLAG_VFPEN_MASK;
++            int is_2 = extract32(insn, 29, 1);
 +            int data = (is_2 << 1) | is_s;
 +            tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
 +                               vec_full_reg_offset(s, rn),
 +                               vec_full_reg_offset(s, rm), cpu_env,
 +                               is_q ? 16 : 8, vec_full_reg_size(s),
 +                               data, gen_helper_gvec_fmlal_a64);
 +        }
-+        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
++        return;
 +                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
 +    }
 +
-+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+     default:
          unallocated_encoding(s);
          return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
          }
          is_fp = 2;
          break;
 +    case 0x00: /* FMLAL */
 +    case 0x04: /* FMLSL */
 +    case 0x18: /* FMLAL2 */
 +    case 0x1c: /* FMLSL2 */
 +        if (is_scalar || size != MO_32 || !dc_isar_feature(aa64_fhm, s)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        size = MO_16;
 +        /* is_fp, but we pass cpu_env not fp_status.  */
 +        break;
      default:
          unallocated_encoding(s);
          return;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              tcg_temp_free_ptr(fpst);
          }
          return;
 +
-+    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
++    case 0x00: /* FMLAL */
-+     * states defined in the ARM ARM for software singlestep:
++    case 0x04: /* FMLSL */
-+     *  SS_ACTIVE   PSTATE.SS   State
++    case 0x18: /* FMLAL2 */
-+     *     0            x       Inactive (the TB flag for SS is always 0)
++    case 0x1c: /* FMLSL2 */
-+     *     1            0       Active-pending
++        {
-+     *     1            1       Active-not-pending
++            int is_s = extract32(opcode, 2, 1);
-+     */
++            int is_2 = u;
-+    if (arm_singlestep_active(env)) {
++            int data = (index << 2) | (is_2 << 1) | is_s;
-+        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
++            tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
-+        if (is_a64(env)) {
++                               vec_full_reg_offset(s, rn),
-+            if (env->pstate & PSTATE_SS) {
++                               vec_full_reg_offset(s, rm), cpu_env,
-+                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
++                               is_q ? 16 : 8, vec_full_reg_size(s),
-+            }
++                               data, gen_helper_gvec_fmlal_idx_a64);
 +        } else {
 +            if (env->uncached_cpsr & PSTATE_SS) {
 +                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
 +            }
 +        }
-+    }
++        return;
-+    if (arm_cpu_data_is_big_endian(env)) {
+     }
-+        *flags |= ARM_TBFLAG_BE_DATA_MASK;
-+    }
+     if (size == 3) {
 +    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
 +
 +    if (arm_v7m_is_handler_mode(env)) {
 +        *flags |= ARM_TBFLAG_HANDLER_MASK;
 +    }
 +
 +    *cs_base = 0;
 +}
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 06/21] target/arm: Use pointers in neon tbl helper
+[Qemu-devel] [PULL 14/16] target/arm: Implement VFMAL and VFMSL for aarch32
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than passing a regno to the helper, pass pointers to the
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-vector register directly.  This eliminates the need to pass in
+Message-id: 20190219222952.22183-4-richard.henderson@linaro.org
 the environment pointer and reduces the number of places that
 directly access env->vfp.regs[].
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-5-richard.henderson@linaro.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h    |  2 +-
+ target/arm/cpu.h       |   5 ++
- target/arm/op_helper.c | 17 +++++++----------
+ target/arm/translate.c | 129 ++++++++++++++++++++++++++++++-----------
- target/arm/translate.c |  8 ++++----
+files changed, 101 insertions(+), 33 deletions(-)
-files changed, 12 insertions(+), 15 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/cpu.h
-+++ b/target/arm/helper.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_dp(const ARMISARegisters *id)
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+     return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0;
  DEF_HELPER_2(recpe_u32, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32, ptr)
 -DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int exception_target_el(CPUARMState *env)
      return target_el;
  }
--uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
++static inline bool isar_feature_aa32_fhm(const ARMISARegisters *id)
--                          uint32_t rn, uint32_t maxindex)
++{
-+uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
++    return FIELD_EX32(id->id_isar6, ID_ISAR6, FHM) != 0;
-+                          uint32_t maxindex)
++}
 +
  static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
  {
--    uint32_t val;
+     /*
 -    uint32_t tmp;
 -    int index;
 -    int shift;
 -    uint64_t *table;
 -    table = (uint64_t *)&env->vfp.regs[rn];
 +    uint32_t val, shift;
 +    uint64_t *table = vn;
 +
      val = 0;
      for (shift = 0; shift < 32; shift += 8) {
 -        index = (ireg >> shift) & 0xff;
 +        uint32_t index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 +            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
              val |= tmp << shift;
          } else {
              val |= def & (0xff << shift);
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
-                     tcg_gen_movi_i32(tmp, 0);
+     gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
-                 }
+     int rd, rn, rm, opr_sz;
-                 tmp2 = neon_load_reg(rm, 0);
+     int data = 0;
--                tmp4 = tcg_const_i32(rn);
+-    bool q;
-+                ptr1 = vfp_reg_ptr(true, rn);
+-
-                 tmp5 = tcg_const_i32(n);
+-    q = extract32(insn, 6, 1);
--                gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
+-    VFP_DREG_D(rd, insn);
-+                gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp5);
+-    VFP_DREG_N(rn, insn);
-                 tcg_temp_free_i32(tmp);
+-    VFP_DREG_M(rm, insn);
-                 if (insn & (1 << 6)) {
+-    if ((rd | rn | rm) & q) {
-                     tmp = neon_load_reg(rd, 1);
+-        return 1;
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+-    }
-                     tcg_gen_movi_i32(tmp, 0);
++    int off_rn, off_rm;
-                 }
++    bool is_long = false, q = extract32(insn, 6, 1);
-                 tmp3 = neon_load_reg(rm, 1);
++    bool ptr_is_env = false;
--                gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
-+                gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp5);
+     if ((insn & 0xfe200f10) == 0xfc200800) {
-                 tcg_temp_free_i32(tmp5);
+         /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
--                tcg_temp_free_i32(tmp4);
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
-+                tcg_temp_free_ptr(ptr1);
+             return 1;
-                 neon_store_reg(rd, 0, tmp2);
+         }
-                 neon_store_reg(rd, 1, tmp3);
+         fn_gvec = u ? gen_helper_gvec_udot_b : gen_helper_gvec_sdot_b;
-                 tcg_temp_free_i32(tmp);
++    } else if ((insn & 0xff300f10) == 0xfc200810) {
 +        /* VFM[AS]L -- 1111 1100 S.10 .... .... 1000 .Q.1 .... */
 +        int is_s = extract32(insn, 23, 1);
 +        if (!dc_isar_feature(aa32_fhm, s)) {
 +            return 1;
 +        }
 +        is_long = true;
 +        data = is_s; /* is_2 == 0 */
 +        fn_gvec_ptr = gen_helper_gvec_fmlal_a32;
 +        ptr_is_env = true;
      } else {
          return 1;
      }
 +    VFP_DREG_D(rd, insn);
 +    if (rd & q) {
 +        return 1;
 +    }
 +    if (q || !is_long) {
 +        VFP_DREG_N(rn, insn);
 +        VFP_DREG_M(rm, insn);
 +        if ((rn | rm) & q & !is_long) {
 +            return 1;
 +        }
 +        off_rn = vfp_reg_offset(1, rn);
 +        off_rm = vfp_reg_offset(1, rm);
 +    } else {
 +        rn = VFP_SREG_N(insn);
 +        rm = VFP_SREG_M(insn);
 +        off_rn = vfp_reg_offset(0, rn);
 +        off_rm = vfp_reg_offset(0, rm);
 +    }
 +
      if (s->fp_excp_el) {
          gen_exception_insn(s, 4, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
      opr_sz = (1 + q) * 8;
      if (fn_gvec_ptr) {
 -        TCGv_ptr fpst = get_fpstatus_ptr(1);
 -        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
 -                           vfp_reg_offset(1, rn),
 -                           vfp_reg_offset(1, rm), fpst,
 +        TCGv_ptr ptr;
 +        if (ptr_is_env) {
 +            ptr = cpu_env;
 +        } else {
 +            ptr = get_fpstatus_ptr(1);
 +        }
 +        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
                             opr_sz, opr_sz, data, fn_gvec_ptr);
 -        tcg_temp_free_ptr(fpst);
 +        if (!ptr_is_env) {
 +            tcg_temp_free_ptr(ptr);
 +        }
      } else {
 -        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd),
 -                           vfp_reg_offset(1, rn),
 -                           vfp_reg_offset(1, rm),
 +        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
                             opr_sz, opr_sz, data, fn_gvec);
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
      gen_helper_gvec_3 *fn_gvec = NULL;
      gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
      int rd, rn, rm, opr_sz, data;
 -    bool q;
 -
 -    q = extract32(insn, 6, 1);
 -    VFP_DREG_D(rd, insn);
 -    VFP_DREG_N(rn, insn);
 -    if ((rd | rn) & q) {
 -        return 1;
 -    }
 +    int off_rn, off_rm;
 +    bool is_long = false, q = extract32(insn, 6, 1);
 +    bool ptr_is_env = false;
      if ((insn & 0xff000f10) == 0xfe000800) {
          /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
      } else if ((insn & 0xffb00f00) == 0xfe200d00) {
          /* V[US]DOT -- 1111 1110 0.10 .... .... 1101 .Q.U .... */
          int u = extract32(insn, 4, 1);
 +
          if (!dc_isar_feature(aa32_dp, s)) {
              return 1;
          }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
          /* rm is just Vm, and index is M.  */
          data = extract32(insn, 5, 1); /* index */
          rm = extract32(insn, 0, 4);
 +    } else if ((insn & 0xffa00f10) == 0xfe000810) {
 +        /* VFM[AS]L -- 1111 1110 0.0S .... .... 1000 .Q.1 .... */
 +        int is_s = extract32(insn, 20, 1);
 +        int vm20 = extract32(insn, 0, 3);
 +        int vm3 = extract32(insn, 3, 1);
 +        int m = extract32(insn, 5, 1);
 +        int index;
 +
 +        if (!dc_isar_feature(aa32_fhm, s)) {
 +            return 1;
 +        }
 +        if (q) {
 +            rm = vm20;
 +            index = m * 2 + vm3;
 +        } else {
 +            rm = vm20 * 2 + m;
 +            index = vm3;
 +        }
 +        is_long = true;
 +        data = (index << 2) | is_s; /* is_2 == 0 */
 +        fn_gvec_ptr = gen_helper_gvec_fmlal_idx_a32;
 +        ptr_is_env = true;
      } else {
          return 1;
      }
 +    VFP_DREG_D(rd, insn);
 +    if (rd & q) {
 +        return 1;
 +    }
 +    if (q || !is_long) {
 +        VFP_DREG_N(rn, insn);
 +        if (rn & q & !is_long) {
 +            return 1;
 +        }
 +        off_rn = vfp_reg_offset(1, rn);
 +        off_rm = vfp_reg_offset(1, rm);
 +    } else {
 +        rn = VFP_SREG_N(insn);
 +        off_rn = vfp_reg_offset(0, rn);
 +        off_rm = vfp_reg_offset(0, rm);
 +    }
      if (s->fp_excp_el) {
          gen_exception_insn(s, 4, EXCP_UDEF,
                             syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
      opr_sz = (1 + q) * 8;
      if (fn_gvec_ptr) {
 -        TCGv_ptr fpst = get_fpstatus_ptr(1);
 -        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
 -                           vfp_reg_offset(1, rn),
 -                           vfp_reg_offset(1, rm), fpst,
 +        TCGv_ptr ptr;
 +        if (ptr_is_env) {
 +            ptr = cpu_env;
 +        } else {
 +            ptr = get_fpstatus_ptr(1);
 +        }
 +        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
                             opr_sz, opr_sz, data, fn_gvec_ptr);
 -        tcg_temp_free_ptr(fpst);
 +        if (!ptr_is_env) {
 +            tcg_temp_free_ptr(ptr);
 +        }
      } else {
 -        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd),
 -                           vfp_reg_offset(1, rn),
 -                           vfp_reg_offset(1, rm),
 +        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
                             opr_sz, opr_sz, data, fn_gvec);
      }
      return 0;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/21] target/arm: Mark disas_set_insn_syndrome inline
+[Qemu-devel] [PULL 15/16] target/arm: Enable ARMv8.2-FHM for -cpu max
 From: Richard Henderson <richard.henderson@linaro.org>
-If it isn't used when translate.h is included,
-we'll get a compiler Werror.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190219222952.22183-5-richard.henderson@linaro.org
 Message-id: 20180119045438.28582-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.h | 2 +-
+ target/arm/cpu.c   | 1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/cpu64.c | 2 ++
 files changed, 3 insertions(+)
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
+--- a/target/arm/cpu.c
-+++ b/target/arm/translate.h
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
-             ? 3 : MAX(1, s->current_el);
+             t = cpu->isar.id_isar6;
- }
+             t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
+             t = FIELD_DP32(t, ID_ISAR6, DP, 1);
--static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
++            t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
-+static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+             cpu->isar.id_isar6 = t;
- {
-     /* We don't need to save all of the syndrome so we mask and shift
+             t = cpu->id_mmfr4;
-      * out unneeded bits to help the sleb128 encoder do a better job.
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);
          t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);
          t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);
 +        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);
          cpu->isar.id_aa64isar0 = t;
          t = cpu->isar.id_aa64isar1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          u = cpu->isar.id_isar6;
          u = FIELD_DP32(u, ID_ISAR6, JSCVT, 1);
          u = FIELD_DP32(u, ID_ISAR6, DP, 1);
 +        u = FIELD_DP32(u, ID_ISAR6, FHM, 1);
          cpu->isar.id_isar6 = u;
          /*
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 13/21] target/arm: Simplify fp_exception_el for user-only
+[Qemu-devel] [PULL 16/16] linux-user: Enable HWCAP_ASIMDFHM, HWCAP_JSCVT
 From: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180119045438.28582-16-richard.henderson@linaro.org
+Message-id: 20190219222952.22183-6-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 3 ++-
+ linux-user/elfload.c | 2 ++
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 2 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-user/elfload.c
-+++ b/target/arm/helper.c
++++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
-  */
+     GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
- static inline int fp_exception_el(CPUARMState *env)
+     GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
- {
+     GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
-+#ifndef CONFIG_USER_ONLY
++    GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
-     int fpen;
++    GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
-     int cur_el = arm_current_el(env);
+ #undef GET_FEATURE_ID
@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
          /* Trap all FP ops to EL3 */
          return 3;
      }
 -
 +#endif
      return 0;
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/21] hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
+Deleted patch
-From: Luc MICHEL <luc.michel@git.antfield.fr>
-In the GIC, when an IRQ is acknowledged, its state goes from "pending"
-to:
-   - "active" if the corresponding IRQ pin has been de-asserted
-   - "active and pending" otherwise.
-The GICv2 manual states that when a IRQ becomes active (or active and
-pending), the GIC should either signal another (higher priority) IRQ to
-the CPU if there is one, or de-assert the CPU IRQ pin.
-The current implementation of the GIC in QEMU does not check if the
-IRQ is already active when looking for pending interrupts with
-sufficient priority in gic_update(). This can lead to signaling an
-interrupt that is already active.
-This usually happens when splitting priority drop and interrupt
-deactivation. On priority drop, the IRQ stays active until deactivation.
-If it becomes pending again, chances are that it will be incorrectly
-selected as best_irq in gic_update().
-This commit fixes this by checking if the IRQ is not already active when
-looking for best_irq in gic_update().
-Note that regarding the ARM11MPCore GIC version, the corresponding
-manual is not clear on that point, but it has has no priority
-drop/interrupt deactivation separation, so this case should not happen.
-Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
-Message-id: 20180119145756.7629-3-luc.michel@greensocs.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/arm_gic.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
-+++ b/hw/intc/arm_gic.c
-@@ -XXX,XX +XXX,XX @@ void gic_update(GICState *s)
-         best_irq = 1023;
-         for (irq = 0; irq < s->num_irq; irq++) {
-             if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&
-+                (!GIC_TEST_ACTIVE(irq, cm)) &&
-                 (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {
-                 if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
-                     best_prio = GIC_GET_PRIORITY(irq, cpu);
---
-.7.4

-[Qemu-devel] [PULL 16/21] hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
+Deleted patch
-From: Luc MICHEL <luc.michel@git.antfield.fr>
-When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is
-, the non-secure BPR value is used. However, this value must be
-incremented by one so that it matches the secure world number of
-implemented priority bits (NS world has one less priority bit compared
-to the Secure world).
-Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
-Message-id: 20180119145756.7629-5-luc.michel@greensocs.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: add assert, as the gicv3 code has]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/arm_gic.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
-+++ b/hw/intc/arm_gic.c
-@@ -XXX,XX +XXX,XX @@ static int gic_get_group_priority(GICState *s, int cpu, int irq)
-     if (gic_has_groups(s) &&
-         !(s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) &&
-         GIC_TEST_GROUP(irq, (1 << cpu))) {
--        bpr = s->abpr[cpu];
-+        bpr = s->abpr[cpu] - 1;
-+        assert(bpr >= 0);
-     } else {
-         bpr = s->bpr[cpu];
-     }
---
-.7.4

-[Qemu-devel] [PULL 17/21] hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
+Deleted patch
-From: Luc MICHEL <luc.michel@git.antfield.fr>
-When C_CTRL.CBPR is 1, the Non-Secure view of C_BPR is altered:
-  - A Non-Secure read of C_BPR should return the BPR value plus 1,
-  saturated to 7,
-  - A Non-Secure write should be ignored.
-Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
-Message-id: 20180119145756.7629-6-luc.michel@greensocs.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: fixed comment typo]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/arm_gic.c | 16 +++++++++++++---
-file changed, 13 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
-+++ b/hw/intc/arm_gic.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
-         break;
-     case 0x08: /* Binary Point */
-         if (s->security_extn && !attrs.secure) {
--            /* BPR is banked. Non-secure copy stored in ABPR. */
--            *data = s->abpr[cpu];
-+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
-+                /* NS view of BPR when CBPR is 1 */
-+                *data = MIN(s->bpr[cpu] + 1, 7);
-+            } else {
-+                /* BPR is banked. Non-secure copy stored in ABPR. */
-+                *data = s->abpr[cpu];
-+            }
-         } else {
-             *data = s->bpr[cpu];
-         }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
-         break;
-     case 0x08: /* Binary Point */
-         if (s->security_extn && !attrs.secure) {
--            s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
-+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
-+                /* WI when CBPR is 1 */
-+                return MEMTX_OK;
-+            } else {
-+                s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
-+            }
-         } else {
-             s->bpr[cpu] = MAX(value & 0x7, GIC_MIN_BPR);
-         }
---
-.7.4

Arm queue built up to a point where it seems worth sending:
various bug fixes, plus RTH's refactoring in preparation for SVE.

thanks
-- PMM
 
 
The following changes since commit 0f79bfe38a2cf0f43c7ea4959da7f8ebd7858f3d:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-2.12-pull-request' into staging (2018-01-25 09:53:53 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180125

for you to fetch changes up to 24da047af0e99a83fcc0d50b86c0f2627f7418b3:

pl110: Implement vertical compare/next base interrupts (2018-01-25 11:45:30 +0000)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix address truncation in 64-bit pagetable walks
 * i.MX: Fix FEC/ENET receive functions
 * target/arm: preparatory refactoring for SVE emulation
 * hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
 * hw/intc/arm_gic: Fix C_RPR value on idle priority
 * hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
 * hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1
 * hw/arm/virt: Check that the CPU realize method succeeded
 * sdhci: fix a NULL pointer dereference due to uninitialized AddressSpace object
 * xilinx_spips: Correct usage of an uninitialized local variable
 * pl110: Implement vertical compare/next base interrupts

----------------------------------------------------------------
Ard Biesheuvel (1):
      target/arm: Fix 32-bit address truncation

Francisco Iglesias (1):
      xilinx_spips: Correct usage of an uninitialized local variable

Jean-Christophe Dubois (1):
      i.MX: Fix FEC/ENET receive funtions

Linus Walleij (1):
      pl110: Implement vertical compare/next base interrupts

Luc MICHEL (4):
      hw/intc/arm_gic: Prevent the GIC from signaling an IRQ when it's "active and pending"
      hw/intc/arm_gic: Fix C_RPR value on idle priority
      hw/intc/arm_gic: Fix group priority computation for group 1 IRQs
      hw/intc/arm_gic: Fix the NS view of C_BPR when C_CTRL.CBPR is 1

Peter Maydell (1):
      hw/arm/virt: Check that the CPU realize method succeeded

Philippe Mathieu-Daudé (1):
      sdhci: fix a NULL pointer dereference due to uninitialized AddresSpace object

Richard Henderson (11):
      target/arm: Mark disas_set_insn_syndrome inline
      target/arm: Use pointers in crypto helpers
      target/arm: Use pointers in neon zip/uzp helpers
      target/arm: Use pointers in neon tbl helper
      target/arm: Change the type of vfp.regs
      target/arm: Add aa{32, 64}_vfp_{dreg, qreg} helpers
      vmstate: Add VMSTATE_UINT64_SUB_ARRAY
      target/arm: Add ARM_FEATURE_SVE
      target/arm: Move cpu_get_tb_cpu_state out of line
      target/arm: Hoist store to flags output in cpu_get_tb_cpu_state
      target/arm: Simplify fp_exception_el for user-only

From: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Commit ("3b39d734141a target/arm: Handle page table walk load failures
correctly") modified both versions of the page table walking code (i.e.,
arm_ldl_ptw and arm_ldq_ptw) to record the result of the translation in
a temporary 'data' variable so that it can be inspected before being
returned. However, arm_ldq_ptw() returns an uint64_t, and using a
temporary uint32_t variable truncates the upper bits, corrupting the
result. This causes problems when using more than 4 GB of memory in
a TCG guest. So use a uint64_t instead.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Message-id: 20180119194648.25501-1-ard.biesheuvel@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     MemTxAttrs attrs = {};
     MemTxResult result = MEMTX_OK;
     AddressSpace *as;
-    uint32_t data;
+    uint64_t data;
 
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
-- 
2.7.4

From: Jean-Christophe Dubois <jcd@tribudubois.net>

The actual imx_eth_enable_rx() function is buggy.

