Series comparison

-[Qemu-devel] [PULL 00/21] target-arm queue
+[Qemu-devel] [PULL 00/16] target-arm queue
-target-arm queue: mostly just cleanup/minor stuff, but this does
+The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
 include the raspi3 board model.
--- PMM
+  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
 The following changes since commit 9f9c53368b219a9115eddb39f0ff5ad19c977134:
   Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-2.12-pull-request' into staging (2018-02-15 10:14:11 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180215
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
-for you to fetch changes up to e545f0f9be1f9e60951017c1e6558216732cc14e:
+for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
-  target/arm: Implement v8M MSPLIM and PSPLIM registers (2018-02-15 13:48:11 +0000)
+  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * aspeed: code cleanup to use unimplemented_device
+ * Fix coverity nit in int_to_float code
- * add 'raspi3' RaspberryPi 3 machine model
+ * Don't set Invalid for float-to-int(MAXINT)
- * more SVE prep work
+ * Fix fp_status_f16 tininess before rounding
- * v8M: add minor missing registers
+ * Add various missing insns from the v8.2-FP16 extension
- * v7M: fix bug where we weren't migrating v7m.other_sp
+ * Fix sqrt_f16 exception raising
- * v7M: fix bugs in handling of interrupt registers for
+ * sdcard: Correct CRC16 offset in sd_function_switch()
-   external interrupts beyond 32
+ * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Pekka Enberg (3):
+Alex Bennée (5):
-      bcm2836: Make CPU type configurable
+      fpu/softfloat: int_to_float ensure r fully initialised
-      raspi: Raspberry Pi 3 support
+      target/arm: Implement FCMP for fp16
-      raspi: Add "raspi3" machine type
+      target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Peter Maydell (11):
+Peter Maydell (3):
-      hw/intc/armv7m_nvic: Don't hardcode M profile ID registers in NVIC
+      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-      hw/intc/armv7m_nvic: Fix ICSR PENDNMISET/CLR handling
+      target/arm: Fix fp_status_f16 tininess before rounding
-      hw/intc/armv7m_nvic: Implement M profile cache maintenance ops
+      tcg: Optionally log FPU state in TCG -d cpu logging
       hw/intc/armv7m_nvic: Implement v8M CPPWR register
       hw/intc/armv7m_nvic: Implement cache ID registers
       hw/intc/armv7m_nvic: Implement SCR
       target/arm: Implement writing to CONTROL_NS for v8M
       hw/intc/armv7m_nvic: Fix byte-to-interrupt number conversions
       target/arm: Add AIRCR to vmstate struct
       target/arm: Migrate v7m.other_sp
       target/arm: Implement v8M MSPLIM and PSPLIM registers
-Philippe Mathieu-Daudé (2):
+Philippe Mathieu-Daudé (1):
-      hw/arm/aspeed: directly map the serial device to the system address space
+      sdcard: Correct CRC16 offset in sd_function_switch()
       hw/arm/aspeed: simplify using the 'unimplemented device' for aspeed_soc.io
-Richard Henderson (5):
+Richard Henderson (7):
-      target/arm: Remove ARM_CP_64BIT from ZCR_EL registers
+      target/arm: Implement FMOV (general) for fp16
-      target/arm: Enforce FP access to FPCR/FPSR
+      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
-      target/arm: Suppress TB end for FPCR/FPSR
+      target/arm: Implement FCVT (scalar, integer) for fp16
-      target/arm: Enforce access to ZCR_EL at translation
+      target/arm: Implement FCVT (scalar, fixed-point) for fp16
-      target/arm: Handle SVE registers when using clear_vec_high
+      target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
- include/hw/arm/aspeed_soc.h |   1 -
+ include/qemu/log.h         |   1 +
- include/hw/arm/bcm2836.h    |   1 +
+ target/arm/helper-a64.h    |   2 +
- target/arm/cpu.h            |  71 ++++++++++++-----
+ target/arm/helper.h        |   6 +
- target/arm/internals.h      |   6 ++
+ accel/tcg/cpu-exec.c       |   9 +-
- hw/arm/aspeed_soc.c         |  35 ++-------
+ fpu/softfloat.c            |   6 +-
- hw/arm/bcm2836.c            |  17 +++--
+ hw/sd/sd.c                 |   2 +-
- hw/arm/raspi.c              |  57 +++++++++++---
+ target/arm/cpu.c           |   2 +
- hw/intc/armv7m_nvic.c       |  98 ++++++++++++++++++------
+ target/arm/helper-a64.c    |  10 ++
- target/arm/cpu.c            |  28 +++++++
+ target/arm/helper.c        |  38 +++-
- target/arm/helper.c         |  84 +++++++++++++++-----
+ target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
- target/arm/machine.c        |  84 ++++++++++++++++++++
+ util/log.c                 |   2 +
- target/arm/translate-a64.c  | 181 ++++++++++++++++++++------------------------
+files changed, 428 insertions(+), 71 deletions(-)
 files changed, 452 insertions(+), 211 deletions(-)

