Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 00/33] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+Another arm pullreq; nothing particularly exciting here.
 as well put them in to rc0...
-thanks
 -- PMM
-The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
+The following changes since commit e27d5b488ef08408691bfed61f34ee2858136287:
   Merge remote-tracking branch 'remotes/juanquintela/tags/pull-migration-pull-request' into staging (2020-02-28 14:02:31 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200228
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 1904f9b5f1d94fe12fe021db6b504c87d684f6db:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2 (2020-02-28 16:14:57 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * hw/arm: Use TYPE_PL011 to create serial port
- * dump: Update correct kdump phys_base field for AArch64
+ * target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
- * char: i.MX: Add support for "TX complete" interrupt
+ * hw/arm/integratorcp: Map the audio codec controller
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * GICv2: Correctly implement the limited number of priority bits
-   to boot a Debian Linux kernel on raspi3
+ * target/arm: refactoring of VFP related feature checks and decode
  * xilinx_zynq: Fix USB port instantiation
  * acceptance tests for n800, n810, integratorcp
  * Implement v8.3-RCPC, v8.4-RCPC, v8.3-CCIDX
  * arm_gic_kvm: Don't assume kernel can provide a GICv2
    (provide better error message for user error)
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Gavin Shan (1):
-      char: i.MX: Simplify imx_update()
+      hw/arm: Use TYPE_PL011 to create serial port
       char: i.MX: Add support for "TX complete" interrupt
-Guenter Roeck (1):
+Guenter Roeck (2):
-      fsl-imx6: Swap Ethernet interrupt defines
+      hw/arm/xilinx_zynq: Fix USB port instantiation
       hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class
-Peter Maydell (9):
+Peter Maydell (5):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
-      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+      target/arm: Implement v8.3-RCPC
-      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+      target/arm: Implement v8.4-RCPC
-      hw/arm/bcm2386: Fix parent type of bcm2386
+      target/arm: Implement ARMv8.3-CCIDX
-      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+      hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2
       hw/arm/bcm2836: Create proper bcm2837 device
       hw/arm/bcm2836: Use correct affinity values for BCM2837
       hw/arm/bcm2836: Hardcode correct CPU type
       hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
-Wei Huang (1):
+Philippe Mathieu-Daudé (3):
-      dump: Update correct kdump phys_base field for AArch64
+      hw/arm/integratorcp: Map the audio codec controller
       tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
       tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+Richard Henderson (17):
- include/hw/arm/fsl-imx6.h    |  4 +-
+      target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
- include/hw/char/imx_serial.h |  3 ++
+      target/arm: Add isar_feature_aa32_vfp_simd
- dump.c                       | 14 +++++--
+      target/arm: Rename isar_feature_aa32_fpdp_v2
- hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
+      target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
- hw/arm/boot.c                | 12 ++++++
+      target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
- hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
+      target/arm: Perform fpdp_v2 check first
- hw/char/imx_serial.c         | 44 ++++++++++++++++------
+      target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
- hw/net/imx_fec.c             | 28 +++++++++++++-
+      target/arm: Add missing checks for fpsp_v2
-files changed, 237 insertions(+), 63 deletions(-)
+      target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
       target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
       target/arm: Move VLLDM and VLSTM to vfp.decode
       target/arm: Move the vfp decodetree calls next to the base isa
       linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
       target/arm: Remove ARM_FEATURE_VFP*
       target/arm: Add formats for some vfp 2 and 3-register insns
       target/arm: Split VFM decode
       target/arm: Split VMINMAXNM decode
+Sai Pavan Boddu (3):
+      arm_gic: Mask the un-supported priority bits
+      cpu/a9mpcore: Set number of GIC priority bits to 5
+      cpu/arm11mpcore: Set number of GIC priority bits to 4
+Thomas Huth (2):
+      tests/acceptance: Add a test for the N800 and N810 arm machines
+      tests/acceptance: Add a test for the integratorcp arm machine
+ include/hw/intc/arm_gic.h                    |   2 +
+ include/hw/intc/arm_gic_common.h             |   1 +
+ target/arm/cpu.h                             |  88 +++++-
+ hw/arm/integratorcp.c                        |   1 +