It updates s->regs[ENET_RDAR] after calling qemu_flush_queued_packets().

qemu_flush_queued_packets() is going to call imx_XXX_receive() which itself
is going to call imx_eth_enable_rx().

By updating s->regs[ENET_RDAR] after calling qemu_flush_queued_packets()
we end up updating the register with an outdated value which might
lead to disabling the receive function in the i.MX FEC/ENET device.

This patch change the place where the register update is done so that the
register value stays up to date and the receive function can keep
running.

Reported-by: Fyleo <fyleo45@gmail.com>
Tested-by: Fyleo  <fyleo45@gmail.com>
Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Message-id: 20180113113445.2705-1-jcd@tribudubois.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Tested-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/imx_fec.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
 static void imx_eth_enable_rx(IMXFECState *s, bool flush)
 {
     IMXFECBufDesc bd;
-    bool rx_ring_full;
 
     imx_fec_read_bd(&bd, s->rx_descriptor);
 
-    rx_ring_full = !(bd.flags & ENET_BD_E);
+    s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0;
 
-    if (rx_ring_full) {
+    if (!s->regs[ENET_RDAR]) {
         FEC_PRINTF("RX buffer full\n");
     } else if (flush) {
         qemu_flush_queued_packets(qemu_get_queue(s->nic));
     }
-
-    s->regs[ENET_RDAR] = rx_ring_full ? 0 : ENET_RDAR_RDAR;
 }
 
 static void imx_eth_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
     case ENET_RDAR:
         if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
             if (!s->regs[index]) {
-                s->regs[index] = ENET_RDAR_RDAR;
                 imx_eth_enable_rx(s, true);
             }
         } else {
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

If it isn't used when translate.h is included,
we'll get a compiler Werror.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int default_exception_el(DisasContext *s)
             ? 3 : MAX(1, s->current_el);
 }
 
-static void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
+static inline void disas_set_insn_syndrome(DisasContext *s, uint32_t syn)
 {
     /* We don't need to save all of the syndrome so we mask and shift
      * out unneeded bits to help the sleb128 encoder do a better job.
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Rather than passing regnos to the helpers, pass pointers to the
vector registers directly.  This eliminates the need to pass in
the environment pointer and reduces the number of places that
directly access env->vfp.regs[].

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  18 ++---
 target/arm/crypto_helper.c | 184 +++++++++++++++++----------------------------
 target/arm/translate-a64.c |  75 ++++++++++--------
 target/arm/translate.c     |  68 +++++++++--------
 4 files changed, 161 insertions(+), 184 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
 DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
 DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
 
-DEF_HELPER_4(crypto_aese, void, env, i32, i32, i32)
-DEF_HELPER_4(crypto_aesmc, void, env, i32, i32, i32)
+DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
+DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 
-DEF_HELPER_5(crypto_sha1_3reg, void, env, i32, i32, i32, i32)
-DEF_HELPER_3(crypto_sha1h, void, env, i32, i32)
-DEF_HELPER_3(crypto_sha1su1, void, env, i32, i32)
+DEF_HELPER_FLAGS_4(crypto_sha1_3reg, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_2(crypto_sha1h, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(crypto_sha1su1, TCG_CALL_NO_RWG, void, ptr, ptr)
 
-DEF_HELPER_4(crypto_sha256h, void, env, i32, i32, i32)
-DEF_HELPER_4(crypto_sha256h2, void, env, i32, i32, i32)
-DEF_HELPER_3(crypto_sha256su0, void, env, i32, i32)
-DEF_HELPER_4(crypto_sha256su1, void, env, i32, i32, i32)
+DEF_HELPER_FLAGS_3(crypto_sha256h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
+DEF_HELPER_FLAGS_3(crypto_sha256h2, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
+DEF_HELPER_FLAGS_2(crypto_sha256su0, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_3(crypto_sha256su1, TCG_CALL_NO_RWG, void, ptr, ptr, ptr)
 
 DEF_HELPER_FLAGS_3(crc32, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
 DEF_HELPER_FLAGS_3(crc32c, TCG_CALL_NO_RWG_SE, i32, i32, i32, i32)
diff --git a/target/arm/crypto_helper.c b/target/arm/crypto_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/crypto_helper.c
+++ b/target/arm/crypto_helper.c
@@ -XXX,XX +XXX,XX @@ union CRYPTO_STATE {
 #define CR_ST_WORD(state, i)   (state.words[i])
 #endif
 
-void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
-                         uint32_t decrypt)
+void HELPER(crypto_aese)(void *vd, void *vm, uint32_t decrypt)
 {
     static uint8_t const * const sbox[2] = { AES_sbox, AES_isbox };
     static uint8_t const * const shift[2] = { AES_shifts, AES_ishifts };
-
-    union CRYPTO_STATE rk = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
-    union CRYPTO_STATE st = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE rk = { .l = { rm[0], rm[1] } };
+    union CRYPTO_STATE st = { .l = { rd[0], rd[1] } };
     int i;
 
     assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aese)(CPUARMState *env, uint32_t rd, uint32_t rm,
         CR_ST_BYTE(st, i) = sbox[decrypt][CR_ST_BYTE(rk, shift[decrypt][i])];
     }
 
-    env->vfp.regs[rd] = make_float64(st.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
+    rd[0] = st.l[0];
+    rd[1] = st.l[1];
 }
 
-void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
-                          uint32_t decrypt)
+void HELPER(crypto_aesmc)(void *vd, void *vm, uint32_t decrypt)
 {
     static uint32_t const mc[][256] = { {
         /* MixColumns lookup table */
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
         0x92b479a7, 0x99b970a9, 0x84ae6bbb, 0x8fa362b5,
         0xbe805d9f, 0xb58d5491, 0xa89a4f83, 0xa397468d,
     } };
-    union CRYPTO_STATE st = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE st = { .l = { rm[0], rm[1] } };
     int i;
 
     assert(decrypt < 2);
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_aesmc)(CPUARMState *env, uint32_t rd, uint32_t rm,
             rol32(mc[decrypt][CR_ST_BYTE(st, i + 3)], 24);
     }
 
-    env->vfp.regs[rd] = make_float64(st.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(st.l[1]);
+    rd[0] = st.l[0];
+    rd[1] = st.l[1];
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static uint32_t maj(uint32_t x, uint32_t y, uint32_t z)
     return (x & y) | ((x | y) & z);
 }
 
-void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                              uint32_t rm, uint32_t op)
+void HELPER(crypto_sha1_3reg)(void *vd, void *vn, void *vm, uint32_t op)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     if (op == 3) { /* sha1su0 */
         d.l[0] ^= d.l[1] ^ m.l[0];
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha1_3reg)(CPUARMState *env, uint32_t rd, uint32_t rn,
             CR_ST_WORD(d, 0) = t;
         }
     }
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha1h)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha1h)(void *vd, void *vm)
 {
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(m, 0) = ror32(CR_ST_WORD(m, 0), 2);
     CR_ST_WORD(m, 1) = CR_ST_WORD(m, 2) = CR_ST_WORD(m, 3) = 0;
 
-    env->vfp.regs[rd] = make_float64(m.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(m.l[1]);
+    rd[0] = m.l[0];
+    rd[1] = m.l[1];
 }
 
-void HELPER(crypto_sha1su1)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha1su1)(void *vd, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) = rol32(CR_ST_WORD(d, 0) ^ CR_ST_WORD(m, 1), 1);
     CR_ST_WORD(d, 1) = rol32(CR_ST_WORD(d, 1) ^ CR_ST_WORD(m, 2), 1);
     CR_ST_WORD(d, 2) = rol32(CR_ST_WORD(d, 2) ^ CR_ST_WORD(m, 3), 1);
     CR_ST_WORD(d, 3) = rol32(CR_ST_WORD(d, 3) ^ CR_ST_WORD(d, 0), 1);
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static uint32_t s1(uint32_t x)
     return ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10);
 }
 
-void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                            uint32_t rm)
+void HELPER(crypto_sha256h)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h)(CPUARMState *env, uint32_t rd, uint32_t rn,
         CR_ST_WORD(d, 0) = t;
     }
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                             uint32_t rm)
+void HELPER(crypto_sha256h2)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
     int i;
 
     for (i = 0; i < 4; i++) {
@@ -XXX,XX +XXX,XX @@ void HELPER(crypto_sha256h2)(CPUARMState *env, uint32_t rd, uint32_t rn,
         CR_ST_WORD(d, 0) = CR_ST_WORD(n, 3 - i) + t;
     }
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256su0)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(crypto_sha256su0)(void *vd, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) += s0(CR_ST_WORD(d, 1));
     CR_ST_WORD(d, 1) += s0(CR_ST_WORD(d, 2));
     CR_ST_WORD(d, 2) += s0(CR_ST_WORD(d, 3));
     CR_ST_WORD(d, 3) += s0(CR_ST_WORD(m, 0));
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
 
-void HELPER(crypto_sha256su1)(CPUARMState *env, uint32_t rd, uint32_t rn,
-                              uint32_t rm)
+void HELPER(crypto_sha256su1)(void *vd, void *vn, void *vm)
 {
-    union CRYPTO_STATE d = { .l = {
-        float64_val(env->vfp.regs[rd]),
-        float64_val(env->vfp.regs[rd + 1])
-    } };
-    union CRYPTO_STATE n = { .l = {
-        float64_val(env->vfp.regs[rn]),
-        float64_val(env->vfp.regs[rn + 1])
-    } };
-    union CRYPTO_STATE m = { .l = {
-        float64_val(env->vfp.regs[rm]),
-        float64_val(env->vfp.regs[rm + 1])
-    } };
+    uint64_t *rd = vd;
+    uint64_t *rn = vn;
+    uint64_t *rm = vm;
+    union CRYPTO_STATE d = { .l = { rd[0], rd[1] } };
+    union CRYPTO_STATE n = { .l = { rn[0], rn[1] } };
+    union CRYPTO_STATE m = { .l = { rm[0], rm[1] } };
 
     CR_ST_WORD(d, 0) += s1(CR_ST_WORD(m, 2)) + CR_ST_WORD(n, 1);
     CR_ST_WORD(d, 1) += s1(CR_ST_WORD(m, 3)) + CR_ST_WORD(n, 2);
     CR_ST_WORD(d, 2) += s1(CR_ST_WORD(d, 0)) + CR_ST_WORD(n, 3);
     CR_ST_WORD(d, 3) += s1(CR_ST_WORD(d, 1)) + CR_ST_WORD(m, 0);
 
-    env->vfp.regs[rd] = make_float64(d.l[0]);
-    env->vfp.regs[rd + 1] = make_float64(d.l[1]);
+    rd[0] = d.l[0];
+    rd[1] = d.l[1];
 }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
 typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
 typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
-typedef void CryptoTwoOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32);
-typedef void CryptoThreeOpEnvFn(TCGv_ptr, TCGv_i32, TCGv_i32, TCGv_i32);
+typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
+typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
+typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void a64_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static inline int vec_reg_offset(DisasContext *s, int regno,
     return offs;
 }
 
+/* Return the offset info CPUARMState of the "whole" vector register Qn.  */
+static inline int vec_full_reg_offset(DisasContext *s, int regno)
+{
+    assert_fp_access_checked(s);
+    return offsetof(CPUARMState, vfp.regs[regno * 2]);
+}
+
+/* Return a newly allocated pointer to the vector register.  */
+static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vec_full_reg_offset(s, regno));
+    return ret;
+}
+
 /* Return the offset into CPUARMState of a slice (from
  * the least significant end) of FP register Qn (ie
  * Dn, Sn, Hn or Bn).
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
     int decrypt;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_decrypt;
-    CryptoThreeOpEnvFn *genfn;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
+    TCGv_i32 tcg_decrypt;
+    CryptoThreeOpIntFn *genfn;
 
     if (!arm_dc_feature(s, ARM_FEATURE_V8_AES)
         || size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_aes(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Note that we convert the Vx register indexes into the
-     * index within the vfp.regs[] array, so we can share the
-     * helper with the AArch32 instructions.
-     */
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
     tcg_decrypt = tcg_const_i32(decrypt);
 
-    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_decrypt);
+    genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_decrypt);
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
     tcg_temp_free_i32(tcg_decrypt);
 }
 
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
     int rm = extract32(insn, 16, 5);
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
-    CryptoThreeOpEnvFn *genfn;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno, tcg_rm_regno;
+    CryptoThreeOpFn *genfn;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr;
     int feature = ARM_FEATURE_V8_SHA256;
 
     if (size != 0) {
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_three_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
-    tcg_rm_regno = tcg_const_i32(rm << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
+    tcg_rm_ptr = vec_full_reg_ptr(s, rm);
 
     if (genfn) {
-        genfn(cpu_env, tcg_rd_regno, tcg_rn_regno, tcg_rm_regno);
+        genfn(tcg_rd_ptr, tcg_rn_ptr, tcg_rm_ptr);
     } else {
         TCGv_i32 tcg_opcode = tcg_const_i32(opcode);
 
-        gen_helper_crypto_sha1_3reg(cpu_env, tcg_rd_regno,
-                                    tcg_rn_regno, tcg_rm_regno, tcg_opcode);
+        gen_helper_crypto_sha1_3reg(tcg_rd_ptr, tcg_rn_ptr,
+                                    tcg_rm_ptr, tcg_opcode);
         tcg_temp_free_i32(tcg_opcode);
     }
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
-    tcg_temp_free_i32(tcg_rm_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
+    tcg_temp_free_ptr(tcg_rm_ptr);
 }
 
 /* Crypto two-reg SHA
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
     int opcode = extract32(insn, 12, 5);
     int rn = extract32(insn, 5, 5);
     int rd = extract32(insn, 0, 5);
-    CryptoTwoOpEnvFn *genfn;
+    CryptoTwoOpFn *genfn;
     int feature;
-    TCGv_i32 tcg_rd_regno, tcg_rn_regno;
+    TCGv_ptr tcg_rd_ptr, tcg_rn_ptr;
 
     if (size != 0) {
         unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_crypto_two_reg_sha(DisasContext *s, uint32_t insn)
         return;
     }
 
-    tcg_rd_regno = tcg_const_i32(rd << 1);
-    tcg_rn_regno = tcg_const_i32(rn << 1);
+    tcg_rd_ptr = vec_full_reg_ptr(s, rd);
+    tcg_rn_ptr = vec_full_reg_ptr(s, rn);
 
-    genfn(cpu_env, tcg_rd_regno, tcg_rn_regno);
+    genfn(tcg_rd_ptr, tcg_rn_ptr);
 
-    tcg_temp_free_i32(tcg_rd_regno);
-    tcg_temp_free_i32(tcg_rn_regno);
+    tcg_temp_free_ptr(tcg_rd_ptr);
+    tcg_temp_free_ptr(tcg_rn_ptr);
 }
 
 /* C3.6 Data processing - SIMD, inc Crypto
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void neon_store_reg64(TCGv_i64 var, int reg)
     tcg_gen_st_i64(var, cpu_env, vfp_reg_offset(1, reg));
 }
 
+static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+{
+    TCGv_ptr ret = tcg_temp_new_ptr();
+    tcg_gen_addi_ptr(ret, cpu_env, vfp_reg_offset(dp, reg));
+    return ret;
+}
+
 #define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_ld_f64 tcg_gen_ld_i64
 #define tcg_gen_st_f32 tcg_gen_st_i32
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     int u;
     uint32_t imm, mask;
     TCGv_i32 tmp, tmp2, tmp3, tmp4, tmp5;
+    TCGv_ptr ptr1, ptr2, ptr3;
     TCGv_i64 tmp64;
 
     /* FIXME: this access check should not take precedence over UNDEF
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                     return 1;
                 }
-                tmp = tcg_const_i32(rd);
-                tmp2 = tcg_const_i32(rn);
-                tmp3 = tcg_const_i32(rm);
+                ptr1 = vfp_reg_ptr(true, rd);
+                ptr2 = vfp_reg_ptr(true, rn);
+                ptr3 = vfp_reg_ptr(true, rm);
                 tmp4 = tcg_const_i32(size);
-                gen_helper_crypto_sha1_3reg(cpu_env, tmp, tmp2, tmp3, tmp4);
+                gen_helper_crypto_sha1_3reg(ptr1, ptr2, ptr3, tmp4);
                 tcg_temp_free_i32(tmp4);
             } else { /* SHA-256 */
                 if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA256) || size == 3) {
                     return 1;
                 }
-                tmp = tcg_const_i32(rd);
-                tmp2 = tcg_const_i32(rn);
-                tmp3 = tcg_const_i32(rm);
+                ptr1 = vfp_reg_ptr(true, rd);
+                ptr2 = vfp_reg_ptr(true, rn);
+                ptr3 = vfp_reg_ptr(true, rm);
                 switch (size) {
                 case 0:
-                    gen_helper_crypto_sha256h(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256h(ptr1, ptr2, ptr3);
                     break;
                 case 1:
-                    gen_helper_crypto_sha256h2(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256h2(ptr1, ptr2, ptr3);
                     break;
                 case 2:
-                    gen_helper_crypto_sha256su1(cpu_env, tmp, tmp2, tmp3);
+                    gen_helper_crypto_sha256su1(ptr1, ptr2, ptr3);
                     break;
                 }
             }
-            tcg_temp_free_i32(tmp);
-            tcg_temp_free_i32(tmp2);
-            tcg_temp_free_i32(tmp3);
+            tcg_temp_free_ptr(ptr1);
+            tcg_temp_free_ptr(ptr2);
+            tcg_temp_free_ptr(ptr3);
             return 0;
         }
         if (size == 3 && op != NEON_3R_LOGIC) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         || ((rm | rd) & 1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
 
                      /* Bit 6 is the lowest opcode bit; it distinguishes between
                       * encryption (AESE/AESMC) and decryption (AESD/AESIMC)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp3 = tcg_const_i32(extract32(insn, 6, 1));
 
                     if (op == NEON_2RM_AESE) {
-                        gen_helper_crypto_aese(cpu_env, tmp, tmp2, tmp3);
+                        gen_helper_crypto_aese(ptr1, ptr2, tmp3);
                     } else {
-                        gen_helper_crypto_aesmc(cpu_env, tmp, tmp2, tmp3);
+                        gen_helper_crypto_aesmc(ptr1, ptr2, tmp3);
                     }
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     tcg_temp_free_i32(tmp3);
                     break;
                 case NEON_2RM_SHA1H:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         || ((rm | rd) & 1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
 
-                    gen_helper_crypto_sha1h(cpu_env, tmp, tmp2);
+                    gen_helper_crypto_sha1h(ptr1, ptr2);
 
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     break;
                 case NEON_2RM_SHA1SU1:
                     if ((rm | rd) & 1) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     } else if (!arm_dc_feature(s, ARM_FEATURE_V8_SHA1)) {
                         return 1;
                     }
-                    tmp = tcg_const_i32(rd);
-                    tmp2 = tcg_const_i32(rm);
+                    ptr1 = vfp_reg_ptr(true, rd);
+                    ptr2 = vfp_reg_ptr(true, rm);
                     if (q) {
-                        gen_helper_crypto_sha256su0(cpu_env, tmp, tmp2);
+                        gen_helper_crypto_sha256su0(ptr1, ptr2);
                     } else {
-                        gen_helper_crypto_sha1su1(cpu_env, tmp, tmp2);
+                        gen_helper_crypto_sha1su1(ptr1, ptr2);
                     }
-                    tcg_temp_free_i32(tmp);
-                    tcg_temp_free_i32(tmp2);
+                    tcg_temp_free_ptr(ptr1);
+                    tcg_temp_free_ptr(ptr2);
                     break;
                 default:
                 elementwise:
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180119045438.28582-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h      |  20 +++---
 target/arm/neon_helper.c | 162 +++++++++++++++++++++++++----------------------
 target/arm/translate.c   |  42 ++++++------
 3 files changed, 120 insertions(+), 104 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
 DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
 DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
 