-[Qemu-devel] [PULL 21/21] target/arm: Implement v8M MSPLIM and PSPLIM registers
+[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
-The v8M architecture includes hardware support for enforcing
+From: Alex Bennée <alex.bennee@linaro.org>
 stack pointer limits. We don't implement this behaviour yet,
 but provide the MSPLIM and PSPLIM stack pointer limit registers
 as reads-as-written, so that when we do implement the checks
 in future this won't break guest migration.
+Reported by Coverity (CID1390635). We ensure this for uint_to_float
+later on so we might as well mirror that.
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-12-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |  2 ++
+ fpu/softfloat.c | 2 +-
- target/arm/helper.c  | 46 ++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/machine.c | 21 +++++++++++++++++++++
 files changed, 69 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/fpu/softfloat.c
-+++ b/target/arm/cpu.h
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
-         uint32_t csselr[M_REG_NUM_BANKS];
+ static FloatParts int_to_float(int64_t a, float_status *status)
-         uint32_t scr[M_REG_NUM_BANKS];
+ {
-+        uint32_t msplim[M_REG_NUM_BANKS];
+-    FloatParts r;
-+        uint32_t psplim[M_REG_NUM_BANKS];
++    FloatParts r = {};
-     } v7m;
+     if (a == 0) {
+         r.cls = float_class_zero;
-     /* Information associated with an exception about to be taken:
+         r.sign = false;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
                  return 0;
              }
              return env->v7m.other_ss_psp;
 +        case 0x8a: /* MSPLIM_NS */
 +            if (!env->v7m.secure) {
 +                return 0;
 +            }
 +            return env->v7m.msplim[M_REG_NS];
 +        case 0x8b: /* PSPLIM_NS */
 +            if (!env->v7m.secure) {
 +                return 0;
 +            }
 +            return env->v7m.psplim[M_REG_NS];
          case 0x90: /* PRIMASK_NS */
              if (!env->v7m.secure) {
                  return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
          return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
      case 9: /* PSP */
          return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
 +    case 10: /* MSPLIM */
 +        if (!arm_feature(env, ARM_FEATURE_V8)) {
 +            goto bad_reg;
 +        }
 +        return env->v7m.msplim[env->v7m.secure];
 +    case 11: /* PSPLIM */
 +        if (!arm_feature(env, ARM_FEATURE_V8)) {
 +            goto bad_reg;
 +        }
 +        return env->v7m.psplim[env->v7m.secure];
      case 16: /* PRIMASK */
          return env->v7m.primask[env->v7m.secure];
      case 17: /* BASEPRI */
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
      case 19: /* FAULTMASK */
          return env->v7m.faultmask[env->v7m.secure];
      default:
 +    bad_reg:
          qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
                                         " register %d\n", reg);
          return 0;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              }
              env->v7m.other_ss_psp = val;
              return;
 +        case 0x8a: /* MSPLIM_NS */
 +            if (!env->v7m.secure) {
 +                return;
 +            }
 +            env->v7m.msplim[M_REG_NS] = val & ~7;
 +            return;
 +        case 0x8b: /* PSPLIM_NS */
 +            if (!env->v7m.secure) {
 +                return;
 +            }
 +            env->v7m.psplim[M_REG_NS] = val & ~7;
 +            return;
          case 0x90: /* PRIMASK_NS */
              if (!env->v7m.secure) {
                  return;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              env->v7m.other_sp = val;
          }
          break;
 +    case 10: /* MSPLIM */
 +        if (!arm_feature(env, ARM_FEATURE_V8)) {
 +            goto bad_reg;
 +        }
 +        env->v7m.msplim[env->v7m.secure] = val & ~7;
 +        break;
 +    case 11: /* PSPLIM */
 +        if (!arm_feature(env, ARM_FEATURE_V8)) {
 +            goto bad_reg;
 +        }
 +        env->v7m.psplim[env->v7m.secure] = val & ~7;
 +        break;
      case 16: /* PRIMASK */
          env->v7m.primask[env->v7m.secure] = val & 1;
          break;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
          env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
          break;
      default:
 +    bad_reg:
          qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
                                         " register %d\n", reg);
          return;
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_other_sp = {
      }
  };
 +static bool m_v8m_needed(void *opaque)
 +{
 +    ARMCPU *cpu = opaque;
 +    CPUARMState *env = &cpu->env;
 +
 +    return arm_feature(env, ARM_FEATURE_M) && arm_feature(env, ARM_FEATURE_V8);
 +}
 +
 +static const VMStateDescription vmstate_m_v8m = {
 +    .name = "cpu/m/v8m",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = m_v8m_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(env.v7m.msplim, ARMCPU, M_REG_NUM_BANKS),
 +        VMSTATE_UINT32_ARRAY(env.v7m.psplim, ARMCPU, M_REG_NUM_BANKS),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_m = {
      .name = "cpu/m",
      .version_id = 4,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
          &vmstate_m_csselr,
          &vmstate_m_scr,
          &vmstate_m_other_sp,
 +        &vmstate_m_v8m,
          NULL
      }
  };
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 20/21] target/arm: Migrate v7m.other_sp
+[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
-In commit abc24d86cc0364f we accidentally broke migration of
+In float-to-integer conversion, if the floating point input
-the stack pointer value for the mode (process, handler) the CPU
+converts exactly to the largest or smallest integer that
-is not currently running as. (The commit correctly removed the
+fits in to the result type, this is not an overflow.
-no-longer-used v7m.current_sp flag from the VMState but also
+In this situation we were producing the correct result value,
-deleted the still very much in use v7m.other_sp SP value field.)
+but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Add a subsection to migrate it again. (We don't need to care
+Fix the boundary case to take the right half of the if()
-about trying to retain compatibility with pre-abc24d86cc0364f
+statements.
 versions of QEMU, because that commit bumped the version_id
 and we've since bumped it again a couple of times.)
+This fixes a regression from 2.11 introduced by the softfloat
+refactoring.
+Cc: qemu-stable@nongnu.org
+Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-11-peter.maydell@linaro.org
+Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
 ---
- target/arm/machine.c | 11 +++++++++++
+ fpu/softfloat.c | 4 ++--
-file changed, 11 insertions(+)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/fpu/softfloat.c
-+++ b/target/arm/machine.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_scr = {
+@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
-     }
+             r = UINT64_MAX;
- };
+         }
+         if (p.sign) {
-+static const VMStateDescription vmstate_m_other_sp = {
+-            if (r < -(uint64_t) min) {
-+    .name = "cpu/m/other-sp",
++            if (r <= -(uint64_t) min) {
-+    .version_id = 1,
+                 return -r;
-+    .minimum_version_id = 1,
+             } else {
-+    .fields = (VMStateField[]) {
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
-+        VMSTATE_UINT32(env.v7m.other_sp, ARMCPU),
+                 return min;
-+        VMSTATE_END_OF_LIST()
+             }
-+    }
+         } else {
-+};
+-            if (r < max) {
-+
++            if (r <= max) {
- static const VMStateDescription vmstate_m = {
+                 return r;
-     .name = "cpu/m",
+             } else {
-     .version_id = 4,
+                 s->float_exception_flags = orig_flags | float_flag_invalid;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
          &vmstate_m_faultmask_primask,
          &vmstate_m_csselr,
          &vmstate_m_scr,
 +        &vmstate_m_other_sp,
          NULL
      }
  };
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 11/21] hw/intc/armv7m_nvic: Don't hardcode M profile ID registers in NVIC
+[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
-Instead of hardcoding the values of M profile ID registers in the
+In commit d81ce0ef2c4f105 we added an extra float_status field
-NVIC, use the fields in the CPU struct. This will allow us to
+fp_status_fp16 for Arm, but forgot to initialize it correctly
-give different M profile CPU types different ID register values.
+by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-This commit includes the addition of the missing ID_ISAR5,
+Add the missing initialization.
 which exists as RES0 in both v7M and v8M.
-(The values of the ID registers might be wrong for the M4 --
+Fixes: d81ce0ef2c4f105
-this commit leaves the behaviour there unchanged.)
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
  target/arm/cpu.c | 2 ++
 file changed, 2 insertions(+)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-2-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 30 ++++++++++++++++--------------
- target/arm/cpu.c      | 28 ++++++++++++++++++++++++++++
-files changed, 44 insertions(+), 14 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-                       "Aux Fault status registers unimplemented\n");
-         return 0;
-     case 0xd40: /* PFR0.  */
--        return 0x00000030;
--    case 0xd44: /* PRF1.  */
--        return 0x00000200;
-+        return cpu->id_pfr0;
-+    case 0xd44: /* PFR1.  */
-+        return cpu->id_pfr1;
-     case 0xd48: /* DFR0.  */
--        return 0x00100000;
-+        return cpu->id_dfr0;
-     case 0xd4c: /* AFR0.  */
--        return 0x00000000;
-+        return cpu->id_afr0;
-     case 0xd50: /* MMFR0.  */
--        return 0x00000030;
-+        return cpu->id_mmfr0;
-     case 0xd54: /* MMFR1.  */
--        return 0x00000000;
-+        return cpu->id_mmfr1;
-     case 0xd58: /* MMFR2.  */
--        return 0x00000000;
-+        return cpu->id_mmfr2;
-     case 0xd5c: /* MMFR3.  */
--        return 0x00000000;
-+        return cpu->id_mmfr3;
-     case 0xd60: /* ISAR0.  */
--        return 0x01141110;
-+        return cpu->id_isar0;
-     case 0xd64: /* ISAR1.  */
--        return 0x02111000;
-+        return cpu->id_isar1;
-     case 0xd68: /* ISAR2.  */
--        return 0x21112231;
-+        return cpu->id_isar2;
-     case 0xd6c: /* ISAR3.  */
--        return 0x01111110;
-+        return cpu->id_isar3;
-     case 0xd70: /* ISAR4.  */
--        return 0x01310102;
-+        return cpu->id_isar4;
-+    case 0xd74: /* ISAR5.  */
-+        return cpu->id_isar5;
-     /* TODO: Implement debug registers.  */
-     case 0xd90: /* MPU_TYPE */
-         /* Unified MPU; if the MPU is not present this value is zero */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-     set_feature(&cpu->env, ARM_FEATURE_M);
+                               &env->vfp.fp_status);
-     cpu->midr = 0x410fc231;
+     set_float_detect_tininess(float_tininess_before_rounding,
-     cpu->pmsav7_dregion = 8;
+                               &env->vfp.standard_fp_status);
-+    cpu->id_pfr0 = 0x00000030;
++    set_float_detect_tininess(float_tininess_before_rounding,
-+    cpu->id_pfr1 = 0x00000200;
++                              &env->vfp.fp_status_f16);
-+    cpu->id_dfr0 = 0x00100000;
+ #ifndef CONFIG_USER_ONLY
-+    cpu->id_afr0 = 0x00000000;
+     if (kvm_enabled()) {
-+    cpu->id_mmfr0 = 0x00000030;
+         kvm_arm_reset_vcpu(cpu);
 +    cpu->id_mmfr1 = 0x00000000;
 +    cpu->id_mmfr2 = 0x00000000;
 +    cpu->id_mmfr3 = 0x00000000;
 +    cpu->id_isar0 = 0x01141110;
 +    cpu->id_isar1 = 0x02111000;
 +    cpu->id_isar2 = 0x21112231;
 +    cpu->id_isar3 = 0x01111110;
 +    cpu->id_isar4 = 0x01310102;
 +    cpu->id_isar5 = 0x00000000;
  }
  static void cortex_m4_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
      cpu->midr = 0x410fc240; /* r0p0 */
      cpu->pmsav7_dregion = 8;
 +    cpu->id_pfr0 = 0x00000030;
 +    cpu->id_pfr1 = 0x00000200;
 +    cpu->id_dfr0 = 0x00100000;
 +    cpu->id_afr0 = 0x00000000;
 +    cpu->id_mmfr0 = 0x00000030;
 +    cpu->id_mmfr1 = 0x00000000;
 +    cpu->id_mmfr2 = 0x00000000;
 +    cpu->id_mmfr3 = 0x00000000;
 +    cpu->id_isar0 = 0x01141110;
 +    cpu->id_isar1 = 0x02111000;
 +    cpu->id_isar2 = 0x21112231;
 +    cpu->id_isar3 = 0x01111110;
 +    cpu->id_isar4 = 0x01310102;
 +    cpu->id_isar5 = 0x00000000;
  }
  static void arm_v7m_class_init(ObjectClass *oc, void *data)
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 08/21] target/arm: Suppress TB end for FPCR/FPSR
+[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
 From: Richard Henderson <richard.henderson@linaro.org>
-Nothing in either register affects the TB.
+Adding the fp16 moves to/from general registers.
+Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180211205848.4568-4-richard.henderson@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 4 ++--
+ target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 21 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
-     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
+             clear_vec_high(s, true, rd);
-       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
+             break;
--      .access = PL0_RW, .type = ARM_CP_FPU,
++        case 3:
-+      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
++            /* 16 bit */
-       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
++            tmp = tcg_temp_new_i64();
-     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
++            tcg_gen_ext16u_i64(tmp, tcg_rn);
-       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
++            write_fp_dreg(s, rd, tmp);
--      .access = PL0_RW, .type = ARM_CP_FPU,
++            tcg_temp_free_i64(tmp);
-+      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
++            break;
-       .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
++        default:
-     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
++            g_assert_not_reached();
-       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
+         }
      } else {
          TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          case 0xa: /* 64 bit */
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 06/21] target/arm: Remove ARM_CP_64BIT from ZCR_EL registers
+[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
 From: Richard Henderson <richard.henderson@linaro.org>
-Because they are ARM_CP_STATE_AA64, ARM_CP_64BIT is implied.
+No sense in emitting code after the exception.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180211205848.4568-2-richard.henderson@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 8 ++++----
+ target/arm/translate-a64.c | 2 +-
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
- static const ARMCPRegInfo zcr_el1_reginfo = {
+         default:
-     .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
+             /* all other sf/type/rmode combinations are invalid */
-     .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
+             unallocated_encoding(s);
--    .access = PL1_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
+-            break;
-+    .access = PL1_RW, .accessfn = zcr_access,
++            return;
-     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
+         }
-     .writefn = zcr_write, .raw_writefn = raw_write
- };
+         if (!fp_access_check(s)) {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el1_reginfo = {
  static const ARMCPRegInfo zcr_el2_reginfo = {
      .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL2_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
 +    .access = PL2_RW, .accessfn = zcr_access,
      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
      .writefn = zcr_write, .raw_writefn = raw_write
  };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el2_reginfo = {
  static const ARMCPRegInfo zcr_no_el2_reginfo = {
      .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL2_RW, .type = ARM_CP_64BIT,
 +    .access = PL2_RW,
      .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
  };
  static const ARMCPRegInfo zcr_el3_reginfo = {
      .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL3_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
 +    .access = PL3_RW, .accessfn = zcr_access,
      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
      .writefn = zcr_write, .raw_writefn = raw_write
  };
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 07/21] target/arm: Enforce FP access to FPCR/FPSR
+[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
 From: Richard Henderson <richard.henderson@linaro.org>
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180211205848.4568-3-richard.henderson@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h           | 35 ++++++++++++++++++-----------------
+ target/arm/helper.h        |  6 +++
- target/arm/helper.c        |  6 ++++--
+ target/arm/helper.c        | 38 ++++++++++++++-
- target/arm/translate-a64.c |  3 +++
+ target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
-files changed, 25 insertions(+), 19 deletions(-)
+files changed, 122 insertions(+), 18 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
- }
+ DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+ DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
- /* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
+ DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
-- * special-behaviour cp reg and bits [15..8] indicate what behaviour
++DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
-+ * special-behaviour cp reg and bits [11..8] indicate what behaviour
++DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
-  * it has. Otherwise it is a simple cp reg, where CONST indicates that
++DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
-  * TCG can assume the value to be constant (ie load at translate time)
++DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
-  * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
+ DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+ DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
-  * need to be surrounded by gen_io_start()/gen_io_end(). In particular,
+ DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
-  * registers which implement clocks or timers require this.
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
-  */
+ DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
--#define ARM_CP_SPECIAL 1
+ DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
--#define ARM_CP_CONST 2
+ DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
--#define ARM_CP_64BIT 4
++DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
--#define ARM_CP_SUPPRESS_TB_END 8
++DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
--#define ARM_CP_OVERRIDE 16
--#define ARM_CP_ALIAS 32
+ DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
--#define ARM_CP_IO 64
+ DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 -#define ARM_CP_NO_RAW 128
 -#define ARM_CP_NOP (ARM_CP_SPECIAL | (1 << 8))
 -#define ARM_CP_WFI (ARM_CP_SPECIAL | (2 << 8))
 -#define ARM_CP_NZCV (ARM_CP_SPECIAL | (3 << 8))
 -#define ARM_CP_CURRENTEL (ARM_CP_SPECIAL | (4 << 8))
 -#define ARM_CP_DC_ZVA (ARM_CP_SPECIAL | (5 << 8))
 -#define ARM_LAST_SPECIAL ARM_CP_DC_ZVA
 +#define ARM_CP_SPECIAL           0x0001
 +#define ARM_CP_CONST             0x0002
 +#define ARM_CP_64BIT             0x0004
 +#define ARM_CP_SUPPRESS_TB_END   0x0008
 +#define ARM_CP_OVERRIDE          0x0010
 +#define ARM_CP_ALIAS             0x0020
 +#define ARM_CP_IO                0x0040
 +#define ARM_CP_NO_RAW            0x0080
 +#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
 +#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
 +#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
 +#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
 +#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
 +#define ARM_LAST_SPECIAL         ARM_CP_DC_ZVA
 +#define ARM_CP_FPU               0x1000
  /* Used only as a terminator for ARMCPRegInfo lists */
 -#define ARM_CP_SENTINEL 0xffff
 +#define ARM_CP_SENTINEL          0xffff
  /* Mask of only the flag bits in a type field */
 -#define ARM_CP_FLAG_MASK 0xff
 +#define ARM_CP_FLAG_MASK         0x10ff
  /* Valid values for ARMCPRegInfo state field, indicating which of
   * the AArch32 and AArch64 execution states this register is visible in.
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
-       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
+ #undef VFP_CONV_FIX_A64
-     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
-       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
+ /* Conversion to/from f16 can overflow to infinity before/after scaling.
--      .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
+- * Therefore we convert to f64 (which does not round), scale,
-+      .access = PL0_RW, .type = ARM_CP_FPU,
+- * and then convert f64 to f16 (which may round).
-+      .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
++ * Therefore we convert to f64, scale, and then convert f64 to f16; or
-     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
++ * vice versa for conversion to integer.
-       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
++ *
--      .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
++ * For 16- and 32-bit integers, the conversion to f64 never rounds.
-+      .access = PL0_RW, .type = ARM_CP_FPU,
++ * For 64-bit integers, any integer that would cause rounding will also
-+      .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
++ * overflow to f16 infinity, so there is no double rounding problem.
-     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
+  */
-       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
-       .access = PL0_R, .type = ARM_CP_NO_RAW,
+ static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
+@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
-     default:
+                            bool itof, int rmode, int scale, int sf, int type)
-         break;
+ {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
-+    if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
-+        return;
+     tcg_temp_free_ptr(tcg_fpstatus);
-+    }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+         /* actual FP conversions */
-     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
+         bool itof = extract32(opcode, 1, 1);
-         gen_io_start();
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 09/21] target/arm: Enforce access to ZCR_EL at translation
+[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
 From: Richard Henderson <richard.henderson@linaro.org>
-This also makes sure that we get the correct ordering of
+Cc: qemu-stable@nongnu.org
-SVE vs FP exceptions.
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180211205848.4568-5-richard.henderson@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h           |  3 ++-
+ target/arm/translate-a64.c | 17 +++++++++++++++--
- target/arm/internals.h     |  6 ++++++
+file changed, 15 insertions(+), 2 deletions(-)
  target/arm/helper.c        | 22 ++++------------------
  target/arm/translate-a64.c | 16 ++++++++++++++++
 files changed, 28 insertions(+), 19 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
- #define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
- #define ARM_LAST_SPECIAL         ARM_CP_DC_ZVA
- #define ARM_CP_FPU               0x1000
-+#define ARM_CP_SVE               0x2000
- /* Used only as a terminator for ARMCPRegInfo lists */
- #define ARM_CP_SENTINEL          0xffff
- /* Mask of only the flag bits in a type field */
--#define ARM_CP_FLAG_MASK         0x10ff
-+#define ARM_CP_FLAG_MASK         0x30ff
- /* Valid values for ARMCPRegInfo state field, indicating which of
-  * the AArch32 and AArch64 execution states this register is visible in.
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
-     EC_AA64_HVC               = 0x16,
-     EC_AA64_SMC               = 0x17,
-     EC_SYSTEMREGISTERTRAP     = 0x18,
-+    EC_SVEACCESSTRAP          = 0x19,
-     EC_INSNABORT              = 0x20,
-     EC_INSNABORT_SAME_EL      = 0x21,
-     EC_PCALIGNMENT            = 0x22,
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
-         | (cv << 24) | (cond << 20);
- }
-+static inline uint32_t syn_sve_access_trap(void)
-+{
-+    return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
-+}
-+
- static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
- {
-     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int sve_exception_el(CPUARMState *env)
-     return 0;
- }
--static CPAccessResult zcr_access(CPUARMState *env, const ARMCPRegInfo *ri,
--                                 bool isread)
--{
--    switch (sve_exception_el(env)) {
--    case 3:
--        return CP_ACCESS_TRAP_EL3;
--    case 2:
--        return CP_ACCESS_TRAP_EL2;
--    case 1:
--        return CP_ACCESS_TRAP;
--    }
--    return CP_ACCESS_OK;
--}
--
- static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                       uint64_t value)
- {
-@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- static const ARMCPRegInfo zcr_el1_reginfo = {
-     .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
-     .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
--    .access = PL1_RW, .accessfn = zcr_access,
-+    .access = PL1_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
-     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
-     .writefn = zcr_write, .raw_writefn = raw_write
- };
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el1_reginfo = {
- static const ARMCPRegInfo zcr_el2_reginfo = {
-     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
-     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
--    .access = PL2_RW, .accessfn = zcr_access,
-+    .access = PL2_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
-     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
-     .writefn = zcr_write, .raw_writefn = raw_write
- };
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el2_reginfo = {
- static const ARMCPRegInfo zcr_no_el2_reginfo = {
-     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
-     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
--    .access = PL2_RW,
-+    .access = PL2_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
-     .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
- };
- static const ARMCPRegInfo zcr_el3_reginfo = {
-     .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
-     .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
--    .access = PL3_RW, .accessfn = zcr_access,
-+    .access = PL3_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
-     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
-     .writefn = zcr_write, .raw_writefn = raw_write
- };
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
-     return false;
+     bool sf = extract32(insn, 31, 1);
- }
+     bool itof;
-+/* Check that SVE access is enabled.  If it is, return true.
+-    if (sbit || (type > 1)
-+ * If not, emit code to generate an appropriate exception and return false.
+-        || (!sf && scale < 32)) {
-+ */
++    if (sbit || (!sf && scale < 32)) {
-+static inline bool sve_access_check(DisasContext *s)
++        unallocated_encoding(s);
 +{
 +    if (s->sve_excp_el) {
 +        gen_exception_insn(s, 4, EXCP_UDEF, syn_sve_access_trap(),
 +                           s->sve_excp_el);
 +        return false;
 +    }
 +    return true;
 +}
 +
  /*
   * This utility function is for doing register extension with an
   * optional shift. You will likely want to pass a temporary for the
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
      default:
          break;
      }
 +    if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
 +        return;
 +    }
-     if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
++
 +    switch (type) {
 +    case 0: /* float32 */
 +    case 1: /* float64 */
 +        break;
 +    case 3: /* float16 */
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 10/21] target/arm: Handle SVE registers when using clear_vec_high
+[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
 From: Richard Henderson <richard.henderson@linaro.org>
-When storing to an AdvSIMD FP register, all of the high
+Cc: qemu-stable@nongnu.org
-bits of the SVE register are zeroed.  Therefore, call it
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 more often with is_q as a parameter.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180211205848.4568-6-richard.henderson@linaro.org
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 162 +++++++++++++++++----------------------------
+ target/arm/translate-a64.c | 30 ++++++++++++++----------------
-file changed, 62 insertions(+), 100 deletions(-)
+file changed, 14 insertions(+), 16 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
 @@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
      return v;
  }
-+/* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
++static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
 + * If SVE is not enabled, then there are only 128 bits in the vector.
 + */
 +static void clear_vec_high(DisasContext *s, bool is_q, int rd)
 +{
-+    unsigned ofs = fp_reg_offset(s, rd, MO_64);
++    TCGv_i32 v = tcg_temp_new_i32();
 +    unsigned vsz = vec_full_reg_size(s);
 +
-+    if (!is_q) {
++    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
-+        TCGv_i64 tcg_zero = tcg_const_i64(0);
++    return v;
 +        tcg_gen_st_i64(tcg_zero, cpu_env, ofs + 8);
 +        tcg_temp_free_i64(tcg_zero);
 +    }
 +    if (vsz > 16) {
 +        tcg_gen_gvec_dup8i(ofs + 16, vsz - 16, vsz - 16, 0);
 +    }
 +}
 +
- static void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v)
+ /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
--    TCGv_i64 tcg_zero = tcg_const_i64(0);
+     TCGv_ptr fpst = NULL;
-+    unsigned ofs = fp_reg_offset(s, reg, MO_64);
+-    TCGv_i32 tcg_op = tcg_temp_new_i32();
++    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
--    tcg_gen_st_i64(v, cpu_env, fp_reg_offset(s, reg, MO_64));
+     TCGv_i32 tcg_res = tcg_temp_new_i32();
--    tcg_gen_st_i64(tcg_zero, cpu_env, fp_reg_hi_offset(s, reg));
--    tcg_temp_free_i64(tcg_zero);
+-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-+    tcg_gen_st_i64(v, cpu_env, ofs);
+-
-+    clear_vec_high(s, false, reg);
+     switch (opcode) {
- }
+     case 0x0: /* FMOV */
+         tcg_gen_mov_i32(tcg_res, tcg_op);
- static void write_fp_sreg(DisasContext *s, int reg, TCGv_i32 v)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
-@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
+         tcg_temp_free_i64(tcg_op2);
+         tcg_temp_free_i64(tcg_res);
-     tcg_temp_free_i64(tmplo);
+     } else {
-     tcg_temp_free_i64(tmphi);
+-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-+
+-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
-+    clear_vec_high(s, true, destidx);
++        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
- }
++        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
+         TCGv_i64 tcg_res = tcg_temp_new_i64();
- /*
-@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
+-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
- }
+     if (is_scalar) {
--/* Clear the high 64 bits of a 128 bit vector (in general non-quad
+-        TCGv_i32 tcg_op = tcg_temp_new_i32();
-- * vector ops all need to do this).
++        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-- */
+         TCGv_i32 tcg_res = tcg_temp_new_i32();
--static void clear_vec_high(DisasContext *s, int rd)
--{
+-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -    TCGv_i64 tcg_zero = tcg_const_i64(0);
 -
--    write_vec_element(s, tcg_zero, rd, 1, MO_64);
+         switch (fpop) {
--    tcg_temp_free_i64(tcg_zero);
+         case 0x1a: /* FCVTNS */
--}
+         case 0x1b: /* FCVTMS */
 -
  /* Store from vector register to memory */
  static void do_vec_st(DisasContext *s, int srcidx, int element,
                        TCGv_i64 tcg_addr, int size)
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
                      /* For non-quad operations, setting a slice of the low
                       * 64 bits of the register clears the high 64 bits (in
                       * the ARM ARM pseudocode this is implicit in the fact
 -                     * that 'rval' is a 64 bit wide variable). We optimize
 -                     * by noticing that we only need to do this the first
 -                     * time we touch a register.
 +                     * that 'rval' is a 64 bit wide variable).
 +                     * For quad operations, we might still need to zero the
 +                     * high bits of SVE.  We optimize by noticing that we only
 +                     * need to do this the first time we touch a register.
                       */
 -                    if (!is_q && e == 0 && (r == 0 || xs == selem - 1)) {
 -                        clear_vec_high(s, tt);
 +                    if (e == 0 && (r == 0 || xs == selem - 1)) {
 +                        clear_vec_high(s, is_q, tt);
                      }
                  }
                  tcg_gen_addi_i64(tcg_addr, tcg_addr, ebytes);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
              write_vec_element(s, tcg_tmp, rt, 0, MO_64);
              if (is_q) {
                  write_vec_element(s, tcg_tmp, rt, 1, MO_64);
 -            } else {
 -                clear_vec_high(s, rt);
              }
              tcg_temp_free_i64(tcg_tmp);
 +            clear_vec_high(s, is_q, rt);
          } else {
              /* Load/store one element per register */
              if (is_load) {
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
      }
      if (!is_q) {
 -        clear_vec_high(s, rd);
          write_vec_element(s, tcg_final, rd, 0, MO_64);
      } else {
          write_vec_element(s, tcg_final, rd, 1, MO_64);
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
      tcg_temp_free_i64(tcg_rd);
      tcg_temp_free_i32(tcg_rd_narrowed);
      tcg_temp_free_i64(tcg_final);
 -    return;
 +
 +    clear_vec_high(s, is_q, rd);
  }
  /* SQSHLU, UQSHL, SQSHL: saturating left shifts */
@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
              tcg_temp_free_i64(tcg_op);
          }
          tcg_temp_free_i64(tcg_shift);
 -
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 +        clear_vec_high(s, is_q, rd);
      } else {
          TCGv_i32 tcg_shift = tcg_const_i32(shift);
          static NeonGenTwoOpEnvFn * const fns[2][2][3] = {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
          }
          tcg_temp_free_i32(tcg_shift);
 -        if (!is_q && !scalar) {
 -            clear_vec_high(s, rd);
 +        if (!scalar) {
 +            clear_vec_high(s, is_q, rd);
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void handle_simd_intfp_conv(DisasContext *s, int rd, int rn,
          }
      }
 -    if (!is_double && elements == 2) {
 -        clear_vec_high(s, rd);
 -    }
 -
      tcg_temp_free_i64(tcg_int);
      tcg_temp_free_ptr(tcg_fpst);
      tcg_temp_free_i32(tcg_shift);
 +
 +    clear_vec_high(s, elements << size == 16, rd);
  }
  /* UCVTF/SCVTF - Integer to FP conversion */
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
              write_vec_element(s, tcg_op, rd, pass, MO_64);
              tcg_temp_free_i64(tcg_op);
          }
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 +        clear_vec_high(s, is_q, rd);
      } else {
          int maxpass = is_scalar ? 1 : is_q ? 4 : 2;
          for (pass = 0; pass < maxpass; pass++) {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
              }
              tcg_temp_free_i32(tcg_op);
          }
 -        if (!is_q && !is_scalar) {
 -            clear_vec_high(s, rd);
 +        if (!is_scalar) {
 +            clear_vec_high(s, is_q, rd);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void handle_3same_float(DisasContext *s, int size, int elements,
      tcg_temp_free_ptr(fpst);
 -    if ((elements << size) < 4) {
 -        /* scalar, or non-quad vector op */
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, elements * (size ? 8 : 4) > 8, rd);
  }
  /* AdvSIMD scalar three same
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_fcmp_zero(DisasContext *s, int opcode,
              }
              write_vec_element(s, tcg_res, rd, pass, MO_64);
          }
 -        if (is_scalar) {
 -            clear_vec_high(s, rd);
 -        }
 -
          tcg_temp_free_i64(tcg_res);
          tcg_temp_free_i64(tcg_zero);
          tcg_temp_free_i64(tcg_op);
 +
 +        clear_vec_high(s, !is_scalar, rd);
      } else {
          TCGv_i32 tcg_op = tcg_temp_new_i32();
          TCGv_i32 tcg_zero = tcg_const_i32(0);
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_fcmp_zero(DisasContext *s, int opcode,
          tcg_temp_free_i32(tcg_res);
          tcg_temp_free_i32(tcg_zero);
          tcg_temp_free_i32(tcg_op);
 -        if (!is_q && !is_scalar) {
 -            clear_vec_high(s, rd);
 +        if (!is_scalar) {
 +            clear_vec_high(s, is_q, rd);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_reciprocal(DisasContext *s, int opcode,