+ hw/arm/sbsa-ref.c                            |   3 +-
+ hw/arm/virt.c                                |   3 +-
+ hw/arm/xilinx_zynq.c                         |   5 +-
+ hw/arm/xlnx-versal.c                         |   3 +-
+ hw/cpu/a9mpcore.c                            |   4 +
+ hw/cpu/arm11mpcore.c                         |   5 +
+ hw/intc/arm_gic.c                            |  33 +-
+ hw/intc/arm_gic_common.c                     |   1 +
+ hw/intc/arm_gic_kvm.c                        |   9 +
+ hw/intc/armv7m_nvic.c                        |  20 +-
+ hw/usb/hcd-ehci-sysbus.c                     |  17 -
+ linux-user/arm/signal.c                      |   4 +-
+ linux-user/elfload.c                         |  25 +-
+ target/arm/arch_dump.c                       |  11 +-
+ target/arm/cpu.c                             |  44 +--
+ target/arm/cpu64.c                           |   5 +-
+ target/arm/helper.c                          |  23 +-
+ target/arm/kvm32.c                           |   5 -
+ target/arm/kvm64.c                           |   1 -
+ target/arm/m_helper.c                        |  11 +-
+ target/arm/machine.c                         |   5 +-
+ target/arm/translate-a64.c                   | 114 +++++++
+ target/arm/translate-vfp.inc.c               | 448 +++++++++++++++++----------
+ target/arm/translate.c                       | 122 ++------
+ MAINTAINERS                                  |   2 +
+ hw/arm/Kconfig                               |   1 +
+ target/arm/vfp-uncond.decode                 |  12 +-
+ target/arm/vfp.decode                        | 153 ++++-----
+ tests/acceptance/machine_arm_integratorcp.py |  99 ++++++
+ tests/acceptance/machine_arm_n8x0.py         |  49 +++
+files changed, 865 insertions(+), 464 deletions(-)
+ create mode 100644 tests/acceptance/machine_arm_integratorcp.py
+ create mode 100644 tests/acceptance/machine_arm_n8x0.py

-New patch
+[PULL 01/33] hw/arm: Use TYPE_PL011 to create serial port
+From: Gavin Shan <gshan@redhat.com>
+This uses TYPE_PL011 when creating the serial port so that the code
+looks cleaner.
+Signed-off-by: Gavin Shan <gshan@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20200224222223.4128-1-gshan@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/sbsa-ref.c    | 3 ++-
+ hw/arm/virt.c        | 3 ++-
+ hw/arm/xlnx-versal.c | 3 ++-
+files changed, 6 insertions(+), 3 deletions(-)
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/sbsa-ref.c
++++ b/hw/arm/sbsa-ref.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/pci-host/gpex.h"
+ #include "hw/qdev-properties.h"
+ #include "hw/usb.h"
++#include "hw/char/pl011.h"
+ #include "net/net.h"
+ #define RAMLIMIT_GB 8192
+@@ -XXX,XX +XXX,XX @@ static void create_uart(const SBSAMachineState *sms, int uart,
+ {
+     hwaddr base = sbsa_ref_memmap[uart].base;
+     int irq = sbsa_ref_irqmap[uart];
+-    DeviceState *dev = qdev_create(NULL, "pl011");
++    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
+     SysBusDevice *s = SYS_BUS_DEVICE(dev);
+     qdev_prop_set_chr(dev, "chardev", chr);
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/mem/nvdimm.h"
+ #include "hw/acpi/generic_event_device.h"
+ #include "hw/virtio/virtio-iommu.h"
++#include "hw/char/pl011.h"
+ #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
+     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
+@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, int uart,
+     int irq = vms->irqmap[uart];
+     const char compat[] = "arm,pl011\0arm,primecell";
+     const char clocknames[] = "uartclk\0apb_pclk";
+-    DeviceState *dev = qdev_create(NULL, "pl011");
++    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
+     SysBusDevice *s = SYS_BUS_DEVICE(dev);
+     qdev_prop_set_chr(dev, "chardev", chr);
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/misc/unimp.h"
+ #include "hw/intc/arm_gicv3_common.h"
+ #include "hw/arm/xlnx-versal.h"
++#include "hw/char/pl011.h"
+ #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+ #define GEM_REVISION        0x40070106
+@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
+         DeviceState *dev;
+         MemoryRegion *mr;
+-        dev = qdev_create(NULL, "pl011");
++        dev = qdev_create(NULL, TYPE_PL011);
+         s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
+         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+         object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+--
+.20.1

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 02/33] target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
-The bcm2837 is pretty similar to the bcm2836, but it does have
+From: Richard Henderson <richard.henderson@linaro.org>
 some differences. Notably, the MPIDR affinity aff1 values it
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
-Rather than trying to have one device with properties that
+We had set this for aarch32-only in arm_max_initfn, but
-configure it differently for the two cases, create two
+failed to set the same bit for aarch64.