-DEF_HELPER_3(neon_unzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_unzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qunzip32, void, env, i32, i32)
-DEF_HELPER_3(neon_zip8, void, env, i32, i32)
-DEF_HELPER_3(neon_zip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip8, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip16, void, env, i32, i32)
-DEF_HELPER_3(neon_qzip32, void, env, i32, i32)
+DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qunzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_zip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
+DEF_HELPER_FLAGS_2(neon_qzip32, TCG_CALL_NO_RWG, void, ptr, ptr)
 
 DEF_HELPER_FLAGS_3(crypto_aese, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
 DEF_HELPER_FLAGS_3(crypto_aesmc, TCG_CALL_NO_RWG, void, ptr, ptr, i32)
diff --git a/target/arm/neon_helper.c b/target/arm/neon_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon_helper.c
+++ b/target/arm/neon_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_acgt_f64)(uint64_t a, uint64_t b, void *fpstp)
 
 #define ELEM(V, N, SIZE) (((V) >> ((N) * (SIZE))) & ((1ull << (SIZE)) - 1))
 
-void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip8)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zd0, 2, 8) << 8)
         | (ELEM(zd0, 4, 8) << 16) | (ELEM(zd0, 6, 8) << 24)
         | (ELEM(zd1, 0, 8) << 32) | (ELEM(zd1, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zm0, 5, 8) << 16) | (ELEM(zm0, 7, 8) << 24)
         | (ELEM(zm1, 1, 8) << 32) | (ELEM(zm1, 3, 8) << 40)
         | (ELEM(zm1, 5, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip16)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zd0, 2, 16) << 16)
         | (ELEM(zd1, 0, 16) << 32) | (ELEM(zd1, 2, 16) << 48);
     uint64_t d1 = ELEM(zm0, 0, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qunzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 1, 16) << 32) | (ELEM(zd1, 3, 16) << 48);
     uint64_t m1 = ELEM(zm0, 1, 16) | (ELEM(zm0, 3, 16) << 16)
         | (ELEM(zm1, 1, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qunzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qunzip32)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zd1, 0, 32) << 32);
     uint64_t d1 = ELEM(zm0, 0, 32) | (ELEM(zm1, 0, 32) << 32);
     uint64_t m0 = ELEM(zd0, 1, 32) | (ELEM(zd1, 1, 32) << 32);
     uint64_t m1 = ELEM(zm0, 1, 32) | (ELEM(zm1, 1, 32) << 32);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_unzip8)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zd, 2, 8) << 8)
         | (ELEM(zd, 4, 8) << 16) | (ELEM(zd, 6, 8) << 24)
         | (ELEM(zm, 0, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_unzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd, 5, 8) << 16) | (ELEM(zd, 7, 8) << 24)
         | (ELEM(zm, 1, 8) << 32) | (ELEM(zm, 3, 8) << 40)
         | (ELEM(zm, 5, 8) << 48) | (ELEM(zm, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_unzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_unzip16)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zd, 2, 16) << 16)
         | (ELEM(zm, 0, 16) << 32) | (ELEM(zm, 2, 16) << 48);
     uint64_t m0 = ELEM(zd, 1, 16) | (ELEM(zd, 3, 16) << 16)
         | (ELEM(zm, 1, 16) << 32) | (ELEM(zm, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip8)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 8) | (ELEM(zm0, 0, 8) << 8)
         | (ELEM(zd0, 1, 8) << 16) | (ELEM(zm0, 1, 8) << 24)
         | (ELEM(zd0, 2, 8) << 32) | (ELEM(zm0, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 5, 8) << 16) | (ELEM(zm1, 5, 8) << 24)
         | (ELEM(zd1, 6, 8) << 32) | (ELEM(zm1, 6, 8) << 40)
         | (ELEM(zd1, 7, 8) << 48) | (ELEM(zm1, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip16)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 16) | (ELEM(zm0, 0, 16) << 16)
         | (ELEM(zd0, 1, 16) << 32) | (ELEM(zm0, 1, 16) << 48);
     uint64_t d1 = ELEM(zd0, 2, 16) | (ELEM(zm0, 2, 16) << 16)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_qzip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd1, 1, 16) << 32) | (ELEM(zm1, 1, 16) << 48);
     uint64_t m1 = ELEM(zd1, 2, 16) | (ELEM(zm1, 2, 16) << 16)
         | (ELEM(zd1, 3, 16) << 32) | (ELEM(zm1, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_qzip32)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_qzip32)(void *vd, void *vm)
 {
-    uint64_t zm0 = float64_val(env->vfp.regs[rm]);
-    uint64_t zm1 = float64_val(env->vfp.regs[rm + 1]);
-    uint64_t zd0 = float64_val(env->vfp.regs[rd]);
-    uint64_t zd1 = float64_val(env->vfp.regs[rd + 1]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd0 = rd[0], zd1 = rd[1];
+    uint64_t zm0 = rm[0], zm1 = rm[1];
+
     uint64_t d0 = ELEM(zd0, 0, 32) | (ELEM(zm0, 0, 32) << 32);
     uint64_t d1 = ELEM(zd0, 1, 32) | (ELEM(zm0, 1, 32) << 32);
     uint64_t m0 = ELEM(zd1, 0, 32) | (ELEM(zm1, 0, 32) << 32);
     uint64_t m1 = ELEM(zd1, 1, 32) | (ELEM(zm1, 1, 32) << 32);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rm + 1] = make_float64(m1);
-    env->vfp.regs[rd] = make_float64(d0);
-    env->vfp.regs[rd + 1] = make_float64(d1);
+
+    rm[0] = m0;
+    rm[1] = m1;
+    rd[0] = d0;
+    rd[1] = d1;
 }
 
-void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_zip8)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 8) | (ELEM(zm, 0, 8) << 8)
         | (ELEM(zd, 1, 8) << 16) | (ELEM(zm, 1, 8) << 24)
         | (ELEM(zd, 2, 8) << 32) | (ELEM(zm, 2, 8) << 40)
@@ -XXX,XX +XXX,XX @@ void HELPER(neon_zip8)(CPUARMState *env, uint32_t rd, uint32_t rm)
         | (ELEM(zd, 5, 8) << 16) | (ELEM(zm, 5, 8) << 24)
         | (ELEM(zd, 6, 8) << 32) | (ELEM(zm, 6, 8) << 40)
         | (ELEM(zd, 7, 8) << 48) | (ELEM(zm, 7, 8) << 56);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
-void HELPER(neon_zip16)(CPUARMState *env, uint32_t rd, uint32_t rm)
+void HELPER(neon_zip16)(void *vd, void *vm)
 {
-    uint64_t zm = float64_val(env->vfp.regs[rm]);
-    uint64_t zd = float64_val(env->vfp.regs[rd]);
+    uint64_t *rd = vd, *rm = vm;
+    uint64_t zd = rd[0], zm = rm[0];
+
     uint64_t d0 = ELEM(zd, 0, 16) | (ELEM(zm, 0, 16) << 16)
         | (ELEM(zd, 1, 16) << 32) | (ELEM(zm, 1, 16) << 48);
     uint64_t m0 = ELEM(zd, 2, 16) | (ELEM(zm, 2, 16) << 16)
         | (ELEM(zd, 3, 16) << 32) | (ELEM(zm, 3, 16) << 48);
-    env->vfp.regs[rm] = make_float64(m0);
-    env->vfp.regs[rd] = make_float64(d0);
+
+    rm[0] = m0;
+    rd[0] = d0;
 }
 
 /* Helper function for 64 bit polynomial multiply case:
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline TCGv_i32 neon_get_scalar(int size, int reg)
 
 static int gen_neon_unzip(int rd, int rm, int size, int q)
 {
-    TCGv_i32 tmp, tmp2;
+    TCGv_ptr pd, pm;
+    
     if (!q && size == 2) {
         return 1;
     }
-    tmp = tcg_const_i32(rd);
-    tmp2 = tcg_const_i32(rm);
+    pd = vfp_reg_ptr(true, rd);
+    pm = vfp_reg_ptr(true, rm);
     if (q) {
         switch (size) {
         case 0:
-            gen_helper_neon_qunzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_qunzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip16(pd, pm);
             break;
         case 2:
-            gen_helper_neon_qunzip32(cpu_env, tmp, tmp2);
+            gen_helper_neon_qunzip32(pd, pm);
             break;
         default:
             abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_unzip(int rd, int rm, int size, int q)
     } else {
         switch (size) {
         case 0:
-            gen_helper_neon_unzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_unzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_unzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_unzip16(pd, pm);
             break;
         default:
             abort();
         }
     }
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp2);
+    tcg_temp_free_ptr(pd);
+    tcg_temp_free_ptr(pm);
     return 0;
 }
 
 static int gen_neon_zip(int rd, int rm, int size, int q)
 {
-    TCGv_i32 tmp, tmp2;
+    TCGv_ptr pd, pm;
+
     if (!q && size == 2) {
         return 1;
     }
-    tmp = tcg_const_i32(rd);
-    tmp2 = tcg_const_i32(rm);
+    pd = vfp_reg_ptr(true, rd);
+    pm = vfp_reg_ptr(true, rm);
     if (q) {
         switch (size) {
         case 0:
-            gen_helper_neon_qzip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_qzip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip16(pd, pm);
             break;
         case 2:
-            gen_helper_neon_qzip32(cpu_env, tmp, tmp2);
+            gen_helper_neon_qzip32(pd, pm);
             break;
         default:
             abort();
@@ -XXX,XX +XXX,XX @@ static int gen_neon_zip(int rd, int rm, int size, int q)
     } else {
         switch (size) {
         case 0:
-            gen_helper_neon_zip8(cpu_env, tmp, tmp2);
+            gen_helper_neon_zip8(pd, pm);
             break;
         case 1:
-            gen_helper_neon_zip16(cpu_env, tmp, tmp2);
+            gen_helper_neon_zip16(pd, pm);
             break;
         default:
             abort();
         }
     }
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp2);
+    tcg_temp_free_ptr(pd);
+    tcg_temp_free_ptr(pm);
     return 0;
 }
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Rather than passing a regno to the helper, pass pointers to the
vector register directly.  This eliminates the need to pass in
the environment pointer and reduces the number of places that
directly access env->vfp.regs[].

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-5-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h    |  2 +-
 target/arm/op_helper.c | 17 +++++++----------
 target/arm/translate.c |  8 ++++----
 3 files changed, 12 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_2(recpe_u32, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32, ptr)
-DEF_HELPER_5(neon_tbl, i32, env, i32, i32, i32, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ static int exception_target_el(CPUARMState *env)
     return target_el;
 }
 
-uint32_t HELPER(neon_tbl)(CPUARMState *env, uint32_t ireg, uint32_t def,
-                          uint32_t rn, uint32_t maxindex)
+uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
+                          uint32_t maxindex)
 {
-    uint32_t val;
-    uint32_t tmp;
-    int index;
-    int shift;
-    uint64_t *table;
-    table = (uint64_t *)&env->vfp.regs[rn];
+    uint32_t val, shift;
+    uint64_t *table = vn;
+
     val = 0;
     for (shift = 0; shift < 32; shift += 8) {
-        index = (ireg >> shift) & 0xff;
+        uint32_t index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
+            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
             val |= tmp << shift;
         } else {
             val |= def & (0xff << shift);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tcg_gen_movi_i32(tmp, 0);
                 }
                 tmp2 = neon_load_reg(rm, 0);
-                tmp4 = tcg_const_i32(rn);
+                ptr1 = vfp_reg_ptr(true, rn);
                 tmp5 = tcg_const_i32(n);
-                gen_helper_neon_tbl(tmp2, cpu_env, tmp2, tmp, tmp4, tmp5);
+                gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp5);
                 tcg_temp_free_i32(tmp);
                 if (insn & (1 << 6)) {
                     tmp = neon_load_reg(rd, 1);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tcg_gen_movi_i32(tmp, 0);
                 }
                 tmp3 = neon_load_reg(rm, 1);
-                gen_helper_neon_tbl(tmp3, cpu_env, tmp3, tmp, tmp4, tmp5);
+                gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp5);
                 tcg_temp_free_i32(tmp5);
-                tcg_temp_free_i32(tmp4);
+                tcg_temp_free_ptr(ptr1);
                 neon_store_reg(rd, 0, tmp2);
                 neon_store_reg(rd, 1, tmp3);
                 tcg_temp_free_i32(tmp);
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

All direct users of this field want an integral value.  Drop all
of the extra casting between uint64_t and float64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-6-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  2 +-
 target/arm/arch_dump.c     |  4 ++--
 target/arm/helper.c        | 20 ++++++++++----------
 target/arm/machine.c       |  2 +-
 target/arm/translate-a64.c |  8 ++++----
 target/arm/translate.c     |  2 +-
 6 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
          * the two execution states, and means we do not need to explicitly
          * map these registers when changing states.
          */
-        float64 regs[64];
+        uint64_t regs[64];
 
         uint32_t xregs[16];
         /* We store these fpcsr fields separately for convenience.  */
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 
     for (i = 0; i < 64; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
 
     for (i = 0; i < 32; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, float64_val(env->vfp.regs[i]));
+        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
     }
 
     note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     /* VFP data registers are always little-endian.  */
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        stfq_le_p(buf, env->vfp.regs[reg]);
+        stq_le_p(buf, env->vfp.regs[reg]);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         /* Aliases for Q regs.  */
         nregs += 16;
         if (reg < nregs) {
-            stfq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
-            stfq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
+            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
+            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        env->vfp.regs[reg] = ldfq_le_p(buf);
+        env->vfp.regs[reg] = ldq_le_p(buf);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         nregs += 16;
         if (reg < nregs) {
-            env->vfp.regs[(reg - 32) * 2] = ldfq_le_p(buf);
-            env->vfp.regs[(reg - 32) * 2 + 1] = ldfq_le_p(buf + 8);
+            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
+            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        stfq_le_p(buf, env->vfp.regs[reg * 2]);
-        stfq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
+        stq_le_p(buf, env->vfp.regs[reg * 2]);
+        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
         return 16;
     case 32:
         /* FPSR */
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        env->vfp.regs[reg * 2] = ldfq_le_p(buf);
-        env->vfp.regs[reg * 2 + 1] = ldfq_le_p(buf + 8);
+        env->vfp.regs[reg * 2] = ldq_le_p(buf);
+        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
         return 16;
     case 32:
         /* FPSR */
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_vfp = {
     .minimum_version_id = 3,
     .needed = vfp_needed,
     .fields = (VMStateField[]) {
-        VMSTATE_FLOAT64_ARRAY(env.vfp.regs, ARMCPU, 64),
+        VMSTATE_UINT64_ARRAY(env.vfp.regs, ARMCPU, 64),
         /* The xregs array is a little awkward because element 1 (FPSCR)
          * requires a specific accessor, so we have to split it up in
          * the vmstate:
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
     if (flags & CPU_DUMP_FPU) {
         int numvfpregs = 32;
         for (i = 0; i < numvfpregs; i += 2) {
-            uint64_t vlo = float64_val(env->vfp.regs[i * 2]);
-            uint64_t vhi = float64_val(env->vfp.regs[(i * 2) + 1]);
+            uint64_t vlo = env->vfp.regs[i * 2];
+            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
             cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
                         i, vhi, vlo);
-            vlo = float64_val(env->vfp.regs[(i + 1) * 2]);
-            vhi = float64_val(env->vfp.regs[((i + 1) * 2) + 1]);
+            vlo = env->vfp.regs[(i + 1) * 2];
+            vhi = env->vfp.regs[((i + 1) * 2) + 1];
             cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
                         i + 1, vhi, vlo);
         }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
             numvfpregs += 16;
         }
         for (i = 0; i < numvfpregs; i++) {
-            uint64_t v = float64_val(env->vfp.regs[i]);
+            uint64_t v = env->vfp.regs[i];
             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                         i * 2, (uint32_t)v,
                         i * 2 + 1, (uint32_t)(v >> 32),
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Helpers that return a pointer into env->vfp.regs so that we isolate
the logic of how to index the regs array for different cpu modes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-7-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 27 +++++++++++++++++++++++++++
 linux-user/signal.c        | 22 ++++++++++++----------
 target/arm/arch_dump.c     |  8 +++++---
 target/arm/helper-a64.c    |  5 +++--
 target/arm/helper.c        | 32 ++++++++++++++++++++------------
 target/arm/kvm32.c         |  4 ++--
 target/arm/kvm64.c         | 31 ++++++++++---------------------
 target/arm/translate-a64.c | 25 ++++++++-----------------
 target/arm/translate.c     | 16 +++++++++-------
 9 files changed, 96 insertions(+), 74 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void *arm_get_el_change_hook_opaque(ARMCPU *cpu)
     return cpu->el_change_hook_opaque;
 }
 
+/**
+ * aa32_vfp_dreg:
+ * Return a pointer to the Dn register within env in 32-bit mode.
+ */
+static inline uint64_t *aa32_vfp_dreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[regno];
+}
+
+/**
+ * aa32_vfp_qreg:
+ * Return a pointer to the Qn register within env in 32-bit mode.
+ */
+static inline uint64_t *aa32_vfp_qreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[2 * regno];
+}
+
+/**
+ * aa64_vfp_qreg:
+ * Return a pointer to the Qn register within env in 64-bit mode.
+ */
+static inline uint64_t *aa64_vfp_qreg(CPUARMState *env, unsigned regno)
+{
+    return &env->vfp.regs[2 * regno];
+}
+
 #endif
diff --git a/linux-user/signal.c b/linux-user/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -XXX,XX +XXX,XX @@ static int target_setup_sigframe(struct target_rt_sigframe *sf,
     }
 
     for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef TARGET_WORDS_BIGENDIAN
-        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
-        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
+        __put_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
+        __put_user(q[1], &aux->fpsimd.vregs[i * 2]);
 #else
-        __put_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
-        __put_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
+        __put_user(q[0], &aux->fpsimd.vregs[i * 2]);
+        __put_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
 #endif
     }
     __put_user(vfp_get_fpsr(env), &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static int target_restore_sigframe(CPUARMState *env,
     }
 
     for (i = 0; i < 32; i++) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef TARGET_WORDS_BIGENDIAN
-        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2 + 1]);
-        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2]);
+        __get_user(q[0], &aux->fpsimd.vregs[i * 2 + 1]);
+        __get_user(q[1], &aux->fpsimd.vregs[i * 2]);
 #else
-        __get_user(env->vfp.regs[i * 2], &aux->fpsimd.vregs[i * 2]);
-        __get_user(env->vfp.regs[i * 2 + 1], &aux->fpsimd.vregs[i * 2 + 1]);
+        __get_user(q[0], &aux->fpsimd.vregs[i * 2]);
+        __get_user(q[1], &aux->fpsimd.vregs[i * 2 + 1]);
 #endif
     }
     __get_user(fpsr, &aux->fpsimd.fpsr);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *setup_sigframe_v2_vfp(abi_ulong *regspace, CPUARMState *env)
     __put_user(TARGET_VFP_MAGIC, &vfpframe->magic);
     __put_user(sizeof(*vfpframe), &vfpframe->size);
     for (i = 0; i < 32; i++) {
-        __put_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
+        __put_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
     }
     __put_user(vfp_get_fpscr(env), &vfpframe->ufp.fpscr);
     __put_user(env->vfp.xregs[ARM_VFP_FPEXC], &vfpframe->ufp_exc.fpexc);
@@ -XXX,XX +XXX,XX @@ static abi_ulong *restore_sigframe_v2_vfp(CPUARMState *env, abi_ulong *regspace)
         return 0;
     }
     for (i = 0; i < 32; i++) {
-        __get_user(float64_val(env->vfp.regs[i]), &vfpframe->ufp.fpregs[i]);
+        __get_user(*aa32_vfp_dreg(env, i), &vfpframe->ufp.fpregs[i]);
     }
     __get_user(fpscr, &vfpframe->ufp.fpscr);
     vfp_set_fpscr(env, fpscr);
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     aarch64_note_init(&note, s, "CORE", 5, NT_PRFPREG, sizeof(note.vfp));
 