              }
              write_vec_element(s, tcg_res, rd, pass, MO_64);
          }
 -        if (is_scalar) {
 -            clear_vec_high(s, rd);
 -        }
 -
          tcg_temp_free_i64(tcg_res);
          tcg_temp_free_i64(tcg_op);
 +        clear_vec_high(s, !is_scalar, rd);
      } else {
          TCGv_i32 tcg_op = tcg_temp_new_i32();
          TCGv_i32 tcg_res = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_reciprocal(DisasContext *s, int opcode,
          }
          tcg_temp_free_i32(tcg_res);
          tcg_temp_free_i32(tcg_op);
 -        if (!is_q && !is_scalar) {
 -            clear_vec_high(s, rd);
 +        if (!is_scalar) {
 +            clear_vec_high(s, is_q, rd);
          }
      }
      tcg_temp_free_ptr(fpst);
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_narrow(DisasContext *s, bool scalar,
          write_vec_element_i32(s, tcg_res[pass], rd, destelt + pass, MO_32);
          tcg_temp_free_i32(tcg_res[pass]);
      }
 -    if (!is_q) {
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, is_q, rd);
  }
  /* Remaining saturating accumulating ops */
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_satacc(DisasContext *s, bool is_scalar, bool is_u,
              }
              write_vec_element(s, tcg_rd, rd, pass, MO_64);
          }
 -        if (is_scalar) {
 -            clear_vec_high(s, rd);
 -        }
 -
          tcg_temp_free_i64(tcg_rd);
          tcg_temp_free_i64(tcg_rn);
 +        clear_vec_high(s, !is_scalar, rd);
      } else {
          TCGv_i32 tcg_rn = tcg_temp_new_i32();
          TCGv_i32 tcg_rd = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_satacc(DisasContext *s, bool is_scalar, bool is_u,
              }
              write_vec_element_i32(s, tcg_rd, rd, pass, MO_32);
          }
 -
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 -
          tcg_temp_free_i32(tcg_rd);
          tcg_temp_free_i32(tcg_rn);
 +        clear_vec_high(s, is_q, rd);
      }
  }
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
      tcg_temp_free_i64(tcg_round);
   done:
 -    if (!is_q) {
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, is_q, rd);
  }
  static void gen_shl8_ins_i64(TCGv_i64 d, TCGv_i64 a, int64_t shift)
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shrn(DisasContext *s, bool is_q,
      }
      if (!is_q) {
 -        clear_vec_high(s, rd);
          write_vec_element(s, tcg_final, rd, 0, MO_64);
      } else {
          write_vec_element(s, tcg_final, rd, 1, MO_64);
      }
 -
      if (round) {
          tcg_temp_free_i64(tcg_round);
      }
      tcg_temp_free_i64(tcg_rn);
      tcg_temp_free_i64(tcg_rd);
      tcg_temp_free_i64(tcg_final);
 -    return;
 +
 +    clear_vec_high(s, is_q, rd);
  }
@@ -XXX,XX +XXX,XX @@ static void handle_3rd_narrowing(DisasContext *s, int is_q, int is_u, int size,
          write_vec_element_i32(s, tcg_res[pass], rd, pass + part, MO_32);
          tcg_temp_free_i32(tcg_res[pass]);
      }
 -    if (!is_q) {
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, is_q, rd);
  }
  static void handle_pmull_64(DisasContext *s, int is_q, int rd, int rn, int rm)
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
              write_vec_element_i32(s, tcg_res[pass], rd, pass, MO_32);
              tcg_temp_free_i32(tcg_res[pass]);
          }
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 +        clear_vec_high(s, is_q, rd);
      }
      if (fpst) {
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
              tcg_temp_free_i32(tcg_op2);
          }
      }
 -
 -    if (!is_q) {
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, is_q, rd);
  }
  /* AdvSIMD three same
@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
              write_vec_element(s, tcg_tmp, rd, i, grp_size);
              tcg_temp_free_i64(tcg_tmp);
          }
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 +        clear_vec_high(s, is_q, rd);
      } else {
          int revmask = (1 << grp_size) - 1;
          int esize = 8 << size;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
              tcg_temp_free_i32(tcg_op);
          }
      }
 -    if (!is_q) {
 -        clear_vec_high(s, rd);
 -    }
 +    clear_vec_high(s, is_q, rd);
      if (need_rmode) {
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              tcg_temp_free_i64(tcg_res);
          }
 -        if (is_scalar) {
 -            clear_vec_high(s, rd);
 -        }
 -
          tcg_temp_free_i64(tcg_idx);
 +        clear_vec_high(s, !is_scalar, rd);
      } else if (!is_long) {
          /* 32 bit floating point, or 16 or 32 bit integer.
           * For the 16 bit scalar case we use the usual Neon helpers and
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
          }
          tcg_temp_free_i32(tcg_idx);
 -
 -        if (!is_q) {
 -            clear_vec_high(s, rd);
 -        }
 +        clear_vec_high(s, is_q, rd);
      } else {
          /* long ops: 16x16->32 or 32x32->64 */
          TCGv_i64 tcg_res[2];
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
              }
              tcg_temp_free_i64(tcg_idx);
 -            if (is_scalar) {
 -                clear_vec_high(s, rd);
 -            }
 +            clear_vec_high(s, !is_scalar, rd);
          } else {
              TCGv_i32 tcg_idx = tcg_temp_new_i32();
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 05/21] raspi: Add "raspi3" machine type
+[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
-From: Pekka Enberg <penberg@iki.fi>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds a "raspi3" machine type, which can now be selected as
+We missed all of the scalar fp16 binary operations.
 the machine to run on by users via the "-M" command line option to QEMU.
-The machine type does *not* ignore memory transaction failures so we
+Cc: qemu-stable@nongnu.org
-likely need to add some dummy devices later when people run something
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-more complicated than what I'm using for testing.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Pekka Enberg <penberg@iki.fi>
+Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 [PMM: added #ifdef TARGET_AARCH64 so we don't provide the 64-bit
  board in the 32-bit only arm-softmmu build.]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 23 +++++++++++++++++++++++
+ target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
-file changed, 23 insertions(+)
+file changed, 65 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
-     mc->ignore_memory_transaction_failures = true;
+     tcg_temp_free_i64(tcg_res);
- };
+ }
- DEFINE_MACHINE("raspi2", raspi2_machine_init)
 +/* Floating-point data-processing (2 source) - half precision */
 +static void handle_fp_2src_half(DisasContext *s, int opcode,
 +                                int rd, int rn, int rm)
 +{
 +    TCGv_i32 tcg_op1;
 +    TCGv_i32 tcg_op2;
 +    TCGv_i32 tcg_res;
 +    TCGv_ptr fpst;
 +
-+#ifdef TARGET_AARCH64
++    tcg_res = tcg_temp_new_i32();
-+static void raspi3_init(MachineState *machine)
++    fpst = get_fpstatus_ptr(true);
-+{
++    tcg_op1 = read_fp_hreg(s, rn);
-+    raspi_init(machine, 3);
++    tcg_op2 = read_fp_hreg(s, rm);
 +
 +    switch (opcode) {
 +    case 0x0: /* FMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x1: /* FDIV */
 +        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
-+static void raspi3_machine_init(MachineClass *mc)
+ /* Floating point data-processing (2 source)
-+{
+  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
-+    mc->desc = "Raspberry Pi 3";
+  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
-+    mc->init = raspi3_init;
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
-+    mc->block_default_type = IF_SD;
+         }
-+    mc->no_parallel = 1;
+         handle_fp_2src_double(s, opcode, rd, rn, rm);
-+    mc->no_floppy = 1;
+         break;
-+    mc->no_cdrom = 1;
++    case 3:
-+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
++        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+    mc->max_cpus = BCM2836_NCPUS;
++            unallocated_encoding(s);
-+    mc->min_cpus = BCM2836_NCPUS;
++            return;
-+    mc->default_cpus = BCM2836_NCPUS;
++        }
-+    mc->default_ram_size = 1024 * 1024 * 1024;
++        if (!fp_access_check(s)) {
-+}
++            return;
-+DEFINE_MACHINE("raspi3", raspi3_machine_init)
++        }
-+#endif
++        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 04/21] raspi: Raspberry Pi 3 support
+[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
-From: Pekka Enberg <penberg@iki.fi>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch adds Raspberry Pi 3 support to hw/arm/raspi.c. The
+We missed all of the scalar fp16 fma operations.
 differences to Pi 2 are:
- - Firmware address
+Cc: qemu-stable@nongnu.org
- - Board ID
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
- - Board revision
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-The CPU is different too, but that's going to be configured as part of
+Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 the machine default CPU when we introduce a new machine type.
 The patch was written from scratch by me but the logic is similar to
 Zoltán Baldaszti's previous work, which I used as a reference (with
 permission from the author):
   https://github.com/bztsrc/qemu-raspi3
 Signed-off-by: Pekka Enberg <penberg@iki.fi>
 [PMM: fixed trailing whitespace on one line]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/raspi.c | 31 +++++++++++++++++++++----------
+ target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
-file changed, 21 insertions(+), 10 deletions(-)
+file changed, 48 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/raspi.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
-  * Rasperry Pi 2 emulation Copyright (c) 2015, Microsoft
+     tcg_temp_free_i64(tcg_res);
   * Written by Andrew Baumann
   *
 + * Raspberry Pi 3 emulation Copyright (c) 2018 Zoltán Baldaszti
 + * Upstream code cleanup (c) 2018 Pekka Enberg
 + *
   * This code is licensed under the GNU GPLv2 and later.
   */
@@ -XXX,XX +XXX,XX @@
  #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
  #define MVBAR_ADDR      0x400 /* secure vectors */
  #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 -#define FIRMWARE_ADDR   0x8000 /* Pi loads kernel.img here by default */
 +#define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 +#define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
  /* Table of Linux board IDs for different Pi versions */
 -static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43};
 +static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
  typedef struct RasPiState {
      BCM2836State soc;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      binfo.secure_board_setup = true;
      binfo.secure_boot = true;
 -    /* Pi2 requires SMP setup */
 -    if (version == 2) {
 +    /* Pi2 and Pi3 requires SMP setup */
 +    if (version >= 2) {
          binfo.smp_loader_start = SMPBOOT_ADDR;
          binfo.write_secondary_boot = write_smpboot;
          binfo.secondary_cpu_reset_hook = reset_secondary;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
       * the normal Linux boot process
       */
      if (machine->firmware) {
 +        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
          /* load the firmware image (typically kernel.img) */
 -        r = load_image_targphys(machine->firmware, FIRMWARE_ADDR,
 -                                ram_size - FIRMWARE_ADDR);
 +        r = load_image_targphys(machine->firmware, firmware_addr,
 +                                ram_size - firmware_addr);
          if (r < 0) {
              error_report("Failed to load firmware from %s", machine->firmware);
              exit(1);
          }
 -        binfo.entry = FIRMWARE_ADDR;
 +        binfo.entry = firmware_addr;
          binfo.firmware_loaded = true;
      } else {
          binfo.kernel_filename = machine->kernel_filename;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      arm_load_kernel(ARM_CPU(first_cpu), &binfo);
  }
--static void raspi2_init(MachineState *machine)
++/* Floating-point data-processing (3 source) - half precision */
-+static void raspi_init(MachineState *machine, int version)
++static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
- {
++                                int rd, int rn, int rm, int ra)
-     RasPiState *s = g_new0(RasPiState, 1);
++{
-     uint32_t vcram_size;
++    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
-@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
++    TCGv_i32 tcg_res = tcg_temp_new_i32();
-                             &error_abort);
++    TCGv_ptr fpst = get_fpstatus_ptr(true);
-     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
++
-                             &error_abort);
++    tcg_op1 = read_fp_hreg(s, rn);
--    object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",
++    tcg_op2 = read_fp_hreg(s, rm);
-+    int board_rev = version == 3 ? 0xa02082 : 0xa21041;
++    tcg_op3 = read_fp_hreg(s, ra);
-+    object_property_set_int(OBJECT(&s->soc), board_rev, "board-rev",
++
-                             &error_abort);
++    /* These are fused multiply-add, and must be done as one
-     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_abort);
++     * floating point operation with no rounding between the
++     * multiplication and addition steps.
-@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
++     * NB that doing the negations here as separate steps is
++     * correct : an input NaN should come out with its sign bit
-     vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
++     * flipped if it is a negated-input.
-                                           &error_abort);
++     */
--    setup_boot(machine, 2, machine->ram_size - vcram_size);
++    if (o1 == true) {
-+    setup_boot(machine, version, machine->ram_size - vcram_size);
++        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
 +    if (o0 != o1) {
 +        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +    }
 +
 +    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
-+static void raspi2_init(MachineState *machine)
+ /* Floating point data-processing (3 source)
-+{
+  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
-+    raspi_init(machine, 2);
+  * +---+---+---+-----------+------+----+------+----+------+------+------+
- }
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
+         }
- static void raspi2_machine_init(MachineClass *mc)
+         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 15/21] hw/intc/armv7m_nvic: Implement cache ID registers
+[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
-M profile cores have a similar setup for cache ID registers
+From: Alex Bennée <alex.bennee@linaro.org>
-to A profile:
- * Cache Level ID Register (CLIDR) is a fixed value
+These where missed out from the rest of the half-precision work.
- * Cache Type Register (CTR) is a fixed value
- * Cache Size ID Registers (CCSIDR) are a bank of registers;
+Cc: qemu-stable@nongnu.org
-   which one you see is selected by the Cache Size Selection
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-   Register (CSSELR)
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
-The only difference is that they're in the NVIC memory mapped
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-register space rather than being coprocessor registers.
+Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
-Implement the M profile view of them.
+[rth: Diagnose lack of FP16 before fp_access_check]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Since neither Cortex-M3 nor Cortex-M4 implement caches,
 we don't need to update their init functions and can leave
 the ctr/clidr/ccsidr[] fields in their ARMCPU structs at zero.
 Newer cores (like the Cortex-M33) will want to be able to
 set these ID registers to non-zero values, though.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-6-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      | 26 ++++++++++++++++++++++++++
+ target/arm/helper-a64.h    |  2 +
- hw/intc/armv7m_nvic.c | 16 ++++++++++++++++
+ target/arm/helper-a64.c    | 10 +++++
- target/arm/machine.c  | 36 ++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
-files changed, 78 insertions(+)
+files changed, 83 insertions(+), 17 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper-a64.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper-a64.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@
-         uint32_t faultmask[M_REG_NUM_BANKS];
+ DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
-         uint32_t aircr; /* only holds r/w state if security extn implemented */
+ DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
+ DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
-+        uint32_t csselr[M_REG_NUM_BANKS];
++DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
-     } v7m;
++DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
+ DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
-     /* Information associated with an exception about to be taken:
+ DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
+ DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
- FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
- FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper-a64.c
-+/* v7M CLIDR bits */
++++ b/target/arm/helper-a64.c
-+FIELD(V7M_CLIDR, CTYPE_ALL, 0, 21)
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
-+FIELD(V7M_CLIDR, LOUIS, 21, 3)
+     return flags;
 +FIELD(V7M_CLIDR, LOC, 24, 3)
 +FIELD(V7M_CLIDR, LOUU, 27, 3)
 +FIELD(V7M_CLIDR, ICB, 30, 2)
 +
 +FIELD(V7M_CSSELR, IND, 0, 1)
 +FIELD(V7M_CSSELR, LEVEL, 1, 3)
 +/* We use the combination of InD and Level to index into cpu->ccsidr[];
 + * define a mask for this and check that it doesn't permit running off
 + * the end of the array.
 + */
 +FIELD(V7M_CSSELR, INDEX, 0, 4)
 +
 +QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
 +
  /* If adding a feature bit which corresponds to a Linux ELF
   * HWCAP bit, remember to update the feature-bit-to-hwcap
   * mapping in linux-user/elfload.c:get_elf_hwcap().
@@ -XXX,XX +XXX,XX @@ static inline int arm_debug_target_el(CPUARMState *env)
      }
  }
-+static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
++uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
 +{
-+    /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
++    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
 +     * CSSELR is RAZ/WI.
 +     */
 +    return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
 +}
 +
- static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
++uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
 +{
 +    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
-     if (arm_is_secure(env)) {
+     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
-         return cpu->id_isar4;
+     }
-     case 0xd74: /* ISAR5.  */
+ }
-         return cpu->id_isar5;
-+    case 0xd78: /* CLIDR */
+-static void handle_fp_compare(DisasContext *s, bool is_double,
-+        return cpu->clidr;
++static void handle_fp_compare(DisasContext *s, int size,
-+    case 0xd7c: /* CTR */
+                               unsigned int rn, unsigned int rm,
-+        return cpu->ctr;
+                               bool cmp_with_zero, bool signal_all_nans)
-+    case 0xd80: /* CSSIDR */
+ {
-+    {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-+        int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
+-    TCGv_ptr fpst = get_fpstatus_ptr(false);
-+        return cpu->ccsidr[idx];
++    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
-+    case 0xd84: /* CSSELR */
++
-+        return cpu->env.v7m.csselr[attrs.secure];
++    switch (type) {
-     /* TODO: Implement debug registers.  */
++    case 0:
-     case 0xd90: /* MPU_TYPE */
++        size = MO_32;
-         /* Unified MPU; if the MPU is not present this value is zero */
++        break;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
++    case 1:
-         qemu_log_mask(LOG_UNIMP,
++        size = MO_64;
-                       "NVIC: Aux fault status registers unimplemented\n");
++        break;
-         break;
++    case 3:
-+    case 0xd84: /* CSSELR */
++        size = MO_16;
-+        if (!arm_v7m_csselr_razwi(cpu)) {
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+            cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
++            break;
 +        }
-+        break;
++        /* fallthru */
-     case 0xd90: /* MPU_TYPE */
++    default:
-         return; /* RO */
+         unallocated_encoding(s);
-     case 0xd94: /* MPU_CTRL */
+         return;
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+     }
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
---- a/target/arm/machine.c
+         return;
-+++ b/target/arm/machine.c
+     }
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_faultmask_primask = {
-     }
+-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
- };
++    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
+ }
-+/* CSSELR is in a subsection because we didn't implement it previously.
-+ * Migration from an old implementation will leave it at zero, which
+ /* Floating point conditional compare
-+ * is OK since the only CPUs in the old implementation make the
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-+ * register RAZ/WI.
+     unsigned int mos, type, rm, cond, rn, op, nzcv;
-+ * Since there was no version of QEMU which implemented the CSSELR for
+     TCGv_i64 tcg_flags;
-+ * just non-secure, we transfer both banks here rather than putting
+     TCGLabel *label_continue = NULL;
-+ * the secure banked version in the m-security subsection.
++    int size;
-+ */
-+static bool csselr_vmstate_validate(void *opaque, int version_id)
+     mos = extract32(insn, 29, 3);
-+{
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+    ARMCPU *cpu = opaque;
++    type = extract32(insn, 22, 2);
-+
+     rm = extract32(insn, 16, 5);
-+    return cpu->env.v7m.csselr[M_REG_NS] <= R_V7M_CSSELR_INDEX_MASK
+     cond = extract32(insn, 12, 4);
-+        && cpu->env.v7m.csselr[M_REG_S] <= R_V7M_CSSELR_INDEX_MASK;
+     rn = extract32(insn, 5, 5);
-+}
+     op = extract32(insn, 4, 1);
-+
+     nzcv = extract32(insn, 0, 4);
-+static bool m_csselr_needed(void *opaque)
-+{
+-    if (mos || type > 1) {
-+    ARMCPU *cpu = opaque;
++    if (mos) {
-+
++        unallocated_encoding(s);
-+    return !arm_v7m_csselr_razwi(cpu);
++        return;
 +}
 +
 +static const VMStateDescription vmstate_m_csselr = {
 +    .name = "cpu/m/csselr",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = m_csselr_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(env.v7m.csselr, ARMCPU, M_REG_NUM_BANKS),
 +        VMSTATE_VALIDATE("CSSELR is valid", csselr_vmstate_validate),
 +        VMSTATE_END_OF_LIST()
 +    }
-+};
++
-+
++    switch (type) {
- static const VMStateDescription vmstate_m = {
++    case 0:
-     .name = "cpu/m",
++        size = MO_32;
-     .version_id = 4,
++        break;
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
++    case 1:
-     },
++        size = MO_64;
-     .subsections = (const VMStateDescription*[]) {
++        break;
-         &vmstate_m_faultmask_primask,
++    case 3:
-+        &vmstate_m_csselr,
++        size = MO_16;
-         NULL
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-     }
++            break;
- };
++        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 03/21] bcm2836: Make CPU type configurable
+[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
-From: Pekka Enberg <penberg@iki.fi>
+From: Alex Bennée <alex.bennee@linaro.org>
-This patch adds a "cpu-type" property to BCM2836 SoC in preparation for
+These were missed out from the rest of the half-precision work.
 reusing the code for the Raspberry Pi 3, which has a different processor
 model.
-Signed-off-by: Pekka Enberg <penberg@iki.fi>
+Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
+[rth: Fix erroneous check vs type]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/bcm2836.h |  1 +
+ target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
- hw/arm/bcm2836.c         | 17 +++++++++--------
+file changed, 25 insertions(+), 6 deletions(-)
  hw/arm/raspi.c           |  3 +++
 files changed, 13 insertions(+), 8 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/translate-a64.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-     DeviceState parent_obj;
+     unsigned int mos, type, rm, cond, rn, rd;
-     /*< public >*/
+     TCGv_i64 t_true, t_false, t_zero;
+     DisasCompare64 c;
-+    char *cpu_type;
++    TCGMemOp sz;
-     uint32_t enabled_cpus;
+     mos = extract32(insn, 29, 3);
-     ARMCPU cpus[BCM2836_NCPUS];
+-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
++    type = extract32(insn, 22, 2);
-index XXXXXXX..XXXXXXX 100644
+     rm = extract32(insn, 16, 5);
---- a/hw/arm/bcm2836.c
+     cond = extract32(insn, 12, 4);
-+++ b/hw/arm/bcm2836.c
+     rn = extract32(insn, 5, 5);
-@@ -XXX,XX +XXX,XX @@
+     rd = extract32(insn, 0, 5);
- static void bcm2836_init(Object *obj)
- {
+-    if (mos || type > 1) {
-     BCM2836State *s = BCM2836(obj);
++    if (mos) {
--    int n;
++        unallocated_encoding(s);
--
++        return;
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 -        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 -                          "cortex-a15-" TYPE_ARM_CPU);
 -        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 -                                  &error_abort);
 -    }
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
 +    obj = OBJECT(dev);
 +    for (n = 0; n < BCM2836_NCPUS; n++) {
 +        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 +                          s->cpu_type);
 +        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 +                                  &error_abort);
 +    }
 +
-     obj = object_property_get_link(OBJECT(dev), "ram", &err);
++    switch (type) {
-     if (obj == NULL) {
++    case 0:
-         error_setg(errp, "%s: required ram link not found: %s",
++        sz = MO_32;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
++        break;
- }
++    case 1:
++        sz = MO_64;
- static Property bcm2836_props[] = {
++        break;
-+    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
++    case 3:
-     DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
++        sz = MO_16;
-     DEFINE_PROP_END_OF_LIST()
++        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
- };
++            break;
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
++        }
-index XXXXXXX..XXXXXXX 100644
++        /* fallthru */
---- a/hw/arm/raspi.c
++    default:
-+++ b/hw/arm/raspi.c
+         unallocated_encoding(s);
-@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
+         return;
-     /* Setup the SOC */
+     }
-     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-                                    &error_abort);
+         return;
-+    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
+     }
-+                            &error_abort);
-     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
+-    /* Zero extend sreg inputs to 64 bits now.  */
-                             &error_abort);
++    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-     object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",
+     t_true = tcg_temp_new_i64();
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
+     t_false = tcg_temp_new_i64();
-     mc->no_parallel = 1;
+-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-     mc->no_floppy = 1;
+-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-     mc->no_cdrom = 1;
++    read_vec_element(s, t_true, rn, 0, sz);
-+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
++    read_vec_element(s, t_false, rm, 0, sz);
-     mc->max_cpus = BCM2836_NCPUS;
-     mc->min_cpus = BCM2836_NCPUS;
+     a64_test_cc(&c, cond);
-     mc->default_cpus = BCM2836_NCPUS;
+     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 19/21] target/arm: Add AIRCR to vmstate struct
+[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
-In commit commit 3b2e934463121 we added support for the AIRCR
+From: Alex Bennée <alex.bennee@linaro.org>
 register holding state, but forgot to add it to the vmstate
 structs. Since it only holds r/w state if the security extension
 is implemented, we can just add it to vmstate_m_security.
+All the hard work is already done by vfp_expand_imm, we just need to
+make sure we pick up the correct size.
+Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
+[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-10-peter.maydell@linaro.org
 ---
- target/arm/machine.c | 4 ++++
+ target/arm/translate-a64.c | 20 +++++++++++++++++---
-file changed, 4 insertions(+)
+file changed, 17 insertions(+), 3 deletions(-)
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/machine.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-         VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
+ {
-         VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
+     int rd = extract32(insn, 0, 5);
-         VMSTATE_UINT32(env.v7m.scr[M_REG_S], ARMCPU),
+     int imm8 = extract32(insn, 13, 8);
-+        /* AIRCR is not secure-only, but our implementation is R/O if the
+-    int is_double = extract32(insn, 22, 2);
-+         * security extension is unimplemented, so we migrate it here.
++    int type = extract32(insn, 22, 2);
-+         */
+     uint64_t imm;
-+        VMSTATE_UINT32(env.v7m.aircr, ARMCPU),
+     TCGv_i64 tcg_res;
-         VMSTATE_END_OF_LIST()
++    TCGMemOp sz;
 -    if (is_double > 1) {
 +    switch (type) {
 +    case 0:
 +        sz = MO_32;
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
- };
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
          return;
      }
 -    imm = vfp_expand_imm(MO_32 + is_double, imm8);
 +    imm = vfp_expand_imm(sz, imm8);
      tcg_res = tcg_const_i64(imm);
      write_fp_dreg(s, rd, tcg_res);
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 01/21] hw/arm/aspeed: directly map the serial device to the system address space
+[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Alex Bennée <alex.bennee@linaro.org>
-(qemu) info mtree
+We are meant to explicitly pass fpst, not cpu_env.
  address-space: cpu-memory-0
    0000000000000000-ffffffffffffffff (prio 0, i/o): system
      0000000000000000-0000000007ffffff (prio 0, rom): aspeed.boot_rom
      000000001e600000-000000001e7fffff (prio -1, i/o): aspeed_soc.io
 -      000000001e784000-000000001e78401f (prio 0, i/o): serial
      000000001e620000-000000001e6200ff (prio 0, i/o): aspeed.smc.ast2500-fmc
      000000001e630000-000000001e6300ff (prio 0, i/o): aspeed.smc.ast2500-spi1
      [...]
      000000001e720000-000000001e728fff (prio 0, ram): aspeed.sram
      000000001e782000-000000001e782fff (prio 0, i/o): aspeed.timer
 +    000000001e784000-000000001e78401f (prio 0, i/o): serial
      000000001e785000-000000001e78501f (prio 0, i/o): aspeed.wdt
      000000001e785020-000000001e78503f (prio 0, i/o): aspeed.wdt
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209085755.30414-2-f4bug@amsat.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed_soc.c | 3 ++-
+ target/arm/translate-a64.c | 3 ++-
 file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/target/arm/translate-a64.c
-+++ b/hw/arm/aspeed_soc.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
-     /* UART - attach an 8250 to the IO space as our UART5 */
+         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-     if (serial_hds[0]) {
+         break;
-         qemu_irq uart5 = qdev_get_gpio_in(DEVICE(&s->vic), uart_irqs[4]);
+     case 0x3: /* FSQRT */
--        serial_mm_init(&s->iomem, ASPEED_SOC_UART_5_BASE, 2,
+-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
-+        serial_mm_init(get_system_memory(),
++        fpst = get_fpstatus_ptr(true);
-+                       ASPEED_SOC_IOMEM_BASE + ASPEED_SOC_UART_5_BASE, 2,
++        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
-                        uart5, 38400, serial_hds[0], DEVICE_LITTLE_ENDIAN);
+         break;
-     }
+     case 0x8: /* FRINTN */
+     case 0x9: /* FRINTP */
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 02/21] hw/arm/aspeed: simplify using the 'unimplemented device' for aspeed_soc.io
+[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-(qemu) info mtree
+Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
- address-space: cpu-memory-0
-   0000000000000000-ffffffffffffffff (prio 0, i/o): system
+  The block length is predefined to 512 bits
-     0000000000000000-0000000007ffffff (prio 0, rom): aspeed.boot_rom
--    000000001e600000-000000001e7fffff (prio -1, i/o): aspeed_soc.io
+and "4.10.2 SD Status":
-+    000000001e600000-000000001e7fffff (prio -1000, i/o): aspeed_soc.io
-     000000001e620000-000000001e6200ff (prio 0, i/o): aspeed.smc.ast2500-fmc
+  The SD Status contains status bits that are related to the SD Memory Card
-     000000001e630000-000000001e6300ff (prio 0, i/o): aspeed.smc.ast2500-spi1
+  proprietary features and may be used for future application-specific usage.
-     000000001e631000-000000001e6310ff (prio 0, i/o): aspeed.smc.ast2500-spi2
+  The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20180509060104.4458-3-f4bug@amsat.org
-Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180209085755.30414-3-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  1 -
+ hw/sd/sd.c | 2 +-
- hw/arm/aspeed_soc.c         | 32 +++-----------------------------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 3 insertions(+), 30 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/sd/sd.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/sd/sd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
+@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
-     /*< public >*/
+     }
-     ARMCPU cpu;
+     memset(&sd->data[17], 0, 47);
--    MemoryRegion iomem;
+-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-     MemoryRegion sram;
++    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
-     AspeedVICState vic;
+ }
-     AspeedTimerCtrlState timerctrl;
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+ static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "exec/address-spaces.h"
 +#include "hw/misc/unimp.h"
  #include "hw/arm/aspeed_soc.h"
  #include "hw/char/serial.h"
  #include "qemu/log.h"
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
      },
  };
 -/*
 - * IO handlers: simply catch any reads/writes to IO addresses that aren't
 - * handled by a device mapping.
 - */
 -
 -static uint64_t aspeed_soc_io_read(void *p, hwaddr offset, unsigned size)
 -{
 -    qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
 -                  __func__, offset, size);
 -    return 0;
 -}
 -
 -static void aspeed_soc_io_write(void *opaque, hwaddr offset, uint64_t value,
 -                unsigned size)
 -{
 -    qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " <- 0x%" PRIx64 " [%u]\n",
 -                  __func__, offset, value, size);
 -}
 -
 -static const MemoryRegionOps aspeed_soc_io_ops = {
 -    .read = aspeed_soc_io_read,
 -    .write = aspeed_soc_io_write,
 -    .endianness = DEVICE_LITTLE_ENDIAN,
 -};
 -
  static void aspeed_soc_init(Object *obj)
  {
      AspeedSoCState *s = ASPEED_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
      Error *err = NULL, *local_err = NULL;
      /* IO space */
 -    memory_region_init_io(&s->iomem, NULL, &aspeed_soc_io_ops, NULL,
 -            "aspeed_soc.io", ASPEED_SOC_IOMEM_SIZE);
 -    memory_region_add_subregion_overlap(get_system_memory(),
 -                                        ASPEED_SOC_IOMEM_BASE, &s->iomem, -1);
 +    create_unimplemented_device("aspeed_soc.io",
 +                                ASPEED_SOC_IOMEM_BASE, ASPEED_SOC_IOMEM_SIZE);
      /* CPU */
      object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 12/21] hw/intc/armv7m_nvic: Fix ICSR PENDNMISET/CLR handling
+Deleted patch
-The PENDNMISET/CLR bits in the ICSR should be RAZ/WI from
-NonSecure state if the AIRCR.BFHFNMINS bit is zero. We had
-misimplemented this as making the bits RAZ/WI from both
-Secure and NonSecure states. Fix this bug by checking
-attrs.secure so that Secure code can pend and unpend NMIs.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-3-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 6 +++---
-file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-             }
-         }
-         /* NMIPENDSET */
--        if ((cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
--            s->vectors[ARMV7M_EXCP_NMI].pending) {
-+        if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
-+            && s->vectors[ARMV7M_EXCP_NMI].pending) {
-             val |= (1 << 31);
-         }
-         /* ISRPREEMPT: RES0 when halting debug not implemented */
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         break;
-     }
-     case 0xd04: /* Interrupt Control State (ICSR) */
--        if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
-+        if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
-             if (value & (1 << 31)) {
-                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
-             } else if (value & (1 << 30) &&
---
-.16.1