 separate QOM devices for the two SoCs. We use the same approach
 as hw/arm/aspeed_soc.c and share code and have a data table
 that might differ per-SoC. For the moment the two types don't
 actually have different behaviour.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200218190958.745-2-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ target/arm/cpu64.c | 1 +
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+file changed, 1 insertion(+)
  hw/arm/raspi.c           |  3 ++-
 files changed, 53 insertions(+), 6 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/cpu64.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+         cpu->isar.id_mmfr3 = u;
- #define BCM283X_NCPUS 4
+         u = cpu->isar.id_mmfr4;
-+/* These type names are for specific SoCs; other than instantiating
++        u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
-+ * them, code using these devices should always handle them via the
+         u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+         cpu->isar.id_mmfr4 = u;
 + */
 +#define TYPE_BCM2836 "bcm2836"
 +#define TYPE_BCM2837 "bcm2837"
 +
  typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
      BCM2835PeripheralState peripherals;
  } BCM283XState;
 +typedef struct BCM283XInfo BCM283XInfo;
 +
 +typedef struct BCM283XClass {
 +    DeviceClass parent_class;
 +    const BCM283XInfo *info;
 +} BCM283XClass;
 +
 +#define BCM283X_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
 +#define BCM283X_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 +
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2836.c
 +++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
  /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
  #define BCM2836_CONTROL_BASE    0x40000000
 +struct BCM283XInfo {
 +    const char *name;
 +};
 +
 +static const BCM283XInfo bcm283x_socs[] = {
 +    {
 +        .name = TYPE_BCM2836,
 +    },
 +    {
 +        .name = TYPE_BCM2837,
 +    },
 +};
 +
  static void bcm2836_init(Object *obj)
  {
      BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
      DEFINE_PROP_END_OF_LIST()
  };
 -static void bcm2836_class_init(ObjectClass *oc, void *data)
 +static void bcm283x_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 +    BCM283XClass *bc = BCM283X_CLASS(oc);
 -    dc->props = bcm2836_props;
 +    bc->info = data;
      dc->realize = bcm2836_realize;
 +    dc->props = bcm2836_props;
  }
 -static const TypeInfo bcm2836_type_info = {
 +static const TypeInfo bcm283x_type_info = {
      .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
      .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
 -    .class_init = bcm2836_class_init,
 +    .class_size = sizeof(BCM283XClass),
 +    .abstract = true,
  };
  static void bcm2836_register_types(void)
  {
 -    type_register_static(&bcm2836_type_info);
 +    int i;
 +
 +    type_register_static(&bcm283x_type_info);
 +    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
 +        TypeInfo ti = {
 +            .name = bcm283x_socs[i].name,
 +            .parent = TYPE_BCM283X,
 +            .class_init = bcm283x_class_init,
 +            .class_data = (void *) &bcm283x_socs[i],
 +        };
 +        type_register(&ti);
 +    }
  }
  type_init(bcm2836_register_types)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
 +    object_initialize(&s->soc, sizeof(s->soc),
 +                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
 --
-.16.2
+.20.1

-New patch
+[PULL 03/33] hw/arm/integratorcp: Map the audio codec controller
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+The Linux kernel displays errors why trying to detect the PL041
+audio interface:
+  Linux version 4.16.0 (linus@genomnajs) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #142 PREEMPT Wed May 9 13:24:55 CEST 2018
+  CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00093177
+  CPU: VIVT data cache, VIVT instruction cache
+  OF: fdt: Machine model: ARM Integrator/CP
+  ...