-    for (i = 0; i < 64; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+    for (i = 0; i < 32; ++i) {
+        uint64_t *q = aa64_vfp_qreg(env, i);
+        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int arm_write_elf32_vfp(WriteCoreDumpFunction f, CPUARMState *env,
     arm_note_init(&note, s, "LINUX", 6, NT_ARM_VFP, sizeof(note.vfp));
 
     for (i = 0; i < 32; ++i) {
-        note.vfp.vregs[i] = cpu_to_dump64(s, env->vfp.regs[i]);
+        note.vfp.vregs[i] = cpu_to_dump64(s, *aa32_vfp_dreg(env, i));
     }
 
     note.vfp.fpscr = cpu_to_dump32(s, vfp_get_fpscr(env));
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(simd_tbl)(CPUARMState *env, uint64_t result, uint64_t indices,
         if (index < 16 * numregs) {
             /* Convert index (a byte offset into the virtual table
              * which is a series of 128-bit vectors concatenated)
-             * into the correct vfp.regs[] element plus a bit offset
+             * into the correct register element plus a bit offset
              * into that element, bearing in mind that the table
              * can wrap around from V31 to V0.
              */
             int elt = (rn * 2 + (index >> 3)) % 64;
             int bitidx = (index & 7) * 8;
-            uint64_t val = extract64(env->vfp.regs[elt], bitidx, 8);
+            uint64_t *q = aa64_vfp_qreg(env, elt >> 1);
+            uint64_t val = extract64(q[elt & 1], bitidx, 8);
 
             result = deposit64(result, shift, 8, val);
         }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     /* VFP data registers are always little-endian.  */
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        stq_le_p(buf, env->vfp.regs[reg]);
+        stq_le_p(buf, *aa32_vfp_dreg(env, reg));
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         /* Aliases for Q regs.  */
         nregs += 16;
         if (reg < nregs) {
-            stq_le_p(buf, env->vfp.regs[(reg - 32) * 2]);
-            stq_le_p(buf + 8, env->vfp.regs[(reg - 32) * 2 + 1]);
+            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
+            stq_le_p(buf, q[0]);
+            stq_le_p(buf + 8, q[1]);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int vfp_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     nregs = arm_feature(env, ARM_FEATURE_VFP3) ? 32 : 16;
     if (reg < nregs) {
-        env->vfp.regs[reg] = ldq_le_p(buf);
+        *aa32_vfp_dreg(env, reg) = ldq_le_p(buf);
         return 8;
     }
     if (arm_feature(env, ARM_FEATURE_NEON)) {
         nregs += 16;
         if (reg < nregs) {
-            env->vfp.regs[(reg - 32) * 2] = ldq_le_p(buf);
-            env->vfp.regs[(reg - 32) * 2 + 1] = ldq_le_p(buf + 8);
+            uint64_t *q = aa32_vfp_qreg(env, reg - 32);
+            q[0] = ldq_le_p(buf);
+            q[1] = ldq_le_p(buf + 8);
             return 16;
         }
     }
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_get_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        stq_le_p(buf, env->vfp.regs[reg * 2]);
-        stq_le_p(buf + 8, env->vfp.regs[reg * 2 + 1]);
-        return 16;
+        {
+            uint64_t *q = aa64_vfp_qreg(env, reg);
+            stq_le_p(buf, q[0]);
+            stq_le_p(buf + 8, q[1]);
+            return 16;
+        }
     case 32:
         /* FPSR */
         stl_p(buf, vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     switch (reg) {
     case 0 ... 31:
         /* 128 bit FP register */
-        env->vfp.regs[reg * 2] = ldq_le_p(buf);
-        env->vfp.regs[reg * 2 + 1] = ldq_le_p(buf + 8);
-        return 16;
+        {
+            uint64_t *q = aa64_vfp_qreg(env, reg);
+            q[0] = ldq_le_p(buf);
+            q[1] = ldq_le_p(buf + 8);
+            return 16;
+        }
     case 32:
         /* FPSR */
         vfp_set_fpsr(env, ldl_p(buf));
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
-        r.addr = (uintptr_t)(&env->vfp.regs[i]);
+        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &r);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
     for (i = 0; i < 32; i++) {
-        r.addr = (uintptr_t)(&env->vfp.regs[i]);
+        r.addr = (uintptr_t)aa32_vfp_dreg(env, i);
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &r);
         if (ret) {
             return ret;
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         }
     }
 
-    /* Advanced SIMD and FP registers
-     * We map Qn = regs[2n+1]:regs[2n]
-     */
+    /* Advanced SIMD and FP registers. */
     for (i = 0; i < 32; i++) {
-        int rd = i << 1;
-        uint64_t fp_val[2];
+        uint64_t *q = aa64_vfp_qreg(env, i);
 #ifdef HOST_WORDS_BIGENDIAN
-        fp_val[0] = env->vfp.regs[rd + 1];
-        fp_val[1] = env->vfp.regs[rd];
+        uint64_t fp_val[2] = { q[1], q[0] };
+        reg.addr = (uintptr_t)fp_val;
 #else
-        fp_val[1] = env->vfp.regs[rd + 1];
-        fp_val[0] = env->vfp.regs[rd];
+        reg.addr = (uintptr_t)q;
 #endif
         reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)(&fp_val);
         ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
         if (ret) {
             return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         env->spsr = env->banked_spsr[i];
     }
 
-    /* Advanced SIMD and FP registers
-     * We map Qn = regs[2n+1]:regs[2n]
-     */
+    /* Advanced SIMD and FP registers */
     for (i = 0; i < 32; i++) {
-        uint64_t fp_val[2];
+        uint64_t *q = aa64_vfp_qreg(env, i);
         reg.id = AARCH64_SIMD_CORE_REG(fp_regs.vregs[i]);
-        reg.addr = (uintptr_t)(&fp_val);
+        reg.addr = (uintptr_t)q;
         ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
         if (ret) {
             return ret;
         } else {
-            int rd = i << 1;
 #ifdef HOST_WORDS_BIGENDIAN
-            env->vfp.regs[rd + 1] = fp_val[0];
-            env->vfp.regs[rd] = fp_val[1];
-#else
-            env->vfp.regs[rd + 1] = fp_val[1];
-            env->vfp.regs[rd] = fp_val[0];
+            uint64_t t;
+            t = q[0], q[0] = q[1], q[1] = t;
 #endif
         }
     }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_cpu_dump_state(CPUState *cs, FILE *f,
 
     if (flags & CPU_DUMP_FPU) {
         int numvfpregs = 32;
-        for (i = 0; i < numvfpregs; i += 2) {
-            uint64_t vlo = env->vfp.regs[i * 2];
-            uint64_t vhi = env->vfp.regs[(i * 2) + 1];
-            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 " ",
-                        i, vhi, vlo);
-            vlo = env->vfp.regs[(i + 1) * 2];
-            vhi = env->vfp.regs[((i + 1) * 2) + 1];
-            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "\n",
-                        i + 1, vhi, vlo);
+        for (i = 0; i < numvfpregs; i++) {
+            uint64_t *q = aa64_vfp_qreg(env, i);
+            uint64_t vlo = q[0];
+            uint64_t vhi = q[1];
+            cpu_fprintf(f, "q%02d=%016" PRIx64 ":%016" PRIx64 "%c",
+                        i, vhi, vlo, (i & 1 ? '\n' : ' '));
         }
         cpu_fprintf(f, "FPCR: %08x  FPSR: %08x\n",
                     vfp_get_fpcr(env), vfp_get_fpsr(env));
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vec_full_reg_ptr(DisasContext *s, int regno)
  */
 static inline int fp_reg_offset(DisasContext *s, int regno, TCGMemOp size)
 {
-    int offs = offsetof(CPUARMState, vfp.regs[regno * 2]);
-#ifdef HOST_WORDS_BIGENDIAN
-    offs += (8 - (1 << size));
-#endif
-    assert_fp_access_checked(s);
-    return offs;
+    return vec_reg_offset(s, regno, 0, size);
 }
 
 /* Offset of the high half of the 128 bit vector Qn */
 static inline int fp_reg_hi_offset(DisasContext *s, int regno)
 {
-    assert_fp_access_checked(s);
-    return offsetof(CPUARMState, vfp.regs[regno * 2 + 1]);
+    return vec_reg_offset(s, regno, 1, MO_64);
 }
 
 /* Convenience accessors for reading and writing single and double
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_vfp_st(DisasContext *s, int dp, TCGv_i32 addr)
 static inline long
 vfp_reg_offset (int dp, int reg)
 {
-    if (dp)
+    if (dp) {
         return offsetof(CPUARMState, vfp.regs[reg]);
-    else if (reg & 1) {
-        return offsetof(CPUARMState, vfp.regs[reg >> 1])
-          + offsetof(CPU_DoubleU, l.upper);
     } else {
-        return offsetof(CPUARMState, vfp.regs[reg >> 1])
-          + offsetof(CPU_DoubleU, l.lower);
+        long ofs = offsetof(CPUARMState, vfp.regs[reg >> 1]);
+        if (reg & 1) {
+            ofs += offsetof(CPU_DoubleU, l.upper);
+        } else {
+            ofs += offsetof(CPU_DoubleU, l.lower);
+        }
+        return ofs;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_dump_state(CPUState *cs, FILE *f, fprintf_function cpu_fprintf,
             numvfpregs += 16;
         }
         for (i = 0; i < numvfpregs; i++) {
-            uint64_t v = env->vfp.regs[i];
+            uint64_t v = *aa32_vfp_dreg(env, i);
             cpu_fprintf(f, "s%02d=%08x s%02d=%08x d%02d=%016" PRIx64 "\n",
                         i * 2, (uint32_t)v,
                         i * 2 + 1, (uint32_t)(v >> 32),
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

At the same time, move VMSTATE_UINT32_SUB_ARRAY
beside the other UINT32 definitions.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-8-richard.henderson@linaro.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/migration/vmstate.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_UINT32_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, 0)
 
+#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
+
 #define VMSTATE_UINT32_2DARRAY(_f, _s, _n1, _n2)                      \
     VMSTATE_UINT32_2DARRAY_V(_f, _s, _n1, _n2, 0)
 
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_UINT64_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, 0)
 
+#define VMSTATE_UINT64_SUB_ARRAY(_f, _s, _start, _num)                \
+    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint64, uint64_t)
+
 #define VMSTATE_UINT64_2DARRAY(_f, _s, _n1, _n2)                      \
     VMSTATE_UINT64_2DARRAY_V(_f, _s, _n1, _n2, 0)
 
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qtailq;
 #define VMSTATE_INT32_ARRAY(_f, _s, _n)                               \
     VMSTATE_INT32_ARRAY_V(_f, _s, _n, 0)
 
-#define VMSTATE_UINT32_SUB_ARRAY(_f, _s, _start, _num)                \
-    VMSTATE_SUB_ARRAY(_f, _s, _start, _num, 0, vmstate_info_uint32, uint32_t)
-
 #define VMSTATE_INT64_ARRAY_V(_f, _s, _n, _v)                         \
     VMSTATE_ARRAY(_f, _s, _n, _v, vmstate_info_int64, int64_t)
 
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-14-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 127 +---------------------------------------------------
 target/arm/helper.c | 126 +++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 128 insertions(+), 125 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
 #endif
 }
 
-/* Return the exception level to which FP-disabled exceptions should
- * be taken, or 0 if FP is enabled.
- */
-static inline int fp_exception_el(CPUARMState *env)
-{
-    int fpen;
-    int cur_el = arm_current_el(env);
-
-    /* CPACR and the CPTR registers don't exist before v6, so FP is
-     * always accessible
-     */
-    if (!arm_feature(env, ARM_FEATURE_V6)) {
-        return 0;
-    }
-
-    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
-     * 0, 2 : trap EL0 and EL1/PL1 accesses
-     * 1    : trap only EL0 accesses
-     * 3    : trap no accesses
-     */
-    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
-    switch (fpen) {
-    case 0:
-    case 2:
-        if (cur_el == 0 || cur_el == 1) {
-            /* Trap to PL1, which might be EL1 or EL3 */
-            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-                return 3;
-            }
-            return 1;
-        }
-        if (cur_el == 3 && !is_a64(env)) {
-            /* Secure PL1 running at EL3 */
-            return 3;
-        }
-        break;
-    case 1:
-        if (cur_el == 0) {
-            return 1;
-        }
-        break;
-    case 3:
-        break;
-    }
-
-    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
-     * check because zero bits in the registers mean "don't trap".
-     */
-
-    /* CPTR_EL2 : present in v7VE or v8 */
-    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
-        && !arm_is_secure_below_el3(env)) {
-        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
-        return 2;
-    }
-
-    /* CPTR_EL3 : present in v8 */
-    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
-        /* Trap all FP ops to EL3 */
-        return 3;
-    }
-
-    return 0;
-}
-
 #ifdef CONFIG_USER_ONLY
 static inline bool arm_cpu_bswap_data(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_regime_tbi1(CPUARMState *env, ARMMMUIdx mmu_idx)
 }
 #endif
 
-static inline void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                                        target_ulong *cs_base, uint32_t *flags)
-{
-    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
-    if (is_a64(env)) {
-        *pc = env->pc;
-        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
-        /* Get control bits for tagged addresses */
-        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
-        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
-    } else {
-        *pc = env->regs[15];
-        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
-            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
-            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
-            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
-            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
-        if (!(access_secure_reg(env))) {
-            *flags |= ARM_TBFLAG_NS_MASK;
-        }
-        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
-            || arm_el_is_aa64(env, 1)) {
-            *flags |= ARM_TBFLAG_VFPEN_MASK;
-        }
-        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
-                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
-    }
-
-    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
-
-    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
-     * states defined in the ARM ARM for software singlestep:
-     *  SS_ACTIVE   PSTATE.SS   State
-     *     0            x       Inactive (the TB flag for SS is always 0)
-     *     1            0       Active-pending
-     *     1            1       Active-not-pending
-     */
-    if (arm_singlestep_active(env)) {
-        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
-        if (is_a64(env)) {
-            if (env->pstate & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
-            }
-        } else {
-            if (env->uncached_cpsr & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
-            }
-        }
-    }
-    if (arm_cpu_data_is_big_endian(env)) {
-        *flags |= ARM_TBFLAG_BE_DATA_MASK;
-    }
-    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
-
-    if (arm_v7m_is_handler_mode(env)) {
-        *flags |= ARM_TBFLAG_HANDLER_MASK;
-    }
-
-    *cs_base = 0;
-}
+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                          target_ulong *cs_base, uint32_t *flags);
 
 enum {
     QEMU_PSCI_CONDUIT_DISABLED = 0,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(crc32c)(uint32_t acc, uint32_t val, uint32_t bytes)
     /* Linux crc32c converts the output to one's complement.  */
     return crc32c(acc, buf, bytes) ^ 0xffffffff;
 }
+
+/* Return the exception level to which FP-disabled exceptions should
+ * be taken, or 0 if FP is enabled.
+ */
+static inline int fp_exception_el(CPUARMState *env)
+{
+    int fpen;
+    int cur_el = arm_current_el(env);
+
+    /* CPACR and the CPTR registers don't exist before v6, so FP is
+     * always accessible
+     */
+    if (!arm_feature(env, ARM_FEATURE_V6)) {
+        return 0;
+    }
+
+    /* The CPACR controls traps to EL1, or PL1 if we're 32 bit:
+     * 0, 2 : trap EL0 and EL1/PL1 accesses
+     * 1    : trap only EL0 accesses
+     * 3    : trap no accesses
+     */
+    fpen = extract32(env->cp15.cpacr_el1, 20, 2);
+    switch (fpen) {
+    case 0:
+    case 2:
+        if (cur_el == 0 || cur_el == 1) {
+            /* Trap to PL1, which might be EL1 or EL3 */
+            if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
+                return 3;
+            }
+            return 1;
+        }
+        if (cur_el == 3 && !is_a64(env)) {
+            /* Secure PL1 running at EL3 */
+            return 3;
+        }
+        break;
+    case 1:
+        if (cur_el == 0) {
+            return 1;
+        }
+        break;
+    case 3:
+        break;
+    }
+
+    /* For the CPTR registers we don't need to guard with an ARM_FEATURE
+     * check because zero bits in the registers mean "don't trap".
+     */
+
+    /* CPTR_EL2 : present in v7VE or v8 */
+    if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
+        && !arm_is_secure_below_el3(env)) {
+        /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
+        return 2;
+    }
+
+    /* CPTR_EL3 : present in v8 */
+    if (extract32(env->cp15.cptr_el[3], 10, 1)) {
+        /* Trap all FP ops to EL3 */
+        return 3;
+    }
+
+    return 0;
+}
+
+void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
+                          target_ulong *cs_base, uint32_t *flags)
+{
+    ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+    if (is_a64(env)) {
+        *pc = env->pc;
+        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+        /* Get control bits for tagged addresses */
+        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+    } else {
+        *pc = env->regs[15];
+        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+            | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
+            | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
+            | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
+            | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
+        if (!(access_secure_reg(env))) {
+            *flags |= ARM_TBFLAG_NS_MASK;
+        }
+        if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
+            || arm_el_is_aa64(env, 1)) {
+            *flags |= ARM_TBFLAG_VFPEN_MASK;
+        }
+        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
+                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
+    }
+
+    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+
+    /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
+     * states defined in the ARM ARM for software singlestep:
+     *  SS_ACTIVE   PSTATE.SS   State
+     *     0            x       Inactive (the TB flag for SS is always 0)
+     *     1            0       Active-pending
+     *     1            1       Active-not-pending
+     */
+    if (arm_singlestep_active(env)) {
+        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
+        if (is_a64(env)) {
+            if (env->pstate & PSTATE_SS) {
+                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+            }
+        } else {
+            if (env->uncached_cpsr & PSTATE_SS) {
+                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+            }
+        }
+    }
+    if (arm_cpu_data_is_big_endian(env)) {
+        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+    }
+    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+
+    if (arm_v7m_is_handler_mode(env)) {
+        *flags |= ARM_TBFLAG_HANDLER_MASK;
+    }
+
+    *cs_base = 0;
+}
-- 
2.7.4

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180119045438.28582-15-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline int fp_exception_el(CPUARMState *env)
 }
 
 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
-                          target_ulong *cs_base, uint32_t *flags)
+                          target_ulong *cs_base, uint32_t *pflags)
 {
     ARMMMUIdx mmu_idx = core_to_arm_mmu_idx(env, cpu_mmu_index(env, false));
+    uint32_t flags;
+
     if (is_a64(env)) {
         *pc = env->pc;
-        *flags = ARM_TBFLAG_AARCH64_STATE_MASK;
+        flags = ARM_TBFLAG_AARCH64_STATE_MASK;
         /* Get control bits for tagged addresses */
-        *flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
-        *flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
+        flags |= (arm_regime_tbi0(env, mmu_idx) << ARM_TBFLAG_TBI0_SHIFT);
+        flags |= (arm_regime_tbi1(env, mmu_idx) << ARM_TBFLAG_TBI1_SHIFT);
     } else {
         *pc = env->regs[15];
-        *flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
+        flags = (env->thumb << ARM_TBFLAG_THUMB_SHIFT)
             | (env->vfp.vec_len << ARM_TBFLAG_VECLEN_SHIFT)
             | (env->vfp.vec_stride << ARM_TBFLAG_VECSTRIDE_SHIFT)
             | (env->condexec_bits << ARM_TBFLAG_CONDEXEC_SHIFT)
             | (arm_sctlr_b(env) << ARM_TBFLAG_SCTLR_B_SHIFT);
         if (!(access_secure_reg(env))) {
-            *flags |= ARM_TBFLAG_NS_MASK;
+            flags |= ARM_TBFLAG_NS_MASK;
         }
         if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)
             || arm_el_is_aa64(env, 1)) {
-            *flags |= ARM_TBFLAG_VFPEN_MASK;
+            flags |= ARM_TBFLAG_VFPEN_MASK;
         }
-        *flags |= (extract32(env->cp15.c15_cpar, 0, 2)
-                   << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
+        flags |= (extract32(env->cp15.c15_cpar, 0, 2)
+                  << ARM_TBFLAG_XSCALE_CPAR_SHIFT);
     }
 
-    *flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
+    flags |= (arm_to_core_mmu_idx(mmu_idx) << ARM_TBFLAG_MMUIDX_SHIFT);
 
     /* The SS_ACTIVE and PSTATE_SS bits correspond to the state machine
      * states defined in the ARM ARM for software singlestep:
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
      *     1            1       Active-not-pending
      */
     if (arm_singlestep_active(env)) {
-        *flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
+        flags |= ARM_TBFLAG_SS_ACTIVE_MASK;
         if (is_a64(env)) {
             if (env->pstate & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
             }
         } else {
             if (env->uncached_cpsr & PSTATE_SS) {
-                *flags |= ARM_TBFLAG_PSTATE_SS_MASK;
+                flags |= ARM_TBFLAG_PSTATE_SS_MASK;
             }
         }
     }
     if (arm_cpu_data_is_big_endian(env)) {
-        *flags |= ARM_TBFLAG_BE_DATA_MASK;
+        flags |= ARM_TBFLAG_BE_DATA_MASK;
     }
-    *flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
+    flags |= fp_exception_el(env) << ARM_TBFLAG_FPEXC_EL_SHIFT;
 
     if (arm_v7m_is_handler_mode(env)) {
-        *flags |= ARM_TBFLAG_HANDLER_MASK;
+        flags |= ARM_TBFLAG_HANDLER_MASK;
     }
 
+    *pflags = flags;
     *cs_base = 0;
 }
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

In the GIC, when an IRQ is acknowledged, its state goes from "pending"
to:
   - "active" if the corresponding IRQ pin has been de-asserted
   - "active and pending" otherwise.
The GICv2 manual states that when a IRQ becomes active (or active and
pending), the GIC should either signal another (higher priority) IRQ to
the CPU if there is one, or de-assert the CPU IRQ pin.