-[Qemu-devel] [PULL 13/21] hw/intc/armv7m_nvic: Implement M profile cache maintenance ops
+Deleted patch
-For M profile cores, cache maintenance operations are done by
-writing to special registers in the system register space.
-For QEMU, cache operations are always NOPs, since we don't
-implement the cache. Implementing these explicitly avoids
-a spurious LOG_GUEST_ERROR when the guest uses them.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-4-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 12 ++++++++++++
-file changed, 12 insertions(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         }
-         break;
-     }
-+    case 0xf50: /* ICIALLU */
-+    case 0xf58: /* ICIMVAU */
-+    case 0xf5c: /* DCIMVAC */
-+    case 0xf60: /* DCISW */
-+    case 0xf64: /* DCCMVAU */
-+    case 0xf68: /* DCCMVAC */
-+    case 0xf6c: /* DCCSW */
-+    case 0xf70: /* DCCIMVAC */
-+    case 0xf74: /* DCCISW */
-+    case 0xf78: /* BPIALL */
-+        /* Cache and branch predictor maintenance: for QEMU these always NOP */
-+        break;
-     default:
-     bad_offset:
-         qemu_log_mask(LOG_GUEST_ERROR,
---
-.16.1

-[Qemu-devel] [PULL 14/21] hw/intc/armv7m_nvic: Implement v8M CPPWR register
+Deleted patch
-The Coprocessor Power Control Register (CPPWR) is new in v8M.
-It allows software to control whether coprocessors are allowed
-to power down and lose their state. QEMU doesn't have any
-notion of power control, so we choose the IMPDEF option of
-making the whole register RAZ/WI (indicating that no coprocessors
-can ever power down and lose state).
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-5-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 14 ++++++++++++++
-file changed, 14 insertions(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-     switch (offset) {
-     case 4: /* Interrupt Control Type.  */
-         return ((s->num_irq - NVIC_FIRST_IRQ) / 32) - 1;
-+    case 0xc: /* CPPWR */
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
-+            goto bad_offset;
-+        }
-+        /* We make the IMPDEF choice that nothing can ever go into a
-+         * non-retentive power state, which allows us to RAZ/WI this.
-+         */
-+        return 0;
-     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
-     {
-         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-     ARMCPU *cpu = s->cpu;
-     switch (offset) {
-+    case 0xc: /* CPPWR */
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
-+            goto bad_offset;
-+        }
-+        /* Make the IMPDEF choice to RAZ/WI this. */
-+        break;
-     case 0x380 ... 0x3bf: /* NVIC_ITNS<n> */
-     {
-         int startvec = 8 * (offset - 0x380) + NVIC_FIRST_IRQ;
---
-.16.1