+  OF: amba_device_add() failed (-19) for /fpga/aaci@1d000000
+Since we have it already modelled, simply plug it.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200223233033.15371-2-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/integratorcp.c | 1 +
+ hw/arm/Kconfig        | 1 +
+files changed, 2 insertions(+)
+diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/integratorcp.c
++++ b/hw/arm/integratorcp.c
+@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
+                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_WPROT, 0));
+     qdev_connect_gpio_out(dev, 1,
+                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_CARDIN, 0));
++    sysbus_create_varargs("pl041", 0x1d000000, pic[25], NULL);
+     if (nd_table[0].used)
+         smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
+     select INTEGRATOR_DEBUG
+     select PL011 # UART
+     select PL031 # RTC
++    select PL041 # audio
+     select PL050 # keyboard/mouse
+     select PL110 # pl111 LCD controller
+     select PL181 # display
+--
+.20.1

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 04/33] arm_gic: Mask the un-supported priority bits
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
 is required for Linux to boot.
+The GICv2 allows the implementation to implement a variable number
+of priority bits; unimplemented bits in the priority registers
+are read as zeros, writes ignored. We were previously always
+implementing a full 8 bits of priority, which is allowed but not
+what the real hardware typically does (which is usually to have
+or 5 bits of priority).
+Add a new device property to allow the number of implemented
+property bits to be specified.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Message-id: 1582537164-764-2-git-send-email-sai.pavan.boddu@xilinx.com
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: improved commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ include/hw/intc/arm_gic.h        |  2 ++
-file changed, 7 insertions(+), 4 deletions(-)
+ include/hw/intc/arm_gic_common.h |  1 +
  hw/intc/arm_gic.c                | 33 ++++++++++++++++++++++++++++++--
  hw/intc/arm_gic_common.c         |  1 +
 files changed, 35 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/include/hw/intc/arm_gic.h
-+++ b/hw/arm/bcm2836.c
++++ b/include/hw/intc/arm_gic.h
 @@ -XXX,XX +XXX,XX @@
- struct BCM283XInfo {
+ /* Number of SGI target-list bits */
-     const char *name;
+ #define GIC_TARGETLIST_BITS 8
-+    int clusterid;
++#define GIC_MAX_PRIORITY_BITS 8
 +#define GIC_MIN_PRIORITY_BITS 4
  #define TYPE_ARM_GIC "arm_gic"
  #define ARM_GIC(obj) \
 diff --git a/include/hw/intc/arm_gic_common.h b/include/hw/intc/arm_gic_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gic_common.h
 +++ b/include/hw/intc/arm_gic_common.h
@@ -XXX,XX +XXX,XX @@ typedef struct GICState {
      uint16_t priority_mask[GIC_NCPU_VCPU];
      uint16_t running_priority[GIC_NCPU_VCPU];
      uint16_t current_pending[GIC_NCPU_VCPU];
 +    uint32_t n_prio_bits;
      /* If we present the GICv2 without security extensions to a guest,
       * the guest can configure the GICC_CTLR to configure group 1 binary point
 diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic.c
 +++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
      return ret;
  }
 +static uint32_t gic_fullprio_mask(GICState *s, int cpu)
 +{
 +    /*
 +     * Return a mask word which clears the unimplemented priority
 +     * bits from a priority value for an interrupt. (Not to be
 +     * confused with the group priority, whose mask depends on BPR.)
 +     */
 +    int priBits;
 +
 +    if (gic_is_vcpu(cpu)) {
 +        priBits = GIC_VIRT_MAX_GROUP_PRIO_BITS;
 +    } else {
 +        priBits = s->n_prio_bits;
 +    }
 +    return ~0U << (8 - priBits);
 +}
 +
  void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
                        MemTxAttrs attrs)
  {
@@ -XXX,XX +XXX,XX @@ void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
          val = 0x80 | (val >> 1); /* Non