The current implementation of the GIC in QEMU does not check if the
IRQ is already active when looking for pending interrupts with
sufficient priority in gic_update(). This can lead to signaling an
interrupt that is already active.

This usually happens when splitting priority drop and interrupt
deactivation. On priority drop, the IRQ stays active until deactivation.
If it becomes pending again, chances are that it will be incorrectly
selected as best_irq in gic_update().

This commit fixes this by checking if the IRQ is not already active when
looking for best_irq in gic_update().

Note that regarding the ARM11MPCore GIC version, the corresponding
manual is not clear on that point, but it has has no priority
drop/interrupt deactivation separation, so this case should not happen.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-3-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ void gic_update(GICState *s)
         best_irq = 1023;
         for (irq = 0; irq < s->num_irq; irq++) {
             if (GIC_TEST_ENABLED(irq, cm) && gic_test_pending(s, irq, cm) &&
+                (!GIC_TEST_ACTIVE(irq, cm)) &&
                 (irq < GIC_INTERNAL || GIC_TARGET(irq) & cm)) {
                 if (GIC_GET_PRIORITY(irq, cpu) < best_prio) {
                     best_prio = GIC_GET_PRIORITY(irq, cpu);
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When there is no active interrupts in the GIC, a read to the C_RPR
register should return the value of the "Idle priority", which is either
the maximum value an IRQ priority field can be set to, or 0xff.

Since the QEMU GIC model implements all the 8 priority bits, the Idle
priority is 0xff.

Internally, when there is no active interrupt, the running priority
value is 0x100. The gic_get_running_priority function returns an uint8_t
and thus, truncate this value to 0x00 when returning it. This is wrong since
a value of 0x00 correspond to the maximum possible priority.

This commit fixes the returned value when the internal value is 0x100.

Note that it is correct for the Non-Secure view to return 0xff even
though from the NS world point of view, only 7 priority bits are
implemented. The specification states that the Idle priority can be 0xff
even when not all the 8 priority bits are implemented. This has been
verified against a real GICv2 hardware on a Xilinx ZynqMP based board.

Regarding the ARM11MPCore version of the GIC, the specification is not
clear on that point, so this commit does not alter its behavior.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-4-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static void gic_set_cpu_control(GICState *s, int cpu, uint32_t value,
 
 static uint8_t gic_get_running_priority(GICState *s, int cpu, MemTxAttrs attrs)
 {
+    if ((s->revision != REV_11MPCORE) && (s->running_priority[cpu] > 0xff)) {
+        /* Idle priority */
+        return 0xff;
+    }
+
     if (s->security_extn && !attrs.secure) {
         if (s->running_priority[cpu] & 0x80) {
             /* Running priority in upper half of range: return the Non-secure
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When determining the group priority of a group 1 IRQ, if C_CTRL.CBPR is
0, the non-secure BPR value is used. However, this value must be
incremented by one so that it matches the secure world number of
implemented priority bits (NS world has one less priority bit compared
to the Secure world).

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-5-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: add assert, as the gicv3 code has]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static int gic_get_group_priority(GICState *s, int cpu, int irq)
     if (gic_has_groups(s) &&
         !(s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) &&
         GIC_TEST_GROUP(irq, (1 << cpu))) {
-        bpr = s->abpr[cpu];
+        bpr = s->abpr[cpu] - 1;
+        assert(bpr >= 0);
     } else {
         bpr = s->bpr[cpu];
     }
-- 
2.7.4

From: Luc MICHEL <luc.michel@git.antfield.fr>

When C_CTRL.CBPR is 1, the Non-Secure view of C_BPR is altered:
  - A Non-Secure read of C_BPR should return the BPR value plus 1,
  saturated to 7,
  - A Non-Secure write should be ignored.

Signed-off-by: Luc MICHEL <luc.michel@git.antfield.fr>
Message-id: 20180119145756.7629-6-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: fixed comment typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gic.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_read(GICState *s, int cpu, int offset,
         break;
     case 0x08: /* Binary Point */
         if (s->security_extn && !attrs.secure) {
-            /* BPR is banked. Non-secure copy stored in ABPR. */
-            *data = s->abpr[cpu];
+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
+                /* NS view of BPR when CBPR is 1 */
+                *data = MIN(s->bpr[cpu] + 1, 7);
+            } else {
+                /* BPR is banked. Non-secure copy stored in ABPR. */
+                *data = s->abpr[cpu];
+            }
         } else {
             *data = s->bpr[cpu];
         }
@@ -XXX,XX +XXX,XX @@ static MemTxResult gic_cpu_write(GICState *s, int cpu, int offset,
         break;
     case 0x08: /* Binary Point */
         if (s->security_extn && !attrs.secure) {
-            s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+            if (s->cpu_ctlr[cpu] & GICC_CTLR_CBPR) {
+                /* WI when CBPR is 1 */
+                return MEMTX_OK;
+            } else {
+                s->abpr[cpu] = MAX(value & 0x7, GIC_MIN_ABPR);
+            }
         } else {
             s->bpr[cpu] = MAX(value & 0x7, GIC_MIN_BPR);
         }
-- 
2.7.4

We were passing a NULL error pointer to the object_property_set_bool()
call that realizes the CPU object. This meant that we wouldn't detect
failure, and would plough blindly on to crash later trying to use a
NULL CPU object pointer. Detect errors and fail instead.

In particular, this will be necessary to detect the user error
of using "-cpu host" without "-enable-kvm" once we make the host
CPU type be registered unconditionally rather than only in
kvm_arch_init().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                      "secure-memory", &error_abort);
         }
 
-        object_property_set_bool(cpuobj, true, "realized", NULL);
+        object_property_set_bool(cpuobj, true, "realized", &error_fatal);
         object_unref(cpuobj);
     }
     fdt_add_timer_nodes(vms);
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

missed in 60765b6ceeb4.

Thread 1 "qemu-system-aarch64" received signal SIGSEGV, Segmentation fault.
  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  3050	    as->root = root;
  (gdb) bt
  #0  address_space_init (as=0x0, root=0x55555726e410, name=name@entry=0x555555e3f0a7 "sdhci-dma") at memory.c:3050
  #1  0x0000555555af62c3 in sdhci_sysbus_realize (dev=<optimized out>, errp=0x7fff7f931150) at hw/sd/sdhci.c:1564
  #2  0x00005555558b25e5 in zynqmp_sdhci_realize (dev=0x555557051520, errp=0x7fff7f931150) at hw/sd/zynqmp-sdhci.c:151
  #3  0x0000555555a2e7f3 in device_set_realized (obj=0x555557051520, value=<optimized out>, errp=0x7fff7f931270) at hw/core/qdev.c:966
  #4  0x0000555555ba3f74 in property_set_bool (obj=0x555557051520, v=<optimized out>, name=<optimized out>, opaque=0x555556e04a20,
      errp=0x7fff7f931270) at qom/object.c:1906
  #5  0x0000555555ba51f4 in object_property_set (obj=obj@entry=0x555557051520, v=v@entry=0x5555576dbd60,
      name=name@entry=0x555555dd6306 "realized", errp=errp@entry=0x7fff7f931270) at qom/object.c:1102

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180123132051.24448-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/sd/sdhci.h | 1 +
 hw/sd/sdhci.c         | 1 +
 2 files changed, 2 insertions(+)

diff --git a/include/hw/sd/sdhci.h b/include/hw/sd/sdhci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/sd/sdhci.h
+++ b/include/hw/sd/sdhci.h
@@ -XXX,XX +XXX,XX @@ typedef struct SDHCIState {
     /*< public >*/
     SDBus sdbus;
     MemoryRegion iomem;
+    AddressSpace sysbus_dma_as;
     AddressSpace *dma_as;
     MemoryRegion *dma_mr;
 
diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -XXX,XX +XXX,XX @@ static void sdhci_sysbus_realize(DeviceState *dev, Error ** errp)
     }
 
     if (s->dma_mr) {
+        s->dma_as = &s->sysbus_dma_as;
         address_space_init(s->dma_as, s->dma_mr, "sdhci-dma");
     } else {
         /* use system_memory() if property "dma" not set */
-- 
2.7.4

From: Francisco Iglesias <frasse.iglesias@gmail.com>

Coverity found that the variable tx_rx in the function
xilinx_spips_flush_txfifo was being used uninitialized (CID 1383841). This
patch corrects this by always initializing tx_rx to zeros.

Signed-off-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20180124215708.30400-1-frasse.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/xilinx_spips.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/xilinx_spips.c b/hw/ssi/xilinx_spips.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spips.c
+++ b/hw/ssi/xilinx_spips.c
@@ -XXX,XX +XXX,XX @@
 #define SNOOP_NONE 0xEE
 #define SNOOP_STRIPING 0
 
+#define MIN_NUM_BUSSES 1
+#define MAX_NUM_BUSSES 2
+
 static inline int num_effective_busses(XilinxSPIPS *s)
 {
     return (s->regs[R_LQSPI_CFG] & LQSPI_CFG_SEP_BUS &&
@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_flush_txfifo(XilinxSPIPS *s)
     for (;;) {
         int i;
         uint8_t tx = 0;
-        uint8_t tx_rx[num_effective_busses(s)];
+        uint8_t tx_rx[MAX_NUM_BUSSES] = { 0 };
         uint8_t dummy_cycles = 0;
         uint8_t addr_length;
 
@@ -XXX,XX +XXX,XX @@ static void xilinx_spips_realize(DeviceState *dev, Error **errp)
 
     DB_PRINT_L(0, "realized spips\n");
 
+    if (s->num_busses > MAX_NUM_BUSSES) {
+        error_setg(errp,
+                   "requested number of SPI busses %u exceeds maximum %d",
+                   s->num_busses, MAX_NUM_BUSSES);
+        return;
+    }
+    if (s->num_busses < MIN_NUM_BUSSES) {
+        error_setg(errp,
+                   "requested number of SPI busses %u is below minimum %d",
+                   s->num_busses, MIN_NUM_BUSSES);
+        return;
+    }
+
     s->spi = g_new(SSIBus *, s->num_busses);
     for (i = 0; i < s->num_busses; ++i) {
         char bus_name[16];
-- 
2.7.4

From: Linus Walleij <linus.walleij@linaro.org>

This implements rudimentary support for interrupt generation on the
PL110. I am working on a new DRI/KMS driver for Linux and since that
uses the blanking interrupt, we need something to fire here. Without
any interrupt support Linux waits for a while and then gives ugly
messages about the vblank not working in the console (it does not
hang perpetually or anything though, DRI is pretty forgiving).

I solved it for now by setting up a timer to fire at 60Hz and pull
the interrupts for "vertical compare" and "next memory base"
at this interval. This works fine and fires roughly the same number
of IRQs on QEMU as on the hardware and leaves the console clean
and nice.

People who want to create more accurate emulation can probably work
on top of this if need be. It is certainly closer to the hardware
behaviour than what we have today anyway.

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Message-id: 20180123225654.5764-1-linus.walleij@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: folded long lines]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/pl110.c | 30 +++++++++++++++++++++++++++++-
 1 file changed, 29 insertions(+), 1 deletion(-)

diff --git a/hw/display/pl110.c b/hw/display/pl110.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/pl110.c
+++ b/hw/display/pl110.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "framebuffer.h"
 #include "ui/pixel_ops.h"
+#include "qemu/timer.h"
 #include "qemu/log.h"
 
 #define PL110_CR_EN   0x001
@@ -XXX,XX +XXX,XX @@
 #define PL110_CR_BEBO 0x200
 #define PL110_CR_BEPO 0x400
 #define PL110_CR_PWR  0x800
+#define PL110_IE_NB   0x004
+#define PL110_IE_VC   0x008
 
 enum pl110_bppmode
 {
@@ -XXX,XX +XXX,XX @@ typedef struct PL110State {
     MemoryRegion iomem;
     MemoryRegionSection fbsection;
     QemuConsole *con;
+    QEMUTimer *vblank_timer;
 
     int version;
     uint32_t timing[4];
@@ -XXX,XX +XXX,XX @@ static void pl110_resize(PL110State *s, int width, int height)
 /* Update interrupts.  */
 static void pl110_update(PL110State *s)
 {
-  /* TODO: Implement interrupts.  */
+    /* Raise IRQ if enabled and any status bit is 1 */
+    if (s->int_status & s->int_mask) {
+        qemu_irq_raise(s->irq);
+    } else {
+        qemu_irq_lower(s->irq);
+    }
+}
+
+static void pl110_vblank_interrupt(void *opaque)
+{
+    PL110State *s = opaque;
+
+    /* Fire the vertical compare and next base IRQs and re-arm */
+    s->int_status |= (PL110_IE_NB | PL110_IE_VC);
+    timer_mod(s->vblank_timer,
+              qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                                NANOSECONDS_PER_SECOND / 60);
+    pl110_update(s);
 }
 
 static uint64_t pl110_read(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static void pl110_write(void *opaque, hwaddr offset,
         s->bpp = (val >> 1) & 7;
         if (pl110_enabled(s)) {
             qemu_console_resize(s->con, s->cols, s->rows);
+            timer_mod(s->vblank_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                                        NANOSECONDS_PER_SECOND / 60);
+        } else {
+            timer_del(s->vblank_timer);
         }
         break;
     case 10: /* LCDICR */
@@ -XXX,XX +XXX,XX @@ static void pl110_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->iomem, OBJECT(s), &pl110_ops, s, "pl110", 0x1000);
     sysbus_init_mmio(sbd, &s->iomem);
     sysbus_init_irq(sbd, &s->irq);
+    s->vblank_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                   pl110_vblank_interrupt, s);
     qdev_init_gpio_in(dev, pl110_mux_ctrl_set, 1);
     s->con = graphic_console_init(dev, 0, &pl110_gfx_ops, s);
 }
-- 
2.7.4

The following changes since commit adf2e451f357e993f173ba9b4176dbf3e65fee7e:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2019-02-26 19:04:47 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190228-1

for you to fetch changes up to 1c9af3a9e05c1607a36df4943f8f5393d7621a91:

linux-user: Enable HWCAP_ASIMDFHM, HWCAP_JSCVT (2019-02-28 11:03:05 +0000)

----------------------------------------------------------------
target-arm queue:
 * add MHU and dual-core support to Musca boards
 * refactor some VFP insns to be gated by ID registers
 * Revert "arm: Allow system registers for KVM guests to be changed by QEMU code"
 * Implement ARMv8.2-FHM extension
 * Advertise JSCVT via HWCAP for linux-user

----------------------------------------------------------------
Peter Maydell (11):
      hw/misc/armsse-mhu.c: Model the SSE-200 Message Handling Unit
      hw/arm/armsse: Wire up the MHUs
      target/arm/cpu: Allow init-svtor property to be set after realize
      target/arm/arm-powerctl: Add new arm_set_cpu_on_and_reset()
      hw/misc/iotkit-sysctl: Correct typo in INITSVTOR0 register name
      hw/arm/iotkit-sysctl: Add SSE-200 registers
      hw/arm/iotkit-sysctl: Implement CPUWAIT and INITSVTOR*
      hw/arm/armsse: Unify init-svtor and cpuwait handling
      target/arm: Use MVFR1 feature bits to gate A32/T32 FP16 instructions
      target/arm: Gate "miscellaneous FP" insns by ID register field
      Revert "arm: Allow system registers for KVM guests to be changed by QEMU code"

Richard Henderson (5):
      target/arm: Add helpers for FMLAL
      target/arm: Implement FMLAL and FMLSL for aarch64
      target/arm: Implement VFMAL and VFMSL for aarch32
      target/arm: Enable ARMv8.2-FHM for -cpu max
      linux-user: Enable HWCAP_ASIMDFHM, HWCAP_JSCVT

Implement a model of the Message Handling Unit (MHU) found in
the Arm SSE-200. This is a simple device which just contains
some registers which allow the two cores of the SSE-200
to raise interrupts on each other.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-2-peter.maydell@linaro.org
---
 hw/misc/Makefile.objs           |   1 +
 include/hw/misc/armsse-mhu.h    |  44 +++++++
 hw/misc/armsse-mhu.c            | 198 ++++++++++++++++++++++++++++++++
 MAINTAINERS                     |   2 +
 default-configs/arm-softmmu.mak |   1 +
 hw/misc/trace-events            |   4 +
 6 files changed, 250 insertions(+)
 create mode 100644 include/hw/misc/armsse-mhu.h
 create mode 100644 hw/misc/armsse-mhu.c

diff --git a/hw/misc/Makefile.objs b/hw/misc/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Makefile.objs
+++ b/hw/misc/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_IOTKIT_SECCTL) += iotkit-secctl.o
 obj-$(CONFIG_IOTKIT_SYSCTL) += iotkit-sysctl.o
 obj-$(CONFIG_IOTKIT_SYSINFO) += iotkit-sysinfo.o
 obj-$(CONFIG_ARMSSE_CPUID) += armsse-cpuid.o
+obj-$(CONFIG_ARMSSE_MHU) += armsse-mhu.o
 