-[Qemu-devel] [PULL 16/21] hw/intc/armv7m_nvic: Implement SCR
+Deleted patch
-We were previously making the system control register (SCR)
-just RAZ/WI. Although we don't implement the functionality
-this register controls, we should at least provide the state,
-including the banked state for v8M.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-7-peter.maydell@linaro.org
----
- target/arm/cpu.h      |  7 +++++++
- hw/intc/armv7m_nvic.c | 12 ++++++++----
- target/arm/machine.c  | 12 ++++++++++++
-files changed, 27 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint32_t aircr; /* only holds r/w state if security extn implemented */
-         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
-         uint32_t csselr[M_REG_NUM_BANKS];
-+        uint32_t scr[M_REG_NUM_BANKS];
-     } v7m;
-     /* Information associated with an exception about to be taken:
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKALIGN, 9, 1)
- FIELD(V7M_CCR, DC, 16, 1)
- FIELD(V7M_CCR, IC, 17, 1)
-+/* V7M SCR bits */
-+FIELD(V7M_SCR, SLEEPONEXIT, 1, 1)
-+FIELD(V7M_SCR, SLEEPDEEP, 2, 1)
-+FIELD(V7M_SCR, SLEEPDEEPS, 3, 1)
-+FIELD(V7M_SCR, SEVONPEND, 4, 1)
-+
- /* V7M AIRCR bits */
- FIELD(V7M_AIRCR, VECTRESET, 0, 1)
- FIELD(V7M_AIRCR, VECTCLRACTIVE, 1, 1)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-         }
-         return val;
-     case 0xd10: /* System Control.  */
--        /* TODO: Implement SLEEPONEXIT.  */
--        return 0;
-+        return cpu->env.v7m.scr[attrs.secure];
-     case 0xd14: /* Configuration Control.  */
-         /* The BFHFNMIGN bit is the only non-banked bit; we
-          * keep it in the non-secure copy of the register.
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         }
-         break;
-     case 0xd10: /* System Control.  */
--        /* TODO: Implement control registers.  */
--        qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");
-+        /* We don't implement deep-sleep so these bits are RAZ/WI.
-+         * The other bits in the register are banked.
-+         * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
-+         * is architecturally permitted.
-+         */
-+        value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
-+        cpu->env.v7m.scr[attrs.secure] = value;
-         break;
-     case 0xd14: /* Configuration Control.  */
-         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
-diff --git a/target/arm/machine.c b/target/arm/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
-+++ b/target/arm/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_csselr = {
-     }
- };
-+static const VMStateDescription vmstate_m_scr = {
-+    .name = "cpu/m/scr",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(env.v7m.scr[M_REG_NS], ARMCPU),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static const VMStateDescription vmstate_m = {
-     .name = "cpu/m",
-     .version_id = 4,
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
-     .subsections = (const VMStateDescription*[]) {
-         &vmstate_m_faultmask_primask,
-         &vmstate_m_csselr,
-+        &vmstate_m_scr,
-         NULL
-     }
- };
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
-         VMSTATE_UINT32(env.sau.rnr, ARMCPU),
-         VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
-         VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
-+        VMSTATE_UINT32(env.v7m.scr[M_REG_S], ARMCPU),
-         VMSTATE_END_OF_LIST()
-     }
- };
---
-.16.1

-[Qemu-devel] [PULL 17/21] target/arm: Implement writing to CONTROL_NS for v8M
+[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
-In commit 50f11062d4c896 we added support for MSR/MRS access
+Usually the logging of the CPU state produced by -d cpu is sufficient
-to the NS banked special registers, but we forgot to implement
+to diagnose problems, but sometimes you want to see the state of
-the support for writing to CONTROL_NS. Correct the omission.
+the floating point registers as well. We don't want to enable that
 by default as it adds a lot of extra data to the log; instead,
 allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180209165810.6668-8-peter.maydell@linaro.org
+Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 10 ++++++++++
+ include/qemu/log.h   | 1 +
-file changed, 10 insertions(+)
+ accel/tcg/cpu-exec.c | 9 ++++++---
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/qemu/log.h
-+++ b/target/arm/helper.c
++++ b/include/qemu/log.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
-             }
+ #define CPU_LOG_PAGE       (1 << 14)
-             env->v7m.faultmask[M_REG_NS] = val & 1;
+ /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-             return;
+ #define CPU_LOG_TB_OP_IND  (1 << 16)
-+        case 0x94: /* CONTROL_NS */
++#define CPU_LOG_TB_FPU     (1 << 17)
-+            if (!env->v7m.secure) {
-+                return;
+ /* Lock output for a series of related logs.  Since this is not needed
-+            }
+  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-+            write_v7m_control_spsel_for_secstate(env,
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-+                                                 val & R_V7M_CONTROL_SPSEL_MASK,
+index XXXXXXX..XXXXXXX 100644
-+                                                 M_REG_NS);
+--- a/accel/tcg/cpu-exec.c
-+            env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
++++ b/accel/tcg/cpu-exec.c
-+            env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
+@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
-+            return;
+     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-         case 0x98: /* SP_NS */
+         && qemu_log_in_addr_range(itb->pc)) {
-         {
+         qemu_log_lock();
-             /* This gives the non-secure SP selected based on whether we're
++        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.16.1
+.17.0

-[Qemu-devel] [PULL 18/21] hw/intc/armv7m_nvic: Fix byte-to-interrupt number conversions
+Deleted patch
-In many of the NVIC registers relating to interrupts, we
-have to convert from a byte offset within a register set
-into the number of the first interrupt which is affected.
-We were getting this wrong for:
- * reads of NVIC_ISPR<n>, NVIC_ISER<n>, NVIC_ICPR<n>, NVIC_ICER<n>,
-   NVIC_IABR<n> -- in all these cases we were missing the "* 8"
-   needed to convert from the byte offset to the interrupt number
-   (since all these registers use one bit per interrupt)
- * writes of NVIC_IPR<n> had the opposite problem of a spurious
-   "* 8" (since these registers use one byte per interrupt)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180209165810.6668-9-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
-         /* fall through */
-     case 0x180 ... 0x1bf: /* NVIC Clear enable */
-         val = 0;
--        startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
-+        startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
-         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-             if (s->vectors[startvec + i].enabled &&
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
-         /* fall through */
-     case 0x280 ... 0x2bf: /* NVIC Clear pend */
-         val = 0;
--        startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
-+        startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
-         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-             if (s->vectors[startvec + i].pending &&
-                 (attrs.secure || s->itns[startvec + i])) {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
-         break;
-     case 0x300 ... 0x33f: /* NVIC Active */
-         val = 0;
--        startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
-+        startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
-         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
-             if (s->vectors[startvec + i].active &&
-@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
-     case 0x300 ... 0x33f: /* NVIC Active */
-         return MEMTX_OK; /* R/O */
-     case 0x400 ... 0x5ef: /* NVIC Priority */
--        startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
-+        startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
-         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
-             if (attrs.secure || s->itns[startvec + i]) {
---
-.16.1

target-arm queue: mostly just cleanup/minor stuff, but this does
include the raspi3 board model.

-- PMM

The following changes since commit 9f9c53368b219a9115eddb39f0ff5ad19c977134:

Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-2.12-pull-request' into staging (2018-02-15 10:14:11 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180215

for you to fetch changes up to e545f0f9be1f9e60951017c1e6558216732cc14e:

target/arm: Implement v8M MSPLIM and PSPLIM registers (2018-02-15 13:48:11 +0000)

----------------------------------------------------------------
target-arm queue:
 * aspeed: code cleanup to use unimplemented_device
 * add 'raspi3' RaspberryPi 3 machine model
 * more SVE prep work
 * v8M: add minor missing registers
 * v7M: fix bug where we weren't migrating v7m.other_sp
 * v7M: fix bugs in handling of interrupt registers for
   external interrupts beyond 32

----------------------------------------------------------------
Pekka Enberg (3):
      bcm2836: Make CPU type configurable
      raspi: Raspberry Pi 3 support
      raspi: Add "raspi3" machine type

Peter Maydell (11):
      hw/intc/armv7m_nvic: Don't hardcode M profile ID registers in NVIC
      hw/intc/armv7m_nvic: Fix ICSR PENDNMISET/CLR handling
      hw/intc/armv7m_nvic: Implement M profile cache maintenance ops
      hw/intc/armv7m_nvic: Implement v8M CPPWR register
      hw/intc/armv7m_nvic: Implement cache ID registers
      hw/intc/armv7m_nvic: Implement SCR
      target/arm: Implement writing to CONTROL_NS for v8M
      hw/intc/armv7m_nvic: Fix byte-to-interrupt number conversions
      target/arm: Add AIRCR to vmstate struct
      target/arm: Migrate v7m.other_sp
      target/arm: Implement v8M MSPLIM and PSPLIM registers

Philippe Mathieu-Daudé (2):
      hw/arm/aspeed: directly map the serial device to the system address space
      hw/arm/aspeed: simplify using the 'unimplemented device' for aspeed_soc.io

Richard Henderson (5):
      target/arm: Remove ARM_CP_64BIT from ZCR_EL registers
      target/arm: Enforce FP access to FPCR/FPSR
      target/arm: Suppress TB end for FPCR/FPSR
      target/arm: Enforce access to ZCR_EL at translation
      target/arm: Handle SVE registers when using clear_vec_high

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

(qemu) info mtree
 address-space: cpu-memory-0
   0000000000000000-ffffffffffffffff (prio 0, i/o): system
     0000000000000000-0000000007ffffff (prio 0, rom): aspeed.boot_rom
     000000001e600000-000000001e7fffff (prio -1, i/o): aspeed_soc.io
-      000000001e784000-000000001e78401f (prio 0, i/o): serial
     000000001e620000-000000001e6200ff (prio 0, i/o): aspeed.smc.ast2500-fmc
     000000001e630000-000000001e6300ff (prio 0, i/o): aspeed.smc.ast2500-spi1
     [...]
     000000001e720000-000000001e728fff (prio 0, ram): aspeed.sram
     000000001e782000-000000001e782fff (prio 0, i/o): aspeed.timer
+    000000001e784000-000000001e78401f (prio 0, i/o): serial
     000000001e785000-000000001e78501f (prio 0, i/o): aspeed.wdt
     000000001e785020-000000001e78503f (prio 0, i/o): aspeed.wdt

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180209085755.30414-2-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_soc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     /* UART - attach an 8250 to the IO space as our UART5 */
     if (serial_hds[0]) {
         qemu_irq uart5 = qdev_get_gpio_in(DEVICE(&s->vic), uart_irqs[4]);
-        serial_mm_init(&s->iomem, ASPEED_SOC_UART_5_BASE, 2,
+        serial_mm_init(get_system_memory(),
+                       ASPEED_SOC_IOMEM_BASE + ASPEED_SOC_UART_5_BASE, 2,
                        uart5, 38400, serial_hds[0], DEVICE_LITTLE_ENDIAN);
     }
 
-- 
2.16.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Message-id: 20180209085755.30414-3-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  1 -
 hw/arm/aspeed_soc.c         | 32 +++-----------------------------
 2 files changed, 3 insertions(+), 30 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
 
     /*< public >*/
     ARMCPU cpu;
-    MemoryRegion iomem;
     MemoryRegion sram;
     AspeedVICState vic;
     AspeedTimerCtrlState timerctrl;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
+#include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/char/serial.h"
 #include "qemu/log.h"
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
     },
 };
 
-/*
- * IO handlers: simply catch any reads/writes to IO addresses that aren't
- * handled by a device mapping.
- */
-
-static uint64_t aspeed_soc_io_read(void *p, hwaddr offset, unsigned size)
-{
-    qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
-                  __func__, offset, size);
-    return 0;
-}
-
-static void aspeed_soc_io_write(void *opaque, hwaddr offset, uint64_t value,
-                unsigned size)
-{
-    qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " <- 0x%" PRIx64 " [%u]\n",
-                  __func__, offset, value, size);
-}
-
-static const MemoryRegionOps aspeed_soc_io_ops = {
-    .read = aspeed_soc_io_read,
-    .write = aspeed_soc_io_write,
-    .endianness = DEVICE_LITTLE_ENDIAN,
-};
-
 static void aspeed_soc_init(Object *obj)
 {
     AspeedSoCState *s = ASPEED_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
     Error *err = NULL, *local_err = NULL;
 
     /* IO space */
-    memory_region_init_io(&s->iomem, NULL, &aspeed_soc_io_ops, NULL,
-            "aspeed_soc.io", ASPEED_SOC_IOMEM_SIZE);
-    memory_region_add_subregion_overlap(get_system_memory(),
-                                        ASPEED_SOC_IOMEM_BASE, &s->iomem, -1);
+    create_unimplemented_device("aspeed_soc.io",
+                                ASPEED_SOC_IOMEM_BASE, ASPEED_SOC_IOMEM_SIZE);
 
     /* CPU */
     object_property_set_bool(OBJECT(&s->cpu), true, "realized", &err);
-- 
2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds a "cpu-type" property to BCM2836 SoC in preparation for
reusing the code for the Raspberry Pi 3, which has a different processor
model.