 obj-$(CONFIG_PVPANIC) += pvpanic.o
 obj-$(CONFIG_AUX) += auxbus.o
diff --git a/include/hw/misc/armsse-mhu.h b/include/hw/misc/armsse-mhu.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/armsse-mhu.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SSE-200 Message Handling Unit (MHU)
+ *
+ * Copyright (c) 2019 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/*
+ * This is a model of the Message Handling Unit (MHU) which is part of the
+ * Arm SSE-200 and documented in
+ * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
+ *
+ * QEMU interface:
+ *  + sysbus MMIO region 0: the system information register bank
+ *  + sysbus IRQ 0: interrupt for CPU 0
+ *  + sysbus IRQ 1: interrupt for CPU 1
+ */
+
+#ifndef HW_MISC_SSE_MHU_H
+#define HW_MISC_SSE_MHU_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_ARMSSE_MHU "armsse-mhu"
+#define ARMSSE_MHU(obj) OBJECT_CHECK(ARMSSEMHU, (obj), TYPE_ARMSSE_MHU)
+
+typedef struct ARMSSEMHU {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    qemu_irq cpu0irq;
+    qemu_irq cpu1irq;
+
+    uint32_t cpu0intr;
+    uint32_t cpu1intr;
+} ARMSSEMHU;
+
+#endif
diff --git a/hw/misc/armsse-mhu.c b/hw/misc/armsse-mhu.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/armsse-mhu.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SSE-200 Message Handling Unit (MHU)
+ *
+ * Copyright (c) 2019 Linaro Limited
+ * Written by Peter Maydell
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License version 2 or
+ *  (at your option) any later version.
+ */
+
+/*
+ * This is a model of the Message Handling Unit (MHU) which is part of the
+ * Arm SSE-200 and documented in
+ * http://infocenter.arm.com/help/topic/com.arm.doc.101104_0100_00_en/corelink_sse200_subsystem_for_embedded_technical_reference_manual_101104_0100_00_en.pdf
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "qapi/error.h"
+#include "sysemu/sysemu.h"
+#include "hw/sysbus.h"
+#include "hw/registerfields.h"
+#include "hw/misc/armsse-mhu.h"
+
+REG32(CPU0INTR_STAT, 0x0)
+REG32(CPU0INTR_SET, 0x4)
+REG32(CPU0INTR_CLR, 0x8)
+REG32(CPU1INTR_STAT, 0x10)
+REG32(CPU1INTR_SET, 0x14)
+REG32(CPU1INTR_CLR, 0x18)
+REG32(PID4, 0xfd0)
+REG32(PID5, 0xfd4)
+REG32(PID6, 0xfd8)
+REG32(PID7, 0xfdc)
+REG32(PID0, 0xfe0)
+REG32(PID1, 0xfe4)
+REG32(PID2, 0xfe8)
+REG32(PID3, 0xfec)
+REG32(CID0, 0xff0)
+REG32(CID1, 0xff4)
+REG32(CID2, 0xff8)
+REG32(CID3, 0xffc)
+
+/* Valid bits in the interrupt registers. If any are set the IRQ is raised */
+#define INTR_MASK 0xf
+
+/* PID/CID values */
+static const int armsse_mhu_id[] = {
+    0x04, 0x00, 0x00, 0x00, /* PID4..PID7 */
+    0x56, 0xb8, 0x0b, 0x00, /* PID0..PID3 */
+    0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
+};
+
+static void armsse_mhu_update(ARMSSEMHU *s)
+{
+    qemu_set_irq(s->cpu0irq, s->cpu0intr != 0);
+    qemu_set_irq(s->cpu1irq, s->cpu1intr != 0);
+}
+
+static uint64_t armsse_mhu_read(void *opaque, hwaddr offset, unsigned size)
+{
+    ARMSSEMHU *s = ARMSSE_MHU(opaque);
+    uint64_t r;
+
+    switch (offset) {
+    case A_CPU0INTR_STAT:
+        r = s->cpu0intr;
+        break;
+
+    case A_CPU1INTR_STAT:
+        r = s->cpu1intr;
+        break;
+
+    case A_PID4 ... A_CID3:
+        r = armsse_mhu_id[(offset - A_PID4) / 4];
+        break;
+
+    case A_CPU0INTR_SET:
+    case A_CPU0INTR_CLR:
+    case A_CPU1INTR_SET:
+    case A_CPU1INTR_CLR:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SSE MHU: read of write-only register at offset 0x%x\n",
+                      (int)offset);
+        r = 0;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SSE MHU read: bad offset 0x%x\n", (int)offset);
+        r = 0;
+        break;
+    }
+    trace_armsse_mhu_read(offset, r, size);
+    return r;
+}
+
+static void armsse_mhu_write(void *opaque, hwaddr offset,
+                             uint64_t value, unsigned size)
+{
+    ARMSSEMHU *s = ARMSSE_MHU(opaque);
+
+    trace_armsse_mhu_write(offset, value, size);
+
+    switch (offset) {
+    case A_CPU0INTR_SET:
+        s->cpu0intr |= (value & INTR_MASK);
+        break;
+    case A_CPU0INTR_CLR:
+        s->cpu0intr &= ~(value & INTR_MASK);
+        break;
+    case A_CPU1INTR_SET:
+        s->cpu1intr |= (value & INTR_MASK);
+        break;
+    case A_CPU1INTR_CLR:
+        s->cpu1intr &= ~(value & INTR_MASK);
+        break;
+
+    case A_CPU0INTR_STAT:
+    case A_CPU1INTR_STAT:
+    case A_PID4 ... A_CID3:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SSE MHU: write to read-only register at offset 0x%x\n",
+                      (int)offset);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SSE MHU write: bad offset 0x%x\n", (int)offset);
+        break;
+    }
+
+    armsse_mhu_update(s);
+}
+
+static const MemoryRegionOps armsse_mhu_ops = {
+    .read = armsse_mhu_read,
+    .write = armsse_mhu_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static void armsse_mhu_reset(DeviceState *dev)
+{
+    ARMSSEMHU *s = ARMSSE_MHU(dev);
+
+    s->cpu0intr = 0;
+    s->cpu1intr = 0;
+}
+
+static const VMStateDescription armsse_mhu_vmstate = {
+    .name = "armsse-mhu",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(cpu0intr, ARMSSEMHU),
+        VMSTATE_UINT32(cpu1intr, ARMSSEMHU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void armsse_mhu_init(Object *obj)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    ARMSSEMHU *s = ARMSSE_MHU(obj);
+
+    memory_region_init_io(&s->iomem, obj, &armsse_mhu_ops,
+                          s, "armsse-mhu", 0x1000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->cpu0irq);
+    sysbus_init_irq(sbd, &s->cpu1irq);
+}
+
+static void armsse_mhu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = armsse_mhu_reset;
+    dc->vmsd = &armsse_mhu_vmstate;
+}
+
+static const TypeInfo armsse_mhu_info = {
+    .name = TYPE_ARMSSE_MHU,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(ARMSSEMHU),
+    .instance_init = armsse_mhu_init,
+    .class_init = armsse_mhu_class_init,
+};
+
+static void armsse_mhu_register_types(void)
+{
+    type_register_static(&armsse_mhu_info);
+}
+
+type_init(armsse_mhu_register_types);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/misc/iotkit-sysinfo.c
 F: include/hw/misc/iotkit-sysinfo.h
 F: hw/misc/armsse-cpuid.c
 F: include/hw/misc/armsse-cpuid.h
+F: hw/misc/armsse-mhu.c
+F: include/hw/misc/armsse-mhu.h
 
 Musca
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_IOTKIT_SECCTL=y
 CONFIG_IOTKIT_SYSCTL=y
 CONFIG_IOTKIT_SYSINFO=y
 CONFIG_ARMSSE_CPUID=y
+CONFIG_ARMSSE_MHU=y
 
 CONFIG_VERSATILE=y
 CONFIG_VERSATILE_PCI=y
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -XXX,XX +XXX,XX @@ iotkit_sysctl_reset(void) "IoTKit SysCtl: reset"
 # hw/misc/armsse-cpuid.c
 armsse_cpuid_read(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 armsse_cpuid_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 CPU_IDENTITY write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+
+# hw/misc/armsse-mhu.c
+armsse_mhu_read(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+armsse_mhu_write(uint64_t offset, uint64_t data, unsigned size) "SSE-200 MHU write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
-- 
2.20.1

Create and connect the MHUs in the SSE-200.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-3-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h |  3 ++-
 hw/arm/armsse.c         | 40 ++++++++++++++++++++++++++++++----------
 2 files changed, 32 insertions(+), 11 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/iotkit-sysctl.h"
 #include "hw/misc/iotkit-sysinfo.h"
 #include "hw/misc/armsse-cpuid.h"
+#include "hw/misc/armsse-mhu.h"
 #include "hw/misc/unimp.h"
 #include "hw/or-irq.h"
 #include "hw/core/split-irq.h"
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
     IoTKitSysCtl sysctl;
     IoTKitSysCtl sysinfo;
 
-    UnimplementedDeviceState mhu[2];
+    ARMSSEMHU mhu[2];
     UnimplementedDeviceState ppu[NUM_PPUS];
     UnimplementedDeviceState cachectrl[SSE_MAX_CPUS];
     UnimplementedDeviceState cpusecctrl[SSE_MAX_CPUS];
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_init(Object *obj)
                           sizeof(s->sysinfo), TYPE_IOTKIT_SYSINFO);
     if (info->has_mhus) {
         sysbus_init_child_obj(obj, "mhu0", &s->mhu[0], sizeof(s->mhu[0]),
-                              TYPE_UNIMPLEMENTED_DEVICE);
+                              TYPE_ARMSSE_MHU);
         sysbus_init_child_obj(obj, "mhu1", &s->mhu[1], sizeof(s->mhu[1]),
-                              TYPE_UNIMPLEMENTED_DEVICE);
+                              TYPE_ARMSSE_MHU);
     }
     if (info->has_ppus) {
         for (i = 0; i < info->num_cpus; i++) {
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     }
 
     if (info->has_mhus) {
-        for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
-            char *name;
-            char *port;
+        /*
+         * An SSE-200 with only one CPU should have only one MHU created,
+         * with the region where the second MHU usually is being RAZ/WI.
+         * We don't implement that SSE-200 config; if we want to support
+         * it then this code needs to be enhanced to handle creating the
+         * RAZ/WI region instead of the second MHU.
+         */
+        assert(info->num_cpus == ARRAY_SIZE(s->mhu));
+
+        for (i = 0; i < ARRAY_SIZE(s->mhu); i++) {
+            char *port;
+            int cpunum;
+            SysBusDevice *mhu_sbd = SYS_BUS_DEVICE(&s->mhu[i]);
 
-            name = g_strdup_printf("MHU%d", i);
-            qdev_prop_set_string(DEVICE(&s->mhu[i]), "name", name);
-            qdev_prop_set_uint64(DEVICE(&s->mhu[i]), "size", 0x1000);
             object_property_set_bool(OBJECT(&s->mhu[i]), true,
                                      "realized", &err);
-            g_free(name);
             if (err) {
                 error_propagate(errp, err);
                 return;
             }
             port = g_strdup_printf("port[%d]", i + 3);
-            mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->mhu[i]), 0);
+            mr = sysbus_mmio_get_region(mhu_sbd, 0);
             object_property_set_link(OBJECT(&s->apb_ppc0), OBJECT(mr),
                                      port, &err);
             g_free(port);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 error_propagate(errp, err);
                 return;
             }
+
+            /*
+             * Each MHU has an irq line for each CPU:
+             *  MHU 0 irq line 0 -> CPU 0 IRQ 6
+             *  MHU 0 irq line 1 -> CPU 1 IRQ 6
+             *  MHU 1 irq line 0 -> CPU 0 IRQ 7
+             *  MHU 1 irq line 1 -> CPU 1 IRQ 7
+             */
+            for (cpunum = 0; cpunum < info->num_cpus; cpunum++) {
+                DeviceState *cpudev = DEVICE(&s->armv7m[cpunum]);
+
+                sysbus_connect_irq(mhu_sbd, cpunum,
+                                   qdev_get_gpio_in(cpudev, 6 + i));
+            }
         }
     }
 
-- 
2.20.1

Make the M-profile "init-svtor" property be settable after realize.
This matches the hardware, where this is a config signal which
is sampled on CPU reset and can thus be changed between one
reset and another. To do this we have to change the API we
use to add the property.

(We will need this capability for the SSE-200.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-4-peter.maydell@linaro.org
---
 target/arm/cpu.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/idau.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
+#include "qapi/visitor.h"
 #include "cpu.h"
 #include "internals.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pmsav7_dregion_property =
                                            pmsav7_dregion,
                                            qdev_prop_uint32, uint32_t);
 
-/* M profile: initial value of the Secure VTOR */
-static Property arm_cpu_initsvtor_property =
-            DEFINE_PROP_UINT32("init-svtor", ARMCPU, init_svtor, 0);
+static void arm_get_init_svtor(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    visit_type_uint32(v, name, &cpu->init_svtor, errp);
+}
+
+static void arm_set_init_svtor(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    visit_type_uint32(v, name, &cpu->init_svtor, errp);
+}
 
 void arm_cpu_post_init(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                  qdev_prop_allow_set_link_before_realize,
                                  OBJ_PROP_LINK_STRONG,
                                  &error_abort);
-        qdev_property_add_static(DEVICE(obj), &arm_cpu_initsvtor_property,
-                                 &error_abort);
+        /*
+         * M profile: initial value of the Secure VTOR. We can't just use
+         * a simple DEFINE_PROP_UINT32 for this because we want to permit
+         * the property to be set after realize.
+         */
+        object_property_add(obj, "init-svtor", "uint32",
+                            arm_get_init_svtor, arm_set_init_svtor,
+                            NULL, NULL, &error_abort);
     }
 
     qdev_property_add_static(DEVICE(obj), &arm_cpu_cfgend_property,
-- 
2.20.1

Currently the Arm arm-powerctl.h APIs allow:
 * arm_set_cpu_on(), which powers on a CPU and sets its
   initial PC and other startup state
 * arm_reset_cpu(), which resets a CPU which is already on
   (and fails if the CPU is powered off)

but there is no way to say "power on a CPU as if it had
just come out of reset and don't do anything else to it".

Add a new function arm_set_cpu_on_and_reset(), which does this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-5-peter.maydell@linaro.org
---
 target/arm/arm-powerctl.h | 16 +++++++++++
 target/arm/arm-powerctl.c | 56 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)

diff --git a/target/arm/arm-powerctl.h b/target/arm/arm-powerctl.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.h
+++ b/target/arm/arm-powerctl.h
@@ -XXX,XX +XXX,XX @@ int arm_set_cpu_off(uint64_t cpuid);
  */
 int arm_reset_cpu(uint64_t cpuid);
 
+/*
+ * arm_set_cpu_on_and_reset:
+ * @cpuid: the id of the CPU we want to star
+ *
+ * Start the cpu designated by @cpuid and put it through its normal
+ * CPU reset process. The CPU will start in the way it is architected
+ * to start after a power-on reset.
+ *
+ * Returns: QEMU_ARM_POWERCTL_RET_SUCCESS on success.
+ * QEMU_ARM_POWERCTL_INVALID_PARAM if there is no CPU with that ID.
+ * QEMU_ARM_POWERCTL_ALREADY_ON if the CPU is already on.
+ * QEMU_ARM_POWERCTL_ON_PENDING if the CPU is already partway through
+ * powering on.
+ */
+int arm_set_cpu_on_and_reset(uint64_t cpuid);
+
 #endif
diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -XXX,XX +XXX,XX @@ int arm_set_cpu_on(uint64_t cpuid, uint64_t entry, uint64_t context_id,
     return QEMU_ARM_POWERCTL_RET_SUCCESS;
 }
 
+static void arm_set_cpu_on_and_reset_async_work(CPUState *target_cpu_state,
+                                                run_on_cpu_data data)
+{
+    ARMCPU *target_cpu = ARM_CPU(target_cpu_state);
+
+    /* Initialize the cpu we are turning on */
+    cpu_reset(target_cpu_state);
+    target_cpu_state->halted = 0;
+
+    /* Finally set the power status */
+    assert(qemu_mutex_iothread_locked());
+    target_cpu->power_state = PSCI_ON;
+}
+
+int arm_set_cpu_on_and_reset(uint64_t cpuid)
+{
+    CPUState *target_cpu_state;
+    ARMCPU *target_cpu;
+
+    assert(qemu_mutex_iothread_locked());
+
+    /* Retrieve the cpu we are powering up */
+    target_cpu_state = arm_get_cpu_by_id(cpuid);
+    if (!target_cpu_state) {
+        /* The cpu was not found */
+        return QEMU_ARM_POWERCTL_INVALID_PARAM;
+    }
+
+    target_cpu = ARM_CPU(target_cpu_state);
+    if (target_cpu->power_state == PSCI_ON) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "[ARM]%s: CPU %" PRId64 " is already on\n",
+                      __func__, cpuid);
+        return QEMU_ARM_POWERCTL_ALREADY_ON;
+    }
+
+    /*
+     * If another CPU has powered the target on we are in the state
+     * ON_PENDING and additional attempts to power on the CPU should
+     * fail (see 6.6 Implementation CPU_ON/CPU_OFF races in the PSCI
+     * spec)
+     */
+    if (target_cpu->power_state == PSCI_ON_PENDING) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "[ARM]%s: CPU %" PRId64 " is already powering on\n",
+                      __func__, cpuid);
+        return QEMU_ARM_POWERCTL_ON_PENDING;
+    }
+
+    async_run_on_cpu(target_cpu_state, arm_set_cpu_on_and_reset_async_work,
+                     RUN_ON_CPU_NULL);
+
+    /* We are good to go */
+    return QEMU_ARM_POWERCTL_RET_SUCCESS;
+}
+
 static void arm_set_cpu_off_async_work(CPUState *target_cpu_state,
                                        run_on_cpu_data data)
 {
-- 
2.20.1

The iotkit-sysctl device has a register it names INITSVRTOR0.
This is actually a typo present in the IoTKit documentation
and also in part of the SSE-200 documentation:  it should be
INITSVTOR0 because it is specifying the initial value of the
Secure VTOR register in the CPU. Correct the typo.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-6-peter.maydell@linaro.org
---
 include/hw/misc/iotkit-sysctl.h |  2 +-
 hw/misc/iotkit-sysctl.c         | 16 ++++++++--------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/iotkit-sysctl.h
+++ b/include/hw/misc/iotkit-sysctl.h
@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
     uint32_t reset_syndrome;
     uint32_t reset_mask;
     uint32_t gretreg;
-    uint32_t initsvrtor0;
+    uint32_t initsvtor0;
     uint32_t cpuwait;
     uint32_t wicctrl;
 } IoTKitSysCtl;
diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@ REG32(RESET_MASK, 0x104)
 REG32(SWRESET, 0x108)
     FIELD(SWRESET, SWRESETREQ, 9, 1)
 REG32(GRETREG, 0x10c)
-REG32(INITSVRTOR0, 0x110)
+REG32(INITSVTOR0, 0x110)
 REG32(CPUWAIT, 0x118)
 REG32(BUSWAIT, 0x11c)
 REG32(WICCTRL, 0x120)
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
     case A_GRETREG:
         r = s->gretreg;
         break;
-    case A_INITSVRTOR0:
-        r = s->initsvrtor0;
+    case A_INITSVTOR0:
+        r = s->initsvtor0;
         break;
     case A_CPUWAIT:
         r = s->cpuwait;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
          */
         s->gretreg = value;
         break;
-    case A_INITSVRTOR0:
-        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVRTOR0 unimplemented\n");
-        s->initsvrtor0 = value;
+    case A_INITSVTOR0:
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR0 unimplemented\n");
+        s->initsvtor0 = value;
         break;
     case A_CPUWAIT:
         qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CPUWAIT unimplemented\n");
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
     s->reset_syndrome = 1;
     s->reset_mask = 0;
     s->gretreg = 0;
-    s->initsvrtor0 = 0x10000000;
+    s->initsvtor0 = 0x10000000;
     s->cpuwait = 0;
     s->wicctrl = 0;
 }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
         VMSTATE_UINT32(reset_syndrome, IoTKitSysCtl),
         VMSTATE_UINT32(reset_mask, IoTKitSysCtl),
         VMSTATE_UINT32(gretreg, IoTKitSysCtl),
-        VMSTATE_UINT32(initsvrtor0, IoTKitSysCtl),
+        VMSTATE_UINT32(initsvtor0, IoTKitSysCtl),
         VMSTATE_UINT32(cpuwait, IoTKitSysCtl),
         VMSTATE_UINT32(wicctrl, IoTKitSysCtl),
         VMSTATE_END_OF_LIST()
-- 
2.20.1

The SYSCTL block in the SSE-200 has some extra registers that
are not present in the IoTKit version. Add these registers
(as reads-as-written stubs), enabled by a new QOM property.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-7-peter.maydell@linaro.org
---
 include/hw/misc/iotkit-sysctl.h |  20 +++
 hw/arm/armsse.c                 |   2 +
 hw/misc/iotkit-sysctl.c         | 245 +++++++++++++++++++++++++++++++-
 3 files changed, 262 insertions(+), 5 deletions(-)

diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/iotkit-sysctl.h
+++ b/include/hw/misc/iotkit-sysctl.h
@@ -XXX,XX +XXX,XX @@
  * "system control register" blocks.
  *
  * QEMU interface:
+ *  + QOM property "SYS_VERSION": value of the SYS_VERSION register of the
+ *    system information block of the SSE
+ *    (used to identify whether to provide SSE-200-only registers)
  *  + sysbus MMIO region 0: the system information register bank
  *  + sysbus MMIO region 1: the system control register bank
  */
@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
     uint32_t initsvtor0;
     uint32_t cpuwait;
     uint32_t wicctrl;
+    uint32_t scsecctrl;
+    uint32_t fclk_div;
+    uint32_t sysclk_div;
+    uint32_t clock_force;
+    uint32_t initsvtor1;
+    uint32_t nmi_enable;
+    uint32_t ewctrl;
+    uint32_t pdcm_pd_sys_sense;
+    uint32_t pdcm_pd_sram0_sense;
+    uint32_t pdcm_pd_sram1_sense;
+    uint32_t pdcm_pd_sram2_sense;
+    uint32_t pdcm_pd_sram3_sense;
+
+    /* Properties */
+    uint32_t sys_version;
+
+    bool is_sse200;
 } IoTKitSysCtl;
 
 #endif
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* System information registers */
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->sysinfo), 0, 0x40020000);
     /* System control registers */
+    object_property_set_int(OBJECT(&s->sysctl), info->sys_version,
+                            "SYS_VERSION", &err);
     object_property_set_bool(OBJECT(&s->sysctl), true, "realized", &err);
     if (err) {
         error_propagate(errp, err);
diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "qemu/log.h"
 #include "trace.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@
 REG32(SECDBGSTAT, 0x0)
 REG32(SECDBGSET, 0x4)
 REG32(SECDBGCLR, 0x8)
+REG32(SCSECCTRL, 0xc)
+REG32(FCLK_DIV, 0x10)
+REG32(SYSCLK_DIV, 0x14)
+REG32(CLOCK_FORCE, 0x18)
 REG32(RESET_SYNDROME, 0x100)
 REG32(RESET_MASK, 0x104)
 REG32(SWRESET, 0x108)
     FIELD(SWRESET, SWRESETREQ, 9, 1)
 REG32(GRETREG, 0x10c)
 REG32(INITSVTOR0, 0x110)
+REG32(INITSVTOR1, 0x114)
 REG32(CPUWAIT, 0x118)
-REG32(BUSWAIT, 0x11c)
+REG32(NMI_ENABLE, 0x11c) /* BUSWAIT in IoTKit */
 REG32(WICCTRL, 0x120)
+REG32(EWCTRL, 0x124)
+REG32(PDCM_PD_SYS_SENSE, 0x200)
+REG32(PDCM_PD_SRAM0_SENSE, 0x20c)
+REG32(PDCM_PD_SRAM1_SENSE, 0x210)
+REG32(PDCM_PD_SRAM2_SENSE, 0x214)
+REG32(PDCM_PD_SRAM3_SENSE, 0x218)
 REG32(PID4, 0xfd0)
 REG32(PID5, 0xfd4)
 REG32(PID6, 0xfd8)
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
     case A_SECDBGSTAT:
         r = s->secure_debug;
         break;
+    case A_SCSECCTRL:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->scsecctrl;
+        break;
+    case A_FCLK_DIV:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->fclk_div;
+        break;
+    case A_SYSCLK_DIV:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->sysclk_div;
+        break;
+    case A_CLOCK_FORCE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->clock_force;
+        break;
     case A_RESET_SYNDROME:
         r = s->reset_syndrome;
         break;
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
     case A_INITSVTOR0:
         r = s->initsvtor0;
         break;
+    case A_INITSVTOR1:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->initsvtor1;
+        break;
     case A_CPUWAIT:
         r = s->cpuwait;
         break;
-    case A_BUSWAIT:
-        /* In IoTKit BUSWAIT is reserved, R/O, zero */
-        r = 0;
+    case A_NMI_ENABLE:
+        /* In IoTKit this is named BUSWAIT but is marked reserved, R/O, zero */
+        if (!s->is_sse200) {
+            r = 0;
+            break;
+        }
+        r = s->nmi_enable;
         break;
     case A_WICCTRL:
         r = s->wicctrl;
         break;
+    case A_EWCTRL:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->ewctrl;
+        break;
+    case A_PDCM_PD_SYS_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->pdcm_pd_sys_sense;
+        break;
+    case A_PDCM_PD_SRAM0_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->pdcm_pd_sram0_sense;
+        break;
+    case A_PDCM_PD_SRAM1_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->pdcm_pd_sram1_sense;
+        break;
+    case A_PDCM_PD_SRAM2_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->pdcm_pd_sram2_sense;
+        break;
+    case A_PDCM_PD_SRAM3_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        r = s->pdcm_pd_sram3_sense;
+        break;
     case A_PID4 ... A_CID3:
         r = sysctl_id[(offset - A_PID4) / 4];
         break;
@@ -XXX,XX +XXX,XX @@ static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
         r = 0;
         break;
     default:
+    bad_offset:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "IoTKit SysCtl read: bad offset %x\n", (int)offset);
         r = 0;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
         }
         break;
-    case A_BUSWAIT:        /* In IoTKit BUSWAIT is reserved, R/O, zero */
+    case A_SCSECCTRL:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SCSECCTRL unimplemented\n");
+        s->scsecctrl = value;
+        break;
+    case A_FCLK_DIV:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl FCLK_DIV unimplemented\n");
+        s->fclk_div = value;
+        break;
+    case A_SYSCLK_DIV:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl SYSCLK_DIV unimplemented\n");
+        s->sysclk_div = value;
+        break;
+    case A_CLOCK_FORCE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CLOCK_FORCE unimplemented\n");
+        s->clock_force = value;
+        break;
+    case A_INITSVTOR1:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR1 unimplemented\n");
+        s->initsvtor1 = value;
+        break;
+    case A_EWCTRL:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl EWCTRL unimplemented\n");
+        s->ewctrl = value;
+        break;
+    case A_PDCM_PD_SYS_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SysCtl PDCM_PD_SYS_SENSE unimplemented\n");
+        s->pdcm_pd_sys_sense = value;
+        break;
+    case A_PDCM_PD_SRAM0_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SysCtl PDCM_PD_SRAM0_SENSE unimplemented\n");
+        s->pdcm_pd_sram0_sense = value;
+        break;
+    case A_PDCM_PD_SRAM1_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SysCtl PDCM_PD_SRAM1_SENSE unimplemented\n");
+        s->pdcm_pd_sram1_sense = value;
+        break;
+    case A_PDCM_PD_SRAM2_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SysCtl PDCM_PD_SRAM2_SENSE unimplemented\n");
+        s->pdcm_pd_sram2_sense = value;
+        break;
+    case A_PDCM_PD_SRAM3_SENSE:
+        if (!s->is_sse200) {
+            goto bad_offset;
+        }
+        qemu_log_mask(LOG_UNIMP,
+                      "IoTKit SysCtl PDCM_PD_SRAM3_SENSE unimplemented\n");
+        s->pdcm_pd_sram3_sense = value;
+        break;
+    case A_NMI_ENABLE:
+        /* In IoTKit this is BUSWAIT: reserved, R/O, zero */
+        if (!s->is_sse200) {
+            goto ro_offset;
+        }
+        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl NMI_ENABLE unimplemented\n");
+        s->nmi_enable = value;
+        break;
     case A_SECDBGSTAT:
     case A_PID4 ... A_CID3:
+    ro_offset:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "IoTKit SysCtl write: write of RO offset %x\n",
                       (int)offset);
         break;
     default:
+    bad_offset:
         qemu_log_mask(LOG_GUEST_ERROR,
                       "IoTKit SysCtl write: bad offset %x\n", (int)offset);
         break;
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
     s->reset_mask = 0;
     s->gretreg = 0;
     s->initsvtor0 = 0x10000000;
+    s->initsvtor1 = 0x10000000;
     s->cpuwait = 0;
     s->wicctrl = 0;
+    s->scsecctrl = 0;
+    s->fclk_div = 0;
+    s->sysclk_div = 0;
+    s->clock_force = 0;
+    s->nmi_enable = 0;
+    s->ewctrl = 0;
+    s->pdcm_pd_sys_sense = 0x7f;
+    s->pdcm_pd_sram0_sense = 0;
+    s->pdcm_pd_sram1_sense = 0;
+    s->pdcm_pd_sram2_sense = 0;
+    s->pdcm_pd_sram3_sense = 0;
 }
 
 static void iotkit_sysctl_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_init(Object *obj)
     sysbus_init_mmio(sbd, &s->iomem);
 }
 
+static void iotkit_sysctl_realize(DeviceState *dev, Error **errp)
+{
+    IoTKitSysCtl *s = IOTKIT_SYSCTL(dev);
+
+    /* The top 4 bits of the SYS_VERSION register tell us if we're an SSE-200 */
+    if (extract32(s->sys_version, 28, 4) == 2) {
+        s->is_sse200 = true;
+    }
+}
+
+static bool sse200_needed(void *opaque)
+{
+    IoTKitSysCtl *s = IOTKIT_SYSCTL(opaque);
+
+    return s->is_sse200;
+}
+
+static const VMStateDescription iotkit_sysctl_sse200_vmstate = {
+    .name = "iotkit-sysctl/sse-200",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = sse200_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(scsecctrl, IoTKitSysCtl),
+        VMSTATE_UINT32(fclk_div, IoTKitSysCtl),
+        VMSTATE_UINT32(sysclk_div, IoTKitSysCtl),
+        VMSTATE_UINT32(clock_force, IoTKitSysCtl),
+        VMSTATE_UINT32(initsvtor1, IoTKitSysCtl),
+        VMSTATE_UINT32(nmi_enable, IoTKitSysCtl),
+        VMSTATE_UINT32(pdcm_pd_sys_sense, IoTKitSysCtl),
+        VMSTATE_UINT32(pdcm_pd_sram0_sense, IoTKitSysCtl),
+        VMSTATE_UINT32(pdcm_pd_sram1_sense, IoTKitSysCtl),
+        VMSTATE_UINT32(pdcm_pd_sram2_sense, IoTKitSysCtl),
+        VMSTATE_UINT32(pdcm_pd_sram3_sense, IoTKitSysCtl),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription iotkit_sysctl_vmstate = {
     .name = "iotkit-sysctl",
     .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
         VMSTATE_UINT32(cpuwait, IoTKitSysCtl),
         VMSTATE_UINT32(wicctrl, IoTKitSysCtl),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription*[]) {
+        &iotkit_sysctl_sse200_vmstate,
+        NULL
     }
 };
 
+static Property iotkit_sysctl_props[] = {
+    DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysCtl, sys_version, 0),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void iotkit_sysctl_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     dc->vmsd = &iotkit_sysctl_vmstate;
     dc->reset = iotkit_sysctl_reset;
+    dc->props = iotkit_sysctl_props;
+    dc->realize = iotkit_sysctl_realize;
 }
 
 static const TypeInfo iotkit_sysctl_info = {
-- 
2.20.1

The CPUWAIT register acts as a sort of power-control: if a bit
in it is 1 then the CPU will have been forced into waiting
when the system was reset (which in QEMU we model as the
CPU starting powered off). Writing a 0 to the register will
allow the CPU to boot (for QEMU, we model this as powering
it on). Note that writing 0 to the register does not power
off a CPU.

For this to work correctly we need to also honour the
INITSVTOR* registers, which let the guest control where the
CPU will load its SP and PC from when it comes out of reset.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-8-peter.maydell@linaro.org
---
 hw/misc/iotkit-sysctl.c | 41 +++++++++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/misc/iotkit-sysctl.h"
+#include "target/arm/arm-powerctl.h"
+#include "target/arm/cpu.h"
 
 REG32(SECDBGSTAT, 0x0)
 REG32(SECDBGSET, 0x4)
@@ -XXX,XX +XXX,XX @@ static const int sysctl_id[] = {
     0x0d, 0xf0, 0x05, 0xb1, /* CID0..CID3 */
 };
 
+/*
+ * Set the initial secure vector table offset address for the core.
+ * This will take effect when the CPU next resets.
+ */
+static void set_init_vtor(uint64_t cpuid, uint32_t vtor)
+{
+    Object *cpuobj = OBJECT(arm_get_cpu_by_id(cpuid));
+
+    if (cpuobj) {
+        if (object_property_find(cpuobj, "init-svtor", NULL)) {
+            object_property_set_uint(cpuobj, vtor, "init-svtor", &error_abort);
+        }
+    }
+}
+
 static uint64_t iotkit_sysctl_read(void *opaque, hwaddr offset,
                                     unsigned size)
 {
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
         s->gretreg = value;
         break;
     case A_INITSVTOR0:
-        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR0 unimplemented\n");
         s->initsvtor0 = value;
+        set_init_vtor(0, s->initsvtor0);
         break;
     case A_CPUWAIT:
-        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl CPUWAIT unimplemented\n");
+        if ((s->cpuwait & 1) && !(value & 1)) {
+            /* Powering up CPU 0 */
+            arm_set_cpu_on_and_reset(0);
+        }
+        if ((s->cpuwait & 2) && !(value & 2)) {
+            /* Powering up CPU 1 */
+            arm_set_cpu_on_and_reset(1);
+        }
         s->cpuwait = value;
         break;
     case A_WICCTRL:
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_write(void *opaque, hwaddr offset,
         if (!s->is_sse200) {
             goto bad_offset;
         }
-        qemu_log_mask(LOG_UNIMP, "IoTKit SysCtl INITSVTOR1 unimplemented\n");
         s->initsvtor1 = value;
+        set_init_vtor(1, s->initsvtor1);
         break;
     case A_EWCTRL:
         if (!s->is_sse200) {
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
     s->gretreg = 0;
     s->initsvtor0 = 0x10000000;
     s->initsvtor1 = 0x10000000;
-    s->cpuwait = 0;
+    if (s->is_sse200) {
+        /*
+         * CPU 0 starts on, CPU 1 starts off. In real hardware this is
+         * configurable by the SoC integrator as a verilog parameter.
+         */
+        s->cpuwait = 2;
+    } else {
+        /* CPU 0 starts on */
+        s->cpuwait = 0;
+    }
     s->wicctrl = 0;
     s->scsecctrl = 0;
     s->fclk_div = 0;
-- 
2.20.1

At the moment the handling of init-svtor and cpuwait initial
values is split between armsse.c and iotkit-sysctl.c:
the code in armsse.c sets the initial state of the CPU
object by setting the init-svtor and start-powered-off
properties, but the iotkit-sysctl.c code has its own
code setting the reset values of its registers (which are
then used when updating the CPU when the guest makes
runtime changes).

Clean this up by making the armsse.c code set properties on the
iotkit-sysctl object to define the initial values of the
registers, so they always match the initial CPU state,
and update the comments in armsse.c accordingly.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219125808.25174-9-peter.maydell@linaro.org
---
 include/hw/misc/iotkit-sysctl.h |  3 ++
 hw/arm/armsse.c                 | 49 +++++++++++++++++++++------------
 hw/misc/iotkit-sysctl.c         | 20 ++++++--------
 3 files changed, 42 insertions(+), 30 deletions(-)

diff --git a/include/hw/misc/iotkit-sysctl.h b/include/hw/misc/iotkit-sysctl.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/iotkit-sysctl.h
+++ b/include/hw/misc/iotkit-sysctl.h
@@ -XXX,XX +XXX,XX @@ typedef struct IoTKitSysCtl {
 
     /* Properties */
     uint32_t sys_version;
+    uint32_t cpuwait_rst;
+    uint32_t initsvtor0_rst;
+    uint32_t initsvtor1_rst;
 
     bool is_sse200;
 } IoTKitSysCtl;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "qemu/bitops.h"
 #include "qapi/error.h"
 #include "trace.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
     int sram_banks;
     int num_cpus;
     uint32_t sys_version;
+    uint32_t cpuwait_rst;
     SysConfigFormat sys_config_format;
     bool has_mhus;
     bool has_ppus;
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .sram_banks = 1,
         .num_cpus = 1,
         .sys_version = 0x41743,
+        .cpuwait_rst = 0,
         .sys_config_format = IoTKitFormat,
         .has_mhus = false,
         .has_ppus = false,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .sram_banks = 4,
         .num_cpus = 2,
         .sys_version = 0x22041743,
+        .cpuwait_rst = 2,
         .sys_config_format = SSE200Format,
         .has_mhus = true,
         .has_ppus = true,
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
 
         qdev_prop_set_uint32(cpudev, "num-irq", s->exp_numirq + 32);
         /*
-         * In real hardware the initial Secure VTOR is set from the INITSVTOR0
-         * register in the IoT Kit System Control Register block, and the
-         * initial value of that is in turn specifiable by the FPGA that
-         * instantiates the IoT Kit. In QEMU we don't implement this wrinkle,
-         * and simply set the CPU's init-svtor to the IoT Kit default value.
-         * In SSE-200 the situation is similar, except that the default value
-         * is a reset-time signal input. Typically a board using the SSE-200
-         * will have a system control processor whose boot firmware initializes
-         * the INITSVTOR* registers before powering up the CPUs in any case,
-         * so the hardware's default value doesn't matter. QEMU doesn't emulate
+         * In real hardware the initial Secure VTOR is set from the INITSVTOR*
+         * registers in the IoT Kit System Control Register block. In QEMU
+         * we set the initial value here, and also the reset value of the
+         * sysctl register, from this object's QOM init-svtor property.
+         * If the guest changes the INITSVTOR* registers at runtime then the
+         * code in iotkit-sysctl.c will update the CPU init-svtor property
+         * (which will then take effect on the next CPU warm-reset).
+         *
+         * Note that typically a board using the SSE-200 will have a system
+         * control processor whose boot firmware initializes the INITSVTOR*
+         * registers before powering up the CPUs. QEMU doesn't emulate
          * the control processor, so instead we behave in the way that the
-         * firmware does. The initial value is configurable by the board code
-         * to match whatever its firmware does.
+         * firmware does: the initial value should be set by the board code
+         * (using the init-svtor property on the ARMSSE object) to match
+         * whatever its firmware does.
          */
         qdev_prop_set_uint32(cpudev, "init-svtor", s->init_svtor);
         /*
-         * Start all CPUs except CPU0 powered down. In real hardware it is
-         * a configurable property of the SSE-200 which CPUs start powered up
-         * (via the CPUWAIT0_RST and CPUWAIT1_RST parameters), but since all
-         * the boards we care about start CPU0 and leave CPU1 powered off,
-         * we hard-code that for now. We can add QOM properties for this
+         * CPUs start powered down if the corresponding bit in the CPUWAIT
+         * register is 1. In real hardware the CPUWAIT register reset value is
+         * a configurable property of the SSE-200 (via the CPUWAIT0_RST and
+         * CPUWAIT1_RST parameters), but since all the boards we care about
+         * start CPU0 and leave CPU1 powered off, we hard-code that in
+         * info->cpuwait_rst for now. We can add QOM properties for this
          * later if necessary.
          */
-        if (i > 0) {
+        if (extract32(info->cpuwait_rst, i, 1)) {
             object_property_set_bool(cpuobj, true, "start-powered-off", &err);
             if (err) {
                 error_propagate(errp, err);
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
     /* System control registers */
     object_property_set_int(OBJECT(&s->sysctl), info->sys_version,
                             "SYS_VERSION", &err);
+    object_property_set_int(OBJECT(&s->sysctl), info->cpuwait_rst,
+                            "CPUWAIT_RST", &err);
+    object_property_set_int(OBJECT(&s->sysctl), s->init_svtor,
+                            "INITSVTOR0_RST", &err);
+    object_property_set_int(OBJECT(&s->sysctl), s->init_svtor,
+                            "INITSVTOR1_RST", &err);
     object_property_set_bool(OBJECT(&s->sysctl), true, "realized", &err);
     if (err) {
         error_propagate(errp, err);
diff --git a/hw/misc/iotkit-sysctl.c b/hw/misc/iotkit-sysctl.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/iotkit-sysctl.c
+++ b/hw/misc/iotkit-sysctl.c
@@ -XXX,XX +XXX,XX @@ static void iotkit_sysctl_reset(DeviceState *dev)
     s->reset_syndrome = 1;
     s->reset_mask = 0;
     s->gretreg = 0;
-    s->initsvtor0 = 0x10000000;
-    s->initsvtor1 = 0x10000000;
-    if (s->is_sse200) {
-        /*
-         * CPU 0 starts on, CPU 1 starts off. In real hardware this is
-         * configurable by the SoC integrator as a verilog parameter.
-         */
-        s->cpuwait = 2;
-    } else {
-        /* CPU 0 starts on */
-        s->cpuwait = 0;
-    }
+    s->initsvtor0 = s->initsvtor0_rst;
+    s->initsvtor1 = s->initsvtor1_rst;
+    s->cpuwait = s->cpuwait_rst;
     s->wicctrl = 0;
     s->scsecctrl = 0;
     s->fclk_div = 0;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription iotkit_sysctl_vmstate = {
 
 static Property iotkit_sysctl_props[] = {
     DEFINE_PROP_UINT32("SYS_VERSION", IoTKitSysCtl, sys_version, 0),
+    DEFINE_PROP_UINT32("CPUWAIT_RST", IoTKitSysCtl, cpuwait_rst, 0),
+    DEFINE_PROP_UINT32("INITSVTOR0_RST", IoTKitSysCtl, initsvtor0_rst,
+                       0x10000000),
+    DEFINE_PROP_UINT32("INITSVTOR1_RST", IoTKitSysCtl, initsvtor1_rst,
+                       0x10000000),
     DEFINE_PROP_END_OF_LIST()
 };
 
-- 
2.20.1

Instead of gating the A32/T32 FP16 conversion instructions on
the ARM_FEATURE_VFP_FP16 flag, switch to our new approach of
looking at ID register bits. In this case MVFR1 fields FPHP
and SIMDHP indicate the presence of these insns.