Signed-off-by: Pekka Enberg <penberg@iki.fi>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2836.h |  1 +
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           |  3 +++
 3 files changed, 13 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     DeviceState parent_obj;
     /*< public >*/
 
+    char *cpu_type;
     uint32_t enabled_cpus;
 
     ARMCPU cpus[BCM2836_NCPUS];
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 static void bcm2836_init(Object *obj)
 {
     BCM2836State *s = BCM2836(obj);
-    int n;
-
-    for (n = 0; n < BCM2836_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          "cortex-a15-" TYPE_ARM_CPU);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
+    obj = OBJECT(dev);
+    for (n = 0; n < BCM2836_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          s->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
+
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
+    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
+    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
+                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_parallel = 1;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
     mc->max_cpus = BCM2836_NCPUS;
     mc->min_cpus = BCM2836_NCPUS;
     mc->default_cpus = BCM2836_NCPUS;
-- 
2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds Raspberry Pi 3 support to hw/arm/raspi.c. The
differences to Pi 2 are:

- Firmware address
 - Board ID
 - Board revision

The CPU is different too, but that's going to be configured as part of
the machine default CPU when we introduce a new machine type.

The patch was written from scratch by me but the logic is similar to
Zoltán Baldaszti's previous work, which I used as a reference (with
permission from the author):

https://github.com/bztsrc/qemu-raspi3

Signed-off-by: Pekka Enberg <penberg@iki.fi>
[PMM: fixed trailing whitespace on one line]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 31 +++++++++++++++++++++----------
 1 file changed, 21 insertions(+), 10 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
+ * Raspberry Pi 3 emulation Copyright (c) 2018 Zoltán Baldaszti
+ * Upstream code cleanup (c) 2018 Pekka Enberg
+ *
  * This code is licensed under the GNU GPLv2 and later.
  */
 
@@ -XXX,XX +XXX,XX @@
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
 #define MVBAR_ADDR      0x400 /* secure vectors */
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
-#define FIRMWARE_ADDR   0x8000 /* Pi loads kernel.img here by default */
+#define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
+#define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 
 /* Table of Linux board IDs for different Pi versions */
-static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43};
+static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
     BCM2836State soc;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.secure_board_setup = true;
     binfo.secure_boot = true;
 
-    /* Pi2 requires SMP setup */
-    if (version == 2) {
+    /* Pi2 and Pi3 requires SMP setup */
+    if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
         binfo.write_secondary_boot = write_smpboot;
         binfo.secondary_cpu_reset_hook = reset_secondary;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
      * the normal Linux boot process
      */
     if (machine->firmware) {
+        hwaddr firmware_addr = version == 3 ? FIRMWARE_ADDR_3 : FIRMWARE_ADDR_2;
         /* load the firmware image (typically kernel.img) */
-        r = load_image_targphys(machine->firmware, FIRMWARE_ADDR,
-                                ram_size - FIRMWARE_ADDR);
+        r = load_image_targphys(machine->firmware, firmware_addr,
+                                ram_size - firmware_addr);
         if (r < 0) {
             error_report("Failed to load firmware from %s", machine->firmware);
             exit(1);
         }
 
-        binfo.entry = FIRMWARE_ADDR;
+        binfo.entry = firmware_addr;
         binfo.firmware_loaded = true;
     } else {
         binfo.kernel_filename = machine->kernel_filename;
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     arm_load_kernel(ARM_CPU(first_cpu), &binfo);
 }
 
-static void raspi2_init(MachineState *machine)
+static void raspi_init(MachineState *machine, int version)
 {
     RasPiState *s = g_new0(RasPiState, 1);
     uint32_t vcram_size;
@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
                             &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
-    object_property_set_int(OBJECT(&s->soc), 0xa21041, "board-rev",
+    int board_rev = version == 3 ? 0xa02082 : 0xa21041;
+    object_property_set_int(OBJECT(&s->soc), board_rev, "board-rev",
                             &error_abort);
     object_property_set_bool(OBJECT(&s->soc), true, "realized", &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_init(MachineState *machine)
 
     vcram_size = object_property_get_uint(OBJECT(&s->soc), "vcram-size",
                                           &error_abort);
-    setup_boot(machine, 2, machine->ram_size - vcram_size);
+    setup_boot(machine, version, machine->ram_size - vcram_size);
+}
+
+static void raspi2_init(MachineState *machine)
+{
+    raspi_init(machine, 2);
 }
 
 static void raspi2_machine_init(MachineClass *mc)
-- 
2.16.1

From: Pekka Enberg <penberg@iki.fi>

This patch adds a "raspi3" machine type, which can now be selected as
the machine to run on by users via the "-M" command line option to QEMU.

The machine type does *not* ignore memory transaction failures so we
likely need to add some dummy devices later when people run something
more complicated than what I'm using for testing.

Signed-off-by: Pekka Enberg <penberg@iki.fi>
[PMM: added #ifdef TARGET_AARCH64 so we don't provide the 64-bit
 board in the 32-bit only arm-softmmu build.]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 };
 DEFINE_MACHINE("raspi2", raspi2_machine_init)
+
+#ifdef TARGET_AARCH64
+static void raspi3_init(MachineState *machine)
+{
+    raspi_init(machine, 3);
+}
+
+static void raspi3_machine_init(MachineClass *mc)
+{
+    mc->desc = "Raspberry Pi 3";
+    mc->init = raspi3_init;
+    mc->block_default_type = IF_SD;
+    mc->no_parallel = 1;
+    mc->no_floppy = 1;
+    mc->no_cdrom = 1;
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
+    mc->max_cpus = BCM2836_NCPUS;
+    mc->min_cpus = BCM2836_NCPUS;
+    mc->default_cpus = BCM2836_NCPUS;
+    mc->default_ram_size = 1024 * 1024 * 1024;
+}
+DEFINE_MACHINE("raspi3", raspi3_machine_init)
+#endif
-- 
2.16.1

From: Richard Henderson <richard.henderson@linaro.org>

Because they are ARM_CP_STATE_AA64, ARM_CP_64BIT is implied.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180211205848.4568-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static const ARMCPRegInfo zcr_el1_reginfo = {
     .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL1_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
+    .access = PL1_RW, .accessfn = zcr_access,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el1_reginfo = {
 static const ARMCPRegInfo zcr_el2_reginfo = {
     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
+    .access = PL2_RW, .accessfn = zcr_access,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el2_reginfo = {
 static const ARMCPRegInfo zcr_no_el2_reginfo = {
     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW, .type = ARM_CP_64BIT,
+    .access = PL2_RW,
     .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
 };
 
 static const ARMCPRegInfo zcr_el3_reginfo = {
     .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL3_RW, .accessfn = zcr_access, .type = ARM_CP_64BIT,
+    .access = PL3_RW, .accessfn = zcr_access,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
-- 
2.16.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180211205848.4568-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 35 ++++++++++++++++++-----------------
 target/arm/helper.c        |  6 ++++--
 target/arm/translate-a64.c |  3 +++
 3 files changed, 25 insertions(+), 19 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
 }
 
 /* ARMCPRegInfo type field bits. If the SPECIAL bit is set this is a
- * special-behaviour cp reg and bits [15..8] indicate what behaviour
+ * special-behaviour cp reg and bits [11..8] indicate what behaviour
  * it has. Otherwise it is a simple cp reg, where CONST indicates that
  * TCG can assume the value to be constant (ie load at translate time)
  * and 64BIT indicates a 64 bit wide coprocessor register. SUPPRESS_TB_END
@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
  * need to be surrounded by gen_io_start()/gen_io_end(). In particular,
  * registers which implement clocks or timers require this.
  */
-#define ARM_CP_SPECIAL 1
-#define ARM_CP_CONST 2
-#define ARM_CP_64BIT 4
-#define ARM_CP_SUPPRESS_TB_END 8
-#define ARM_CP_OVERRIDE 16
-#define ARM_CP_ALIAS 32
-#define ARM_CP_IO 64
-#define ARM_CP_NO_RAW 128
-#define ARM_CP_NOP (ARM_CP_SPECIAL | (1 << 8))
-#define ARM_CP_WFI (ARM_CP_SPECIAL | (2 << 8))
-#define ARM_CP_NZCV (ARM_CP_SPECIAL | (3 << 8))
-#define ARM_CP_CURRENTEL (ARM_CP_SPECIAL | (4 << 8))
-#define ARM_CP_DC_ZVA (ARM_CP_SPECIAL | (5 << 8))
-#define ARM_LAST_SPECIAL ARM_CP_DC_ZVA
+#define ARM_CP_SPECIAL           0x0001
+#define ARM_CP_CONST             0x0002
+#define ARM_CP_64BIT             0x0004
+#define ARM_CP_SUPPRESS_TB_END   0x0008
+#define ARM_CP_OVERRIDE          0x0010
+#define ARM_CP_ALIAS             0x0020
+#define ARM_CP_IO                0x0040
+#define ARM_CP_NO_RAW            0x0080
+#define ARM_CP_NOP               (ARM_CP_SPECIAL | 0x0100)
+#define ARM_CP_WFI               (ARM_CP_SPECIAL | 0x0200)
+#define ARM_CP_NZCV              (ARM_CP_SPECIAL | 0x0300)
+#define ARM_CP_CURRENTEL         (ARM_CP_SPECIAL | 0x0400)
+#define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
+#define ARM_LAST_SPECIAL         ARM_CP_DC_ZVA
+#define ARM_CP_FPU               0x1000
 /* Used only as a terminator for ARMCPRegInfo lists */
-#define ARM_CP_SENTINEL 0xffff
+#define ARM_CP_SENTINEL          0xffff
 /* Mask of only the flag bits in a type field */
-#define ARM_CP_FLAG_MASK 0xff
+#define ARM_CP_FLAG_MASK         0x10ff
 
 /* Valid values for ARMCPRegInfo state field, indicating which of
  * the AArch32 and AArch64 execution states this register is visible in.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
-      .access = PL0_RW, .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
+      .access = PL0_RW, .type = ARM_CP_FPU,
+      .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
-      .access = PL0_RW, .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
+      .access = PL0_RW, .type = ARM_CP_FPU,
+      .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
       .access = PL0_R, .type = ARM_CP_NO_RAW,
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
     default:
         break;
     }
+    if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
+        return;
+    }
 
     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
         gen_io_start();
-- 
2.16.1

From: Richard Henderson <richard.henderson@linaro.org>

Nothing in either register affects the TB.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180211205848.4568-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
-      .access = PL0_RW, .type = ARM_CP_FPU,
+      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
-      .access = PL0_RW, .type = ARM_CP_FPU,
+      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
       .readfn = aa64_fpsr_read, .writefn = aa64_fpsr_write },
     { .name = "DCZID_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 7, .crn = 0, .crm = 0,
-- 
2.16.1

From: Richard Henderson <richard.henderson@linaro.org>

This also makes sure that we get the correct ordering of
SVE vs FP exceptions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180211205848.4568-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  3 ++-
 target/arm/internals.h     |  6 ++++++
 target/arm/helper.c        | 22 ++++------------------
 target/arm/translate-a64.c | 16 ++++++++++++++++
 4 files changed, 28 insertions(+), 19 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
 #define ARM_CP_DC_ZVA            (ARM_CP_SPECIAL | 0x0500)
 #define ARM_LAST_SPECIAL         ARM_CP_DC_ZVA
 #define ARM_CP_FPU               0x1000
+#define ARM_CP_SVE               0x2000
 /* Used only as a terminator for ARMCPRegInfo lists */
 #define ARM_CP_SENTINEL          0xffff
 /* Mask of only the flag bits in a type field */
-#define ARM_CP_FLAG_MASK         0x10ff
+#define ARM_CP_FLAG_MASK         0x30ff
 
 /* Valid values for ARMCPRegInfo state field, indicating which of
  * the AArch32 and AArch64 execution states this register is visible in.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_AA64_HVC               = 0x16,
     EC_AA64_SMC               = 0x17,
     EC_SYSTEMREGISTERTRAP     = 0x18,
+    EC_SVEACCESSTRAP          = 0x19,
     EC_INSNABORT              = 0x20,
     EC_INSNABORT_SAME_EL      = 0x21,
     EC_PCALIGNMENT            = 0x22,
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_fp_access_trap(int cv, int cond, bool is_16bit)
         | (cv << 24) | (cond << 20);
 }
 
+static inline uint32_t syn_sve_access_trap(void)
+{
+    return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
+}
+
 static inline uint32_t syn_insn_abort(int same_el, int ea, int s1ptw, int fsc)
 {
     return (EC_INSNABORT << ARM_EL_EC_SHIFT) | (same_el << ARM_EL_EC_SHIFT)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int sve_exception_el(CPUARMState *env)
     return 0;
 }
 
-static CPAccessResult zcr_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                 bool isread)
-{
-    switch (sve_exception_el(env)) {
-    case 3:
-        return CP_ACCESS_TRAP_EL3;
-    case 2:
-        return CP_ACCESS_TRAP_EL2;
-    case 1:
-        return CP_ACCESS_TRAP;
-    }
-    return CP_ACCESS_OK;
-}
-
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                       uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static const ARMCPRegInfo zcr_el1_reginfo = {
     .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL1_RW, .accessfn = zcr_access,
+    .access = PL1_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el1_reginfo = {
 static const ARMCPRegInfo zcr_el2_reginfo = {
     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW, .accessfn = zcr_access,
+    .access = PL2_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_el2_reginfo = {
 static const ARMCPRegInfo zcr_no_el2_reginfo = {
     .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW,
+    .access = PL2_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
     .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
 };
 
 static const ARMCPRegInfo zcr_el3_reginfo = {
     .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
     .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL3_RW, .accessfn = zcr_access,
+    .access = PL3_RW, .type = ARM_CP_SVE | ARM_CP_FPU,
     .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
     .writefn = zcr_write, .raw_writefn = raw_write
 };
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static inline bool fp_access_check(DisasContext *s)
     return false;
 }
 
+/* Check that SVE access is enabled.  If it is, return true.
+ * If not, emit code to generate an appropriate exception and return false.
+ */
+static inline bool sve_access_check(DisasContext *s)
+{
+    if (s->sve_excp_el) {
+        gen_exception_insn(s, 4, EXCP_UDEF, syn_sve_access_trap(),
+                           s->sve_excp_el);
+        return false;
+    }
+    return true;
+}
+
 /*
  * This utility function is for doing register extension with an
  * optional shift. You will likely want to pass a temporary for the
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
     default:
         break;
     }
+    if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
+        return;
+    }
     if ((ri->type & ARM_CP_FPU) && !fp_access_check(s)) {
         return;
     }
-- 
2.16.1

From: Richard Henderson <richard.henderson@linaro.org>

When storing to an AdvSIMD FP register, all of the high
bits of the SVE register are zeroed.  Therefore, call it
more often with is_q as a parameter.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180211205848.4568-6-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 162 +++++++++++++++++----------------------------
 1 file changed, 62 insertions(+), 100 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+/* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
+ * If SVE is not enabled, then there are only 128 bits in the vector.
+ */
+static void clear_vec_high(DisasContext *s, bool is_q, int rd)
+{
+    unsigned ofs = fp_reg_offset(s, rd, MO_64);
+    unsigned vsz = vec_full_reg_size(s);
+
+    if (!is_q) {
+        TCGv_i64 tcg_zero = tcg_const_i64(0);
+        tcg_gen_st_i64(tcg_zero, cpu_env, ofs + 8);
+        tcg_temp_free_i64(tcg_zero);
+    }
+    if (vsz > 16) {
+        tcg_gen_gvec_dup8i(ofs + 16, vsz - 16, vsz - 16, 0);
+    }
+}
+
 static void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v)
 {
-    TCGv_i64 tcg_zero = tcg_const_i64(0);
+    unsigned ofs = fp_reg_offset(s, reg, MO_64);
 
-    tcg_gen_st_i64(v, cpu_env, fp_reg_offset(s, reg, MO_64));
-    tcg_gen_st_i64(tcg_zero, cpu_env, fp_reg_hi_offset(s, reg));
-    tcg_temp_free_i64(tcg_zero);
+    tcg_gen_st_i64(v, cpu_env, ofs);
+    clear_vec_high(s, false, reg);
 }
 
 static void write_fp_sreg(DisasContext *s, int reg, TCGv_i32 v)
@@ -XXX,XX +XXX,XX @@ static void do_fp_ld(DisasContext *s, int destidx, TCGv_i64 tcg_addr, int size)
 
     tcg_temp_free_i64(tmplo);
     tcg_temp_free_i64(tmphi);
+
+    clear_vec_high(s, true, destidx);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void write_vec_element_i32(DisasContext *s, TCGv_i32 tcg_src,
     }
 }
 