This change doesn't alter behaviour for any of our CPUs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190222170936.13268-2-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 37 ++++++++++++++++++++++++++++++++++++-
 target/arm/cpu.c       |  2 --
 target/arm/kvm32.c     |  3 ---
 target/arm/translate.c | 26 ++++++++++++++++++--------
 4 files changed, 54 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(ID_DFR0, MPROFDBG, 20, 4)
 FIELD(ID_DFR0, PERFMON, 24, 4)
 FIELD(ID_DFR0, TRACEFILT, 28, 4)
 
+FIELD(MVFR0, SIMDREG, 0, 4)
+FIELD(MVFR0, FPSP, 4, 4)
+FIELD(MVFR0, FPDP, 8, 4)
+FIELD(MVFR0, FPTRAP, 12, 4)
+FIELD(MVFR0, FPDIVIDE, 16, 4)
+FIELD(MVFR0, FPSQRT, 20, 4)
+FIELD(MVFR0, FPSHVEC, 24, 4)
+FIELD(MVFR0, FPROUND, 28, 4)
+
+FIELD(MVFR1, FPFTZ, 0, 4)
+FIELD(MVFR1, FPDNAN, 4, 4)
+FIELD(MVFR1, SIMDLS, 8, 4)
+FIELD(MVFR1, SIMDINT, 12, 4)
+FIELD(MVFR1, SIMDSP, 16, 4)
+FIELD(MVFR1, SIMDHP, 20, 4)
+FIELD(MVFR1, FPHP, 24, 4)
+FIELD(MVFR1, SIMDFMAC, 28, 4)
+
+FIELD(MVFR2, SIMDMISC, 0, 4)
+FIELD(MVFR2, FPMISC, 4, 4)
+
 QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
 
 /* If adding a feature bit which corresponds to a Linux ELF
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_THUMB2,
     ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
     ARM_FEATURE_VFP3,
-    ARM_FEATURE_VFP_FP16,
     ARM_FEATURE_NEON,
     ARM_FEATURE_M, /* Microcontroller profile.  */
     ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
 }
 
+/*
+ * We always set the FP and SIMD FP16 fields to indicate identical
+ * levels of support (assuming SIMD is implemented at all), so
+ * we only need one set of accessors.
+ */
+static inline bool isar_feature_aa32_fp16_spconv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 0;
+}
+
+static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->mvfr1, MVFR1, FPHP) > 1;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
     if (arm_feature(env, ARM_FEATURE_VFP4)) {
         set_feature(env, ARM_FEATURE_VFP3);
-        set_feature(env, ARM_FEATURE_VFP_FP16);
     }
     if (arm_feature(env, ARM_FEATURE_VFP3)) {
         set_feature(env, ARM_FEATURE_VFP);
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
     cpu->dtb_compatible = "arm,cortex-a9";
     set_feature(&cpu->env, ARM_FEATURE_V7);
     set_feature(&cpu->env, ARM_FEATURE_VFP3);
-    set_feature(&cpu->env, ARM_FEATURE_VFP_FP16);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_EL3);
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(id_pfr0, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_THUMB2EE);
     }
-    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
-        set_feature(&features, ARM_FEATURE_VFP_FP16);
-    }
     if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
                      * UNPREDICTABLE if bit 8 is set prior to ARMv8
                      * (we choose to UNDEF)
                      */
-                    if ((dp && !arm_dc_feature(s, ARM_FEATURE_V8)) ||
-                        !arm_dc_feature(s, ARM_FEATURE_VFP_FP16)) {
-                        return 1;
+                    if (dp) {
+                        if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
+                            return 1;
+                        }
+                    } else {
+                        if (!dc_isar_feature(aa32_fp16_spconv, s)) {
+                            return 1;
+                        }
                     }
                     rm_is_dp = false;
                     break;
                 case 0x06: /* vcvtb.f16.f32, vcvtb.f16.f64 */
                 case 0x07: /* vcvtt.f16.f32, vcvtt.f16.f64 */
-                    if ((dp && !arm_dc_feature(s, ARM_FEATURE_V8)) ||
-                        !arm_dc_feature(s, ARM_FEATURE_VFP_FP16)) {
-                        return 1;
+                    if (dp) {
+                        if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
+                            return 1;
+                        }
+                    } else {
+                        if (!dc_isar_feature(aa32_fp16_spconv, s)) {
+                            return 1;
+                        }
                     }
                     rd_is_dp = false;
                     break;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     TCGv_ptr fpst;
                     TCGv_i32 ahp;
 
-                    if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
+                    if (!dc_isar_feature(aa32_fp16_spconv, s) ||
                         q || (rm & 1)) {
                         return 1;
                     }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 {
                     TCGv_ptr fpst;
                     TCGv_i32 ahp;
-                    if (!arm_dc_feature(s, ARM_FEATURE_VFP_FP16) ||
+                    if (!dc_isar_feature(aa32_fp16_spconv, s) ||
                         q || (rd & 1)) {
                         return 1;
                     }
-- 
2.20.1

There is a set of VFP instructions which we implement in
disas_vfp_v8_insn() and gate on the ARM_FEATURE_V8 bit.
These were all first introduced in v8 for A-profile, but in
M-profile they appeared in v7M. Gate them on the MVFR2
FPMisc field instead, and rename the function appropriately.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190222170936.13268-3-peter.maydell@linaro.org
---
 target/arm/cpu.h       | 20 ++++++++++++++++++++
 target/arm/translate.c | 25 +++++++++++++------------
 2 files changed, 33 insertions(+), 12 deletions(-)

This reverts commit 823e1b3818f9b10b824ddcd756983b6e2fa68730,
which introduces a regression running EDK2 guest firmware
under KVM:

error: kvm run failed Function not implemented
 PC=000000013f5a6208 X00=00000000404003c4 X01=000000000000003a
X02=0000000000000000 X03=00000000404003c4 X04=0000000000000000
X05=0000000096000046 X06=000000013d2ef270 X07=000000013e3d1710
X08=09010755ffaf8ba8 X09=ffaf8b9cfeeb5468 X10=feeb546409010756
X11=09010757ffaf8b90 X12=feeb50680903068b X13=090306a1ffaf8bc0
X14=0000000000000000 X15=0000000000000000 X16=000000013f872da0
X17=00000000ffffa6ab X18=0000000000000000 X19=000000013f5a92d0
X20=000000013f5a7a78 X21=000000000000003a X22=000000013f5a7ab2
X23=000000013f5a92e8 X24=000000013f631090 X25=0000000000000010
X26=0000000000000100 X27=000000013f89501b X28=000000013e3d14e0
X29=000000013e3d12a0 X30=000000013f5a2518  SP=000000013b7be0b0
PSTATE=404003c4 -Z-- EL1t

with
[ 3507.926571] kvm [35042]: load/store instruction decoding not implemented
in the host dmesg.

Revert the change for the moment until we can investigate the
cause of the regression.

Reported-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |  9 +--------
 target/arm/helper.c  | 27 ++-------------------------
 target/arm/kvm32.c   | 20 ++++++++++++++++++--
 target/arm/kvm64.c   |  2 --
 target/arm/machine.c |  2 +-
 5 files changed, 22 insertions(+), 38 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
 /**
  * write_cpustate_to_list:
  * @cpu: ARMCPU
- * @kvm_sync: true if this is for syncing back to KVM
  *
  * For each register listed in the ARMCPU cpreg_indexes list, write
  * its value from the ARMCPUState structure into the cpreg_values list.
  * This is used to copy info from TCG's working data structures into
  * KVM or for outbound migration.
  *
- * @kvm_sync is true if we are doing this in order to sync the
- * register state back to KVM. In this case we will only update
- * values in the list if the previous list->cpustate sync actually
- * successfully wrote the CPU state. Otherwise we will keep the value
- * that is in the list.
- *
  * Returns: true if all register values were read correctly,
  * false if some register was unknown or could not be read.
  * Note that we do not stop early on failure -- we will attempt
  * reading all registers in the list.
  */
-bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
+bool write_cpustate_to_list(ARMCPU *cpu);
 
 #define ARM_CPUID_TI915T      0x54029152
 #define ARM_CPUID_TI925T      0x54029252
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
     return true;
 }
 
-bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
+bool write_cpustate_to_list(ARMCPU *cpu)
 {
     /* Write the coprocessor state from cpu->env to the (index,value) list. */
     int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
     for (i = 0; i < cpu->cpreg_array_len; i++) {
         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
         const ARMCPRegInfo *ri;
-        uint64_t newval;
 
         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
         if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
         if (ri->type & ARM_CP_NO_RAW) {
             continue;
         }
-
-        newval = read_raw_cp_reg(&cpu->env, ri);
-        if (kvm_sync) {
-            /*
-             * Only sync if the previous list->cpustate sync succeeded.
-             * Rather than tracking the success/failure state for every
-             * item in the list, we just recheck "does the raw write we must
-             * have made in write_list_to_cpustate() read back OK" here.
-             */
-            uint64_t oldval = cpu->cpreg_values[i];
-
-            if (oldval == newval) {
-                continue;
-            }
-
-            write_raw_cp_reg(&cpu->env, ri, oldval);
-            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
-                continue;
-            }
-
-            write_raw_cp_reg(&cpu->env, ri, newval);
-        }
-        cpu->cpreg_values[i] = newval;
+        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
     }
     return ok;
 }
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    write_cpustate_to_list(cpu, true);
-
+    /* Note that we do not call write_cpustate_to_list()
+     * here, so we are only writing the tuple list back to
+     * KVM. This is safe because nothing can change the
+     * CPUARMState cp15 fields (in particular gdb accesses cannot)
+     * and so there are no changes to sync. In fact syncing would
+     * be wrong at this point: for a constant register where TCG and
+     * KVM disagree about its value, the preceding write_list_to_cpustate()
+     * would not have had any effect on the CPUARMState value (since the
+     * register is read-only), and a write_cpustate_to_list() here would
+     * then try to write the TCG value back into KVM -- this would either
+     * fail or incorrectly change the value the guest sees.
+     *
+     * If we ever want to allow the user to modify cp15 registers via
+     * the gdb stub, we would need to be more clever here (for instance
+     * tracking the set of registers kvm_arch_get_registers() successfully
+     * managed to update the CPUARMState with, and only allowing those
+     * to be written back up into the kernel).
+     */
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    write_cpustate_to_list(cpu, true);
-
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
             abort();
         }
     } else {
-        if (!write_cpustate_to_list(cpu, false)) {
+        if (!write_cpustate_to_list(cpu)) {
             /* This should never fail. */
             abort();
         }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Note that float16_to_float32 rightly squashes SNaN to QNaN.
But of course pickNaNMulAdd, for ARM, selects SNaNs first.
So we have to preserve SNaN long enough for the correct NaN
to be selected.  Thus float16_to_float32_by_bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219222952.22183-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h     |   9 +++
 target/arm/vec_helper.c | 148 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 157 insertions(+)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_sqsub_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_5(gvec_sqsub_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 
+DEF_HELPER_FLAGS_5(gvec_fmlal_a32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_a64, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a32, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+DEF_HELPER_FLAGS_5(gvec_fmlal_idx_a64, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, i32)
+
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #include "helper-sve.h"
diff --git a/target/arm/vec_helper.c b/target/arm/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vec_helper.c
+++ b/target/arm/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_sqsub_d)(void *vd, void *vq, void *vn,
     }
     clear_tail(d, oprsz, simd_maxsz(desc));
 }
+
+/*
+ * Convert float16 to float32, raising no exceptions and
+ * preserving exceptional values, including SNaN.
+ * This is effectively an unpack+repack operation.
+ */
+static float32 float16_to_float32_by_bits(uint32_t f16, bool fz16)
+{
+    const int f16_bias = 15;
+    const int f32_bias = 127;
+    uint32_t sign = extract32(f16, 15, 1);
+    uint32_t exp = extract32(f16, 10, 5);
+    uint32_t frac = extract32(f16, 0, 10);
+
+    if (exp == 0x1f) {
+        /* Inf or NaN */
+        exp = 0xff;
+    } else if (exp == 0) {
+        /* Zero or denormal.  */
+        if (frac != 0) {
+            if (fz16) {
+                frac = 0;
+            } else {
+                /*
+                 * Denormal; these are all normal float32.
+                 * Shift the fraction so that the msb is at bit 11,
+                 * then remove bit 11 as the implicit bit of the
+                 * normalized float32.  Note that we still go through
+                 * the shift for normal numbers below, to put the
+                 * float32 fraction at the right place.
+                 */
+                int shift = clz32(frac) - 21;
+                frac = (frac << shift) & 0x3ff;
+                exp = f32_bias - f16_bias - shift + 1;
+            }
+        }
+    } else {
+        /* Normal number; adjust the bias.  */
+        exp += f32_bias - f16_bias;
+    }
+    sign <<= 31;
+    exp <<= 23;
+    frac <<= 23 - 10;
+
+    return sign | exp | frac;
+}
+
+static uint64_t load4_f16(uint64_t *ptr, int is_q, int is_2)
+{
+    /*
+     * Branchless load of u32[0], u64[0], u32[1], or u64[1].
+     * Load the 2nd qword iff is_q & is_2.
+     * Shift to the 2nd dword iff !is_q & is_2.
+     * For !is_q & !is_2, the upper bits of the result are garbage.
+     */
+    return ptr[is_q & is_2] >> ((is_2 & ~is_q) << 5);
+}
+
+/*
+ * Note that FMLAL requires oprsz == 8 or oprsz == 16,
+ * as there is not yet SVE versions that might use blocking.
+ */
+
+static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
+                     uint32_t desc, bool fz16)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    int is_q = oprsz == 16;
+    uint64_t n_4, m_4;
+
+    /* Pre-load all of the f16 data, avoiding overlap issues.  */
+    n_4 = load4_f16(vn, is_q, is_2);
+    m_4 = load4_f16(vm, is_q, is_2);
+
+    /* Negate all inputs for FMLSL at once.  */
+    if (is_s) {
+        n_4 ^= 0x8000800080008000ull;
+    }
+
+    for (i = 0; i < oprsz / 4; i++) {
+        float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
+        float32 m_1 = float16_to_float32_by_bits(m_4 >> (i * 16), fz16);
+        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+                            void *venv, uint32_t desc)
+{
+    CPUARMState *env = venv;
+    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+}
+
+void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                            void *venv, uint32_t desc)
+{
+    CPUARMState *env = venv;
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+}
+
+static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
+                         uint32_t desc, bool fz16)
+{
+    intptr_t i, oprsz = simd_oprsz(desc);
+    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    int index = extract32(desc, SIMD_DATA_SHIFT + 2, 3);
+    int is_q = oprsz == 16;
+    uint64_t n_4;
+    float32 m_1;
+
+    /* Pre-load all of the f16 data, avoiding overlap issues.  */
+    n_4 = load4_f16(vn, is_q, is_2);
+
+    /* Negate all inputs for FMLSL at once.  */
+    if (is_s) {
+        n_4 ^= 0x8000800080008000ull;
+    }
+
+    m_1 = float16_to_float32_by_bits(((float16 *)vm)[H2(index)], fz16);
+
+    for (i = 0; i < oprsz / 4; i++) {
+        float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
+        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
+    }
+    clear_tail(d, oprsz, simd_maxsz(desc));
+}
+
+void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+                                void *venv, uint32_t desc)
+{
+    CPUARMState *env = venv;
+    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+}
+
+void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                void *venv, uint32_t desc)
+{
+    CPUARMState *env = venv;
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+}
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219222952.22183-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  5 ++++
 target/arm/translate-a64.c | 49 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 53 insertions(+), 1 deletion(-)

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219222952.22183-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |   5 ++
 target/arm/translate.c | 129 ++++++++++++++++++++++++++++++-----------
 2 files changed, 101 insertions(+), 33 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_dp(const ARMISARegisters *id)
     return FIELD_EX32(id->id_isar6, ID_ISAR6, DP) != 0;
 }
 
+static inline bool isar_feature_aa32_fhm(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_isar6, ID_ISAR6, FHM) != 0;
+}
+
 static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
 {
     /*
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
     gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
     int rd, rn, rm, opr_sz;
     int data = 0;
-    bool q;
-
-    q = extract32(insn, 6, 1);
-    VFP_DREG_D(rd, insn);
-    VFP_DREG_N(rn, insn);
-    VFP_DREG_M(rm, insn);
-    if ((rd | rn | rm) & q) {
-        return 1;
-    }
+    int off_rn, off_rm;
+    bool is_long = false, q = extract32(insn, 6, 1);
+    bool ptr_is_env = false;
 
     if ((insn & 0xfe200f10) == 0xfc200800) {
         /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
             return 1;
         }
         fn_gvec = u ? gen_helper_gvec_udot_b : gen_helper_gvec_sdot_b;
+    } else if ((insn & 0xff300f10) == 0xfc200810) {
+        /* VFM[AS]L -- 1111 1100 S.10 .... .... 1000 .Q.1 .... */
+        int is_s = extract32(insn, 23, 1);
+        if (!dc_isar_feature(aa32_fhm, s)) {
+            return 1;
+        }
+        is_long = true;
+        data = is_s; /* is_2 == 0 */
+        fn_gvec_ptr = gen_helper_gvec_fmlal_a32;
+        ptr_is_env = true;
     } else {
         return 1;
     }
 
+    VFP_DREG_D(rd, insn);
+    if (rd & q) {
+        return 1;
+    }
+    if (q || !is_long) {
+        VFP_DREG_N(rn, insn);
+        VFP_DREG_M(rm, insn);
+        if ((rn | rm) & q & !is_long) {
+            return 1;
+        }
+        off_rn = vfp_reg_offset(1, rn);
+        off_rm = vfp_reg_offset(1, rm);
+    } else {
+        rn = VFP_SREG_N(insn);
+        rm = VFP_SREG_M(insn);
+        off_rn = vfp_reg_offset(0, rn);
+        off_rm = vfp_reg_offset(0, rm);
+    }
+
     if (s->fp_excp_el) {
         gen_exception_insn(s, 4, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
 
     opr_sz = (1 + q) * 8;
     if (fn_gvec_ptr) {
-        TCGv_ptr fpst = get_fpstatus_ptr(1);
-        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
-                           vfp_reg_offset(1, rn),
-                           vfp_reg_offset(1, rm), fpst,
+        TCGv_ptr ptr;
+        if (ptr_is_env) {
+            ptr = cpu_env;
+        } else {
+            ptr = get_fpstatus_ptr(1);
+        }
+        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
                            opr_sz, opr_sz, data, fn_gvec_ptr);
-        tcg_temp_free_ptr(fpst);
+        if (!ptr_is_env) {
+            tcg_temp_free_ptr(ptr);
+        }
     } else {
-        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd),
-                           vfp_reg_offset(1, rn),
-                           vfp_reg_offset(1, rm),
+        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
                            opr_sz, opr_sz, data, fn_gvec);
     }
     return 0;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
     gen_helper_gvec_3 *fn_gvec = NULL;
     gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
     int rd, rn, rm, opr_sz, data;
-    bool q;
-
-    q = extract32(insn, 6, 1);
-    VFP_DREG_D(rd, insn);
-    VFP_DREG_N(rn, insn);
-    if ((rd | rn) & q) {
-        return 1;
-    }
+    int off_rn, off_rm;
+    bool is_long = false, q = extract32(insn, 6, 1);
+    bool ptr_is_env = false;
 
     if ((insn & 0xff000f10) == 0xfe000800) {
         /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
     } else if ((insn & 0xffb00f00) == 0xfe200d00) {
         /* V[US]DOT -- 1111 1110 0.10 .... .... 1101 .Q.U .... */
         int u = extract32(insn, 4, 1);
+
         if (!dc_isar_feature(aa32_dp, s)) {
             return 1;
         }
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
         /* rm is just Vm, and index is M.  */
         data = extract32(insn, 5, 1); /* index */
         rm = extract32(insn, 0, 4);
+    } else if ((insn & 0xffa00f10) == 0xfe000810) {
+        /* VFM[AS]L -- 1111 1110 0.0S .... .... 1000 .Q.1 .... */
+        int is_s = extract32(insn, 20, 1);
+        int vm20 = extract32(insn, 0, 3);
+        int vm3 = extract32(insn, 3, 1);
+        int m = extract32(insn, 5, 1);
+        int index;
+
+        if (!dc_isar_feature(aa32_fhm, s)) {
+            return 1;
+        }
+        if (q) {
+            rm = vm20;
+            index = m * 2 + vm3;
+        } else {
+            rm = vm20 * 2 + m;
+            index = vm3;
+        }
+        is_long = true;
+        data = (index << 2) | is_s; /* is_2 == 0 */
+        fn_gvec_ptr = gen_helper_gvec_fmlal_idx_a32;
+        ptr_is_env = true;
     } else {
         return 1;
     }
 
+    VFP_DREG_D(rd, insn);
+    if (rd & q) {
+        return 1;
+    }
+    if (q || !is_long) {
+        VFP_DREG_N(rn, insn);
+        if (rn & q & !is_long) {
+            return 1;
+        }
+        off_rn = vfp_reg_offset(1, rn);
+        off_rm = vfp_reg_offset(1, rm);
+    } else {
+        rn = VFP_SREG_N(insn);
+        off_rn = vfp_reg_offset(0, rn);
+        off_rm = vfp_reg_offset(0, rm);
+    }
     if (s->fp_excp_el) {
         gen_exception_insn(s, 4, EXCP_UDEF,
                            syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
 
     opr_sz = (1 + q) * 8;
     if (fn_gvec_ptr) {
-        TCGv_ptr fpst = get_fpstatus_ptr(1);
-        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd),
-                           vfp_reg_offset(1, rn),
-                           vfp_reg_offset(1, rm), fpst,
+        TCGv_ptr ptr;
+        if (ptr_is_env) {
+            ptr = cpu_env;
+        } else {
+            ptr = get_fpstatus_ptr(1);
+        }
+        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
                            opr_sz, opr_sz, data, fn_gvec_ptr);
-        tcg_temp_free_ptr(fpst);
+        if (!ptr_is_env) {
+            tcg_temp_free_ptr(ptr);
+        }
     } else {
-        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd),
-                           vfp_reg_offset(1, rn),
-                           vfp_reg_offset(1, rm),
+        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
                            opr_sz, opr_sz, data, fn_gvec);
     }
     return 0;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190219222952.22183-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c   | 1 +
 target/arm/cpu64.c | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
             t = cpu->isar.id_isar6;
             t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
             t = FIELD_DP32(t, ID_ISAR6, DP, 1);
+            t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
             cpu->isar.id_isar6 = t;
 
             t = cpu->id_mmfr4;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);
         t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);
         t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);
+        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);
         cpu->isar.id_aa64isar0 = t;
 
         t = cpu->isar.id_aa64isar1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         u = cpu->isar.id_isar6;
         u = FIELD_DP32(u, ID_ISAR6, JSCVT, 1);
         u = FIELD_DP32(u, ID_ISAR6, DP, 1);
+        u = FIELD_DP32(u, ID_ISAR6, FHM, 1);
         cpu->isar.id_isar6 = u;
 
         /*
-- 
2.20.1