-/* Clear the high 64 bits of a 128 bit vector (in general non-quad
- * vector ops all need to do this).
- */
-static void clear_vec_high(DisasContext *s, int rd)
-{
-    TCGv_i64 tcg_zero = tcg_const_i64(0);
-
-    write_vec_element(s, tcg_zero, rd, 1, MO_64);
-    tcg_temp_free_i64(tcg_zero);
-}
-
 /* Store from vector register to memory */
 static void do_vec_st(DisasContext *s, int srcidx, int element,
                       TCGv_i64 tcg_addr, int size)
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_multiple_struct(DisasContext *s, uint32_t insn)
                     /* For non-quad operations, setting a slice of the low
                      * 64 bits of the register clears the high 64 bits (in
                      * the ARM ARM pseudocode this is implicit in the fact
-                     * that 'rval' is a 64 bit wide variable). We optimize
-                     * by noticing that we only need to do this the first
-                     * time we touch a register.
+                     * that 'rval' is a 64 bit wide variable).
+                     * For quad operations, we might still need to zero the
+                     * high bits of SVE.  We optimize by noticing that we only
+                     * need to do this the first time we touch a register.
                      */
-                    if (!is_q && e == 0 && (r == 0 || xs == selem - 1)) {
-                        clear_vec_high(s, tt);
+                    if (e == 0 && (r == 0 || xs == selem - 1)) {
+                        clear_vec_high(s, is_q, tt);
                     }
                 }
                 tcg_gen_addi_i64(tcg_addr, tcg_addr, ebytes);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_single_struct(DisasContext *s, uint32_t insn)
             write_vec_element(s, tcg_tmp, rt, 0, MO_64);
             if (is_q) {
                 write_vec_element(s, tcg_tmp, rt, 1, MO_64);
-            } else {
-                clear_vec_high(s, rt);
             }
             tcg_temp_free_i64(tcg_tmp);
+            clear_vec_high(s, is_q, rt);
         } else {
             /* Load/store one element per register */
             if (is_load) {
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
     }
 
     if (!is_q) {
-        clear_vec_high(s, rd);
         write_vec_element(s, tcg_final, rd, 0, MO_64);
     } else {
         write_vec_element(s, tcg_final, rd, 1, MO_64);
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_sqshrn(DisasContext *s, bool is_scalar, bool is_q,
     tcg_temp_free_i64(tcg_rd);
     tcg_temp_free_i32(tcg_rd_narrowed);
     tcg_temp_free_i64(tcg_final);
-    return;
+
+    clear_vec_high(s, is_q, rd);
 }
 
 /* SQSHLU, UQSHL, SQSHL: saturating left shifts */
@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
             tcg_temp_free_i64(tcg_op);
         }
         tcg_temp_free_i64(tcg_shift);
-
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
+        clear_vec_high(s, is_q, rd);
     } else {
         TCGv_i32 tcg_shift = tcg_const_i32(shift);
         static NeonGenTwoOpEnvFn * const fns[2][2][3] = {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_qshl(DisasContext *s, bool scalar, bool is_q,
         }
         tcg_temp_free_i32(tcg_shift);
 
-        if (!is_q && !scalar) {
-            clear_vec_high(s, rd);
+        if (!scalar) {
+            clear_vec_high(s, is_q, rd);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void handle_simd_intfp_conv(DisasContext *s, int rd, int rn,
         }
     }
 
-    if (!is_double && elements == 2) {
-        clear_vec_high(s, rd);
-    }
-
     tcg_temp_free_i64(tcg_int);
     tcg_temp_free_ptr(tcg_fpst);
     tcg_temp_free_i32(tcg_shift);
+
+    clear_vec_high(s, elements << size == 16, rd);
 }
 
 /* UCVTF/SCVTF - Integer to FP conversion */
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
             write_vec_element(s, tcg_op, rd, pass, MO_64);
             tcg_temp_free_i64(tcg_op);
         }
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
+        clear_vec_high(s, is_q, rd);
     } else {
         int maxpass = is_scalar ? 1 : is_q ? 4 : 2;
         for (pass = 0; pass < maxpass; pass++) {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
             }
             tcg_temp_free_i32(tcg_op);
         }
-        if (!is_q && !is_scalar) {
-            clear_vec_high(s, rd);
+        if (!is_scalar) {
+            clear_vec_high(s, is_q, rd);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void handle_3same_float(DisasContext *s, int size, int elements,
 
     tcg_temp_free_ptr(fpst);
 
-    if ((elements << size) < 4) {
-        /* scalar, or non-quad vector op */
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, elements * (size ? 8 : 4) > 8, rd);
 }
 
 /* AdvSIMD scalar three same
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_fcmp_zero(DisasContext *s, int opcode,
             }
             write_vec_element(s, tcg_res, rd, pass, MO_64);
         }
-        if (is_scalar) {
-            clear_vec_high(s, rd);
-        }
-
         tcg_temp_free_i64(tcg_res);
         tcg_temp_free_i64(tcg_zero);
         tcg_temp_free_i64(tcg_op);
+
+        clear_vec_high(s, !is_scalar, rd);
     } else {
         TCGv_i32 tcg_op = tcg_temp_new_i32();
         TCGv_i32 tcg_zero = tcg_const_i32(0);
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_fcmp_zero(DisasContext *s, int opcode,
         tcg_temp_free_i32(tcg_res);
         tcg_temp_free_i32(tcg_zero);
         tcg_temp_free_i32(tcg_op);
-        if (!is_q && !is_scalar) {
-            clear_vec_high(s, rd);
+        if (!is_scalar) {
+            clear_vec_high(s, is_q, rd);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_reciprocal(DisasContext *s, int opcode,
             }
             write_vec_element(s, tcg_res, rd, pass, MO_64);
         }
-        if (is_scalar) {
-            clear_vec_high(s, rd);
-        }
-
         tcg_temp_free_i64(tcg_res);
         tcg_temp_free_i64(tcg_op);
+        clear_vec_high(s, !is_scalar, rd);
     } else {
         TCGv_i32 tcg_op = tcg_temp_new_i32();
         TCGv_i32 tcg_res = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_reciprocal(DisasContext *s, int opcode,
         }
         tcg_temp_free_i32(tcg_res);
         tcg_temp_free_i32(tcg_op);
-        if (!is_q && !is_scalar) {
-            clear_vec_high(s, rd);
+        if (!is_scalar) {
+            clear_vec_high(s, is_q, rd);
         }
     }
     tcg_temp_free_ptr(fpst);
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_narrow(DisasContext *s, bool scalar,
         write_vec_element_i32(s, tcg_res[pass], rd, destelt + pass, MO_32);
         tcg_temp_free_i32(tcg_res[pass]);
     }
-    if (!is_q) {
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, is_q, rd);
 }
 
 /* Remaining saturating accumulating ops */
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_satacc(DisasContext *s, bool is_scalar, bool is_u,
             }
             write_vec_element(s, tcg_rd, rd, pass, MO_64);
         }
-        if (is_scalar) {
-            clear_vec_high(s, rd);
-        }
-
         tcg_temp_free_i64(tcg_rd);
         tcg_temp_free_i64(tcg_rn);
+        clear_vec_high(s, !is_scalar, rd);
     } else {
         TCGv_i32 tcg_rn = tcg_temp_new_i32();
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
@@ -XXX,XX +XXX,XX @@ static void handle_2misc_satacc(DisasContext *s, bool is_scalar, bool is_u,
             }
             write_vec_element_i32(s, tcg_rd, rd, pass, MO_32);
         }
-
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
-
         tcg_temp_free_i32(tcg_rd);
         tcg_temp_free_i32(tcg_rn);
+        clear_vec_high(s, is_q, rd);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
     tcg_temp_free_i64(tcg_round);
 
  done:
-    if (!is_q) {
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, is_q, rd);
 }
 
 static void gen_shl8_ins_i64(TCGv_i64 d, TCGv_i64 a, int64_t shift)
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shrn(DisasContext *s, bool is_q,
     }
 
     if (!is_q) {
-        clear_vec_high(s, rd);
         write_vec_element(s, tcg_final, rd, 0, MO_64);
     } else {
         write_vec_element(s, tcg_final, rd, 1, MO_64);
     }
-
     if (round) {
         tcg_temp_free_i64(tcg_round);
     }
     tcg_temp_free_i64(tcg_rn);
     tcg_temp_free_i64(tcg_rd);
     tcg_temp_free_i64(tcg_final);
-    return;
+
+    clear_vec_high(s, is_q, rd);
 }
 
 
@@ -XXX,XX +XXX,XX @@ static void handle_3rd_narrowing(DisasContext *s, int is_q, int is_u, int size,
         write_vec_element_i32(s, tcg_res[pass], rd, pass + part, MO_32);
         tcg_temp_free_i32(tcg_res[pass]);
     }
-    if (!is_q) {
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, is_q, rd);
 }
 
 static void handle_pmull_64(DisasContext *s, int is_q, int rd, int rn, int rm)
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
             write_vec_element_i32(s, tcg_res[pass], rd, pass, MO_32);
             tcg_temp_free_i32(tcg_res[pass]);
         }
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
+        clear_vec_high(s, is_q, rd);
     }
 
     if (fpst) {
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
             tcg_temp_free_i32(tcg_op2);
         }
     }
-
-    if (!is_q) {
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, is_q, rd);
 }
 
 /* AdvSIMD three same
@@ -XXX,XX +XXX,XX @@ static void handle_rev(DisasContext *s, int opcode, bool u,
             write_vec_element(s, tcg_tmp, rd, i, grp_size);
             tcg_temp_free_i64(tcg_tmp);
         }
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
+        clear_vec_high(s, is_q, rd);
     } else {
         int revmask = (1 << grp_size) - 1;
         int esize = 8 << size;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
             tcg_temp_free_i32(tcg_op);
         }
     }
-    if (!is_q) {
-        clear_vec_high(s, rd);
-    }
+    clear_vec_high(s, is_q, rd);
 
     if (need_rmode) {
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, cpu_env);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
             tcg_temp_free_i64(tcg_res);
         }
 
-        if (is_scalar) {
-            clear_vec_high(s, rd);
-        }
-
         tcg_temp_free_i64(tcg_idx);
+        clear_vec_high(s, !is_scalar, rd);
     } else if (!is_long) {
         /* 32 bit floating point, or 16 or 32 bit integer.
          * For the 16 bit scalar case we use the usual Neon helpers and
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
         }
 
         tcg_temp_free_i32(tcg_idx);
-
-        if (!is_q) {
-            clear_vec_high(s, rd);
-        }
+        clear_vec_high(s, is_q, rd);
     } else {
         /* long ops: 16x16->32 or 32x32->64 */
         TCGv_i64 tcg_res[2];
@@ -XXX,XX +XXX,XX @@ static void disas_simd_indexed(DisasContext *s, uint32_t insn)
             }
             tcg_temp_free_i64(tcg_idx);
 
-            if (is_scalar) {
-                clear_vec_high(s, rd);
-            }
+            clear_vec_high(s, !is_scalar, rd);
         } else {
             TCGv_i32 tcg_idx = tcg_temp_new_i32();
 
-- 
2.16.1

Instead of hardcoding the values of M profile ID registers in the
NVIC, use the fields in the CPU struct. This will allow us to
give different M profile CPU types different ID register values.

This commit includes the addition of the missing ID_ISAR5,
which exists as RES0 in both v7M and v8M.

(The values of the ID registers might be wrong for the M4 --
this commit leaves the behaviour there unchanged.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-2-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 30 ++++++++++++++++--------------
 target/arm/cpu.c      | 28 ++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 14 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
                       "Aux Fault status registers unimplemented\n");
         return 0;
     case 0xd40: /* PFR0.  */
-        return 0x00000030;
-    case 0xd44: /* PRF1.  */
-        return 0x00000200;
+        return cpu->id_pfr0;
+    case 0xd44: /* PFR1.  */
+        return cpu->id_pfr1;
     case 0xd48: /* DFR0.  */
-        return 0x00100000;
+        return cpu->id_dfr0;
     case 0xd4c: /* AFR0.  */
-        return 0x00000000;
+        return cpu->id_afr0;
     case 0xd50: /* MMFR0.  */
-        return 0x00000030;
+        return cpu->id_mmfr0;
     case 0xd54: /* MMFR1.  */
-        return 0x00000000;
+        return cpu->id_mmfr1;
     case 0xd58: /* MMFR2.  */
-        return 0x00000000;
+        return cpu->id_mmfr2;
     case 0xd5c: /* MMFR3.  */
-        return 0x00000000;
+        return cpu->id_mmfr3;
     case 0xd60: /* ISAR0.  */
-        return 0x01141110;
+        return cpu->id_isar0;
     case 0xd64: /* ISAR1.  */
-        return 0x02111000;
+        return cpu->id_isar1;
     case 0xd68: /* ISAR2.  */
-        return 0x21112231;
+        return cpu->id_isar2;
     case 0xd6c: /* ISAR3.  */
-        return 0x01111110;
+        return cpu->id_isar3;
     case 0xd70: /* ISAR4.  */
-        return 0x01310102;
+        return cpu->id_isar4;
+    case 0xd74: /* ISAR5.  */
+        return cpu->id_isar5;
     /* TODO: Implement debug registers.  */
     case 0xd90: /* MPU_TYPE */
         /* Unified MPU; if the MPU is not present this value is zero */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cortex_m3_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     cpu->midr = 0x410fc231;
     cpu->pmsav7_dregion = 8;
+    cpu->id_pfr0 = 0x00000030;
+    cpu->id_pfr1 = 0x00000200;
+    cpu->id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->id_mmfr0 = 0x00000030;
+    cpu->id_mmfr1 = 0x00000000;
+    cpu->id_mmfr2 = 0x00000000;
+    cpu->id_mmfr3 = 0x00000000;
+    cpu->id_isar0 = 0x01141110;
+    cpu->id_isar1 = 0x02111000;
+    cpu->id_isar2 = 0x21112231;
+    cpu->id_isar3 = 0x01111110;
+    cpu->id_isar4 = 0x01310102;
+    cpu->id_isar5 = 0x00000000;
 }
 
 static void cortex_m4_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
     cpu->midr = 0x410fc240; /* r0p0 */
     cpu->pmsav7_dregion = 8;
+    cpu->id_pfr0 = 0x00000030;
+    cpu->id_pfr1 = 0x00000200;
+    cpu->id_dfr0 = 0x00100000;
+    cpu->id_afr0 = 0x00000000;
+    cpu->id_mmfr0 = 0x00000030;
+    cpu->id_mmfr1 = 0x00000000;
+    cpu->id_mmfr2 = 0x00000000;
+    cpu->id_mmfr3 = 0x00000000;
+    cpu->id_isar0 = 0x01141110;
+    cpu->id_isar1 = 0x02111000;
+    cpu->id_isar2 = 0x21112231;
+    cpu->id_isar3 = 0x01111110;
+    cpu->id_isar4 = 0x01310102;
+    cpu->id_isar5 = 0x00000000;
 }
 
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
-- 
2.16.1

The PENDNMISET/CLR bits in the ICSR should be RAZ/WI from
NonSecure state if the AIRCR.BFHFNMINS bit is zero. We had
misimplemented this as making the bits RAZ/WI from both
Secure and NonSecure states. Fix this bug by checking
attrs.secure so that Secure code can pend and unpend NMIs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-3-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             }
         }
         /* NMIPENDSET */
-        if ((cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) &&
-            s->vectors[ARMV7M_EXCP_NMI].pending) {
+        if ((attrs.secure || (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK))
+            && s->vectors[ARMV7M_EXCP_NMI].pending) {
             val |= (1 << 31);
         }
         /* ISRPREEMPT: RES0 when halting debug not implemented */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         break;
     }
     case 0xd04: /* Interrupt Control State (ICSR) */
-        if (cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
+        if (attrs.secure || cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK) {
             if (value & (1 << 31)) {
                 armv7m_nvic_set_pending(s, ARMV7M_EXCP_NMI, false);
             } else if (value & (1 << 30) &&
-- 
2.16.1

For M profile cores, cache maintenance operations are done by
writing to special registers in the system register space.
For QEMU, cache operations are always NOPs, since we don't
implement the cache. Implementing these explicitly avoids
a spurious LOG_GUEST_ERROR when the guest uses them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-4-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     }
+    case 0xf50: /* ICIALLU */
+    case 0xf58: /* ICIMVAU */
+    case 0xf5c: /* DCIMVAC */
+    case 0xf60: /* DCISW */
+    case 0xf64: /* DCCMVAU */
+    case 0xf68: /* DCCMVAC */
+    case 0xf6c: /* DCCSW */
+    case 0xf70: /* DCCIMVAC */
+    case 0xf74: /* DCCISW */
+    case 0xf78: /* BPIALL */
+        /* Cache and branch predictor maintenance: for QEMU these always NOP */
+        break;
     default:
     bad_offset:
         qemu_log_mask(LOG_GUEST_ERROR,
-- 
2.16.1

The Coprocessor Power Control Register (CPPWR) is new in v8M.
It allows software to control whether coprocessors are allowed
to power down and lose their state. QEMU doesn't have any
notion of power control, so we choose the IMPDEF option of
making the whole register RAZ/WI (indicating that no coprocessors
can ever power down and lose state).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

M profile cores have a similar setup for cache ID registers
to A profile:
 * Cache Level ID Register (CLIDR) is a fixed value
 * Cache Type Register (CTR) is a fixed value
 * Cache Size ID Registers (CCSIDR) are a bank of registers;
   which one you see is selected by the Cache Size Selection
   Register (CSSELR)

The only difference is that they're in the NVIC memory mapped
register space rather than being coprocessor registers.
Implement the M profile view of them.

Since neither Cortex-M3 nor Cortex-M4 implement caches,
we don't need to update their init functions and can leave
the ctr/clidr/ccsidr[] fields in their ARMCPU structs at zero.
Newer cores (like the Cortex-M33) will want to be able to
set these ID registers to non-zero values, though.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-6-peter.maydell@linaro.org
---
 target/arm/cpu.h      | 26 ++++++++++++++++++++++++++
 hw/intc/armv7m_nvic.c | 16 ++++++++++++++++
 target/arm/machine.c  | 36 ++++++++++++++++++++++++++++++++++++
 3 files changed, 78 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t faultmask[M_REG_NUM_BANKS];
         uint32_t aircr; /* only holds r/w state if security extn implemented */
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
+        uint32_t csselr[M_REG_NUM_BANKS];
     } v7m;
 
     /* Information associated with an exception about to be taken:
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
 FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
 FIELD(V7M_MPU_CTRL, PRIVDEFENA, 2, 1)
 
+/* v7M CLIDR bits */
+FIELD(V7M_CLIDR, CTYPE_ALL, 0, 21)
+FIELD(V7M_CLIDR, LOUIS, 21, 3)
+FIELD(V7M_CLIDR, LOC, 24, 3)
+FIELD(V7M_CLIDR, LOUU, 27, 3)
+FIELD(V7M_CLIDR, ICB, 30, 2)
+
+FIELD(V7M_CSSELR, IND, 0, 1)
+FIELD(V7M_CSSELR, LEVEL, 1, 3)
+/* We use the combination of InD and Level to index into cpu->ccsidr[];
+ * define a mask for this and check that it doesn't permit running off
+ * the end of the array.
+ */
+FIELD(V7M_CSSELR, INDEX, 0, 4)
+
+QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
+
 /* If adding a feature bit which corresponds to a Linux ELF
  * HWCAP bit, remember to update the feature-bit-to-hwcap
  * mapping in linux-user/elfload.c:get_elf_hwcap().
@@ -XXX,XX +XXX,XX @@ static inline int arm_debug_target_el(CPUARMState *env)
     }
 }
 
+static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
+{
+    /* If all the CLIDR.Ctypem bits are 0 there are no caches, and
+     * CSSELR is RAZ/WI.
+     */
+    return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
+}
+
 static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
 {
     if (arm_is_secure(env)) {
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         return cpu->id_isar4;
     case 0xd74: /* ISAR5.  */
         return cpu->id_isar5;
+    case 0xd78: /* CLIDR */
+        return cpu->clidr;
+    case 0xd7c: /* CTR */
+        return cpu->ctr;
+    case 0xd80: /* CSSIDR */
+    {
+        int idx = cpu->env.v7m.csselr[attrs.secure] & R_V7M_CSSELR_INDEX_MASK;
+        return cpu->ccsidr[idx];
+    }
+    case 0xd84: /* CSSELR */
+        return cpu->env.v7m.csselr[attrs.secure];
     /* TODO: Implement debug registers.  */
     case 0xd90: /* MPU_TYPE */
         /* Unified MPU; if the MPU is not present this value is zero */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         qemu_log_mask(LOG_UNIMP,
                       "NVIC: Aux fault status registers unimplemented\n");
         break;
+    case 0xd84: /* CSSELR */
+        if (!arm_v7m_csselr_razwi(cpu)) {
+            cpu->env.v7m.csselr[attrs.secure] = value & R_V7M_CSSELR_INDEX_MASK;
+        }
+        break;
     case 0xd90: /* MPU_TYPE */
         return; /* RO */
     case 0xd94: /* MPU_CTRL */
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_faultmask_primask = {
     }
 };
 
+/* CSSELR is in a subsection because we didn't implement it previously.
+ * Migration from an old implementation will leave it at zero, which
+ * is OK since the only CPUs in the old implementation make the
+ * register RAZ/WI.
+ * Since there was no version of QEMU which implemented the CSSELR for
+ * just non-secure, we transfer both banks here rather than putting
+ * the secure banked version in the m-security subsection.
+ */
+static bool csselr_vmstate_validate(void *opaque, int version_id)
+{
+    ARMCPU *cpu = opaque;
+
+    return cpu->env.v7m.csselr[M_REG_NS] <= R_V7M_CSSELR_INDEX_MASK
+        && cpu->env.v7m.csselr[M_REG_S] <= R_V7M_CSSELR_INDEX_MASK;
+}
+
+static bool m_csselr_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    return !arm_v7m_csselr_razwi(cpu);
+}
+
+static const VMStateDescription vmstate_m_csselr = {
+    .name = "cpu/m/csselr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = m_csselr_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(env.v7m.csselr, ARMCPU, M_REG_NUM_BANKS),
+        VMSTATE_VALIDATE("CSSELR is valid", csselr_vmstate_validate),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
     .version_id = 4,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
     },
     .subsections = (const VMStateDescription*[]) {
         &vmstate_m_faultmask_primask,
+        &vmstate_m_csselr,
         NULL
     }
 };
-- 
2.16.1

We were previously making the system control register (SCR)
just RAZ/WI. Although we don't implement the functionality
this register controls, we should at least provide the state,
including the banked state for v8M.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-7-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  7 +++++++
 hw/intc/armv7m_nvic.c | 12 ++++++++----
 target/arm/machine.c  | 12 ++++++++++++
 3 files changed, 27 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t aircr; /* only holds r/w state if security extn implemented */
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
         uint32_t csselr[M_REG_NUM_BANKS];
+        uint32_t scr[M_REG_NUM_BANKS];
     } v7m;
 
     /* Information associated with an exception about to be taken:
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_CCR, STKALIGN, 9, 1)
 FIELD(V7M_CCR, DC, 16, 1)
 FIELD(V7M_CCR, IC, 17, 1)
 
+/* V7M SCR bits */
+FIELD(V7M_SCR, SLEEPONEXIT, 1, 1)
+FIELD(V7M_SCR, SLEEPDEEP, 2, 1)
+FIELD(V7M_SCR, SLEEPDEEPS, 3, 1)
+FIELD(V7M_SCR, SEVONPEND, 4, 1)
+
 /* V7M AIRCR bits */
 FIELD(V7M_AIRCR, VECTRESET, 0, 1)
 FIELD(V7M_AIRCR, VECTCLRACTIVE, 1, 1)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return val;
     case 0xd10: /* System Control.  */
-        /* TODO: Implement SLEEPONEXIT.  */
-        return 0;
+        return cpu->env.v7m.scr[attrs.secure];
     case 0xd14: /* Configuration Control.  */
         /* The BFHFNMIGN bit is the only non-banked bit; we
          * keep it in the non-secure copy of the register.
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     case 0xd10: /* System Control.  */
-        /* TODO: Implement control registers.  */
-        qemu_log_mask(LOG_UNIMP, "NVIC: SCR unimplemented\n");
+        /* We don't implement deep-sleep so these bits are RAZ/WI.
+         * The other bits in the register are banked.
+         * QEMU's implementation ignores SEVONPEND and SLEEPONEXIT, which
+         * is architecturally permitted.
+         */
+        value &= ~(R_V7M_SCR_SLEEPDEEP_MASK | R_V7M_SCR_SLEEPDEEPS_MASK);
+        cpu->env.v7m.scr[attrs.secure] = value;
         break;
     case 0xd14: /* Configuration Control.  */
         /* Enforce RAZ/WI on reserved and must-RAZ/WI bits */
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_csselr = {
     }
 };
 
+static const VMStateDescription vmstate_m_scr = {
+    .name = "cpu/m/scr",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.v7m.scr[M_REG_NS], ARMCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
     .version_id = 4,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
     .subsections = (const VMStateDescription*[]) {
         &vmstate_m_faultmask_primask,
         &vmstate_m_csselr,
+        &vmstate_m_scr,
         NULL
     }
 };
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_UINT32(env.sau.rnr, ARMCPU),
         VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
         VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
+        VMSTATE_UINT32(env.v7m.scr[M_REG_S], ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.16.1

In commit 50f11062d4c896 we added support for MSR/MRS access
to the NS banked special registers, but we forgot to implement
the support for writing to CONTROL_NS. Correct the omission.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-8-peter.maydell@linaro.org
---
 target/arm/helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             }
             env->v7m.faultmask[M_REG_NS] = val & 1;
             return;
+        case 0x94: /* CONTROL_NS */
+            if (!env->v7m.secure) {
+                return;
+            }
+            write_v7m_control_spsel_for_secstate(env,
+                                                 val & R_V7M_CONTROL_SPSEL_MASK,
+                                                 M_REG_NS);
+            env->v7m.control[M_REG_NS] &= ~R_V7M_CONTROL_NPRIV_MASK;
+            env->v7m.control[M_REG_NS] |= val & R_V7M_CONTROL_NPRIV_MASK;
+            return;
         case 0x98: /* SP_NS */
         {
             /* This gives the non-secure SP selected based on whether we're
-- 
2.16.1

In many of the NVIC registers relating to interrupts, we
have to convert from a byte offset within a register set
into the number of the first interrupt which is affected.
We were getting this wrong for:
 * reads of NVIC_ISPR<n>, NVIC_ISER<n>, NVIC_ICPR<n>, NVIC_ICER<n>,
   NVIC_IABR<n> -- in all these cases we were missing the "* 8"
   needed to convert from the byte offset to the interrupt number
   (since all these registers use one bit per interrupt)
 * writes of NVIC_IPR<n> had the opposite problem of a spurious
   "* 8" (since these registers use one byte per interrupt)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180209165810.6668-9-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
         /* fall through */
     case 0x180 ... 0x1bf: /* NVIC Clear enable */
         val = 0;
-        startvec = offset - 0x180 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x180) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].enabled &&
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
         /* fall through */
     case 0x280 ... 0x2bf: /* NVIC Clear pend */
         val = 0;
-        startvec = offset - 0x280 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x280) + NVIC_FIRST_IRQ; /* vector # */
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].pending &&
                 (attrs.secure || s->itns[startvec + i])) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
         break;
     case 0x300 ... 0x33f: /* NVIC Active */
         val = 0;
-        startvec = offset - 0x300 + NVIC_FIRST_IRQ; /* vector # */
+        startvec = 8 * (offset - 0x300) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0, end = size * 8; i < end && startvec + i < s->num_irq; i++) {
             if (s->vectors[startvec + i].active &&
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
     case 0x300 ... 0x33f: /* NVIC Active */
         return MEMTX_OK; /* R/O */
     case 0x400 ... 0x5ef: /* NVIC Priority */
-        startvec = 8 * (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
+        startvec = (offset - 0x400) + NVIC_FIRST_IRQ; /* vector # */
 
         for (i = 0; i < size && startvec + i < s->num_irq; i++) {
             if (attrs.secure || s->itns[startvec + i]) {
-- 
2.16.1

In commit commit 3b2e934463121 we added support for the AIRCR
register holding state, but forgot to add it to the vmstate
structs. Since it only holds r/w state if the security extension
is implemented, we can just add it to vmstate_m_security.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-10-peter.maydell@linaro.org
---
 target/arm/machine.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
         VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
         VMSTATE_UINT32(env.v7m.scr[M_REG_S], ARMCPU),
+        /* AIRCR is not secure-only, but our implementation is R/O if the
+         * security extension is unimplemented, so we migrate it here.
+         */
+        VMSTATE_UINT32(env.v7m.aircr, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.16.1

In commit abc24d86cc0364f we accidentally broke migration of
the stack pointer value for the mode (process, handler) the CPU
is not currently running as. (The commit correctly removed the
no-longer-used v7m.current_sp flag from the VMState but also
deleted the still very much in use v7m.other_sp SP value field.)

Add a subsection to migrate it again. (We don't need to care
about trying to retain compatibility with pre-abc24d86cc0364f
versions of QEMU, because that commit bumped the version_id
and we've since bumped it again a couple of times.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-11-peter.maydell@linaro.org
---
 target/arm/machine.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_scr = {
     }
 };
 
+static const VMStateDescription vmstate_m_other_sp = {
+    .name = "cpu/m/other-sp",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.v7m.other_sp, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
     .version_id = 4,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
         &vmstate_m_faultmask_primask,
         &vmstate_m_csselr,
         &vmstate_m_scr,
+        &vmstate_m_other_sp,
         NULL
     }
 };
-- 
2.16.1

The v8M architecture includes hardware support for enforcing
stack pointer limits. We don't implement this behaviour yet,
but provide the MSPLIM and PSPLIM stack pointer limit registers
as reads-as-written, so that when we do implement the checks
in future this won't break guest migration.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180209165810.6668-12-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  2 ++
 target/arm/helper.c  | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/machine.c | 21 +++++++++++++++++++++
 3 files changed, 69 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t secure; /* Is CPU in Secure state? (not guest visible) */
         uint32_t csselr[M_REG_NUM_BANKS];
         uint32_t scr[M_REG_NUM_BANKS];
+        uint32_t msplim[M_REG_NUM_BANKS];
+        uint32_t psplim[M_REG_NUM_BANKS];
     } v7m;
 
     /* Information associated with an exception about to be taken:
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
                 return 0;
             }
             return env->v7m.other_ss_psp;
+        case 0x8a: /* MSPLIM_NS */
+            if (!env->v7m.secure) {
+                return 0;
+            }
+            return env->v7m.msplim[M_REG_NS];
+        case 0x8b: /* PSPLIM_NS */
+            if (!env->v7m.secure) {
+                return 0;
+            }
+            return env->v7m.psplim[M_REG_NS];
         case 0x90: /* PRIMASK_NS */
             if (!env->v7m.secure) {
                 return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
         return v7m_using_psp(env) ? env->v7m.other_sp : env->regs[13];
     case 9: /* PSP */
         return v7m_using_psp(env) ? env->regs[13] : env->v7m.other_sp;
+    case 10: /* MSPLIM */
+        if (!arm_feature(env, ARM_FEATURE_V8)) {
+            goto bad_reg;
+        }
+        return env->v7m.msplim[env->v7m.secure];
+    case 11: /* PSPLIM */
+        if (!arm_feature(env, ARM_FEATURE_V8)) {
+            goto bad_reg;
+        }
+        return env->v7m.psplim[env->v7m.secure];
     case 16: /* PRIMASK */
         return env->v7m.primask[env->v7m.secure];
     case 17: /* BASEPRI */
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
     case 19: /* FAULTMASK */
         return env->v7m.faultmask[env->v7m.secure];
     default:
+    bad_reg:
         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to read unknown special"
                                        " register %d\n", reg);
         return 0;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             }
             env->v7m.other_ss_psp = val;
             return;
+        case 0x8a: /* MSPLIM_NS */
+            if (!env->v7m.secure) {
+                return;
+            }
+            env->v7m.msplim[M_REG_NS] = val & ~7;
+            return;
+        case 0x8b: /* PSPLIM_NS */
+            if (!env->v7m.secure) {
+                return;
+            }
+            env->v7m.psplim[M_REG_NS] = val & ~7;
+            return;
         case 0x90: /* PRIMASK_NS */
             if (!env->v7m.secure) {
                 return;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             env->v7m.other_sp = val;
         }
         break;
+    case 10: /* MSPLIM */
+        if (!arm_feature(env, ARM_FEATURE_V8)) {
+            goto bad_reg;
+        }
+        env->v7m.msplim[env->v7m.secure] = val & ~7;
+        break;
+    case 11: /* PSPLIM */
+        if (!arm_feature(env, ARM_FEATURE_V8)) {
+            goto bad_reg;
+        }
+        env->v7m.psplim[env->v7m.secure] = val & ~7;
+        break;
     case 16: /* PRIMASK */
         env->v7m.primask[env->v7m.secure] = val & 1;
         break;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
         break;
     default:
+    bad_reg:
         qemu_log_mask(LOG_GUEST_ERROR, "Attempt to write unknown special"
                                        " register %d\n", reg);
         return;
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_other_sp = {
     }
 };
 
+static bool m_v8m_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+
+    return arm_feature(env, ARM_FEATURE_M) && arm_feature(env, ARM_FEATURE_V8);
+}
+
+static const VMStateDescription vmstate_m_v8m = {
+    .name = "cpu/m/v8m",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = m_v8m_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(env.v7m.msplim, ARMCPU, M_REG_NUM_BANKS),
+        VMSTATE_UINT32_ARRAY(env.v7m.psplim, ARMCPU, M_REG_NUM_BANKS),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_m = {
     .name = "cpu/m",
     .version_id = 4,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m = {
         &vmstate_m_csselr,
         &vmstate_m_scr,
         &vmstate_m_other_sp,
+        &vmstate_m_v8m,
         NULL
     }
 };
-- 
2.16.1

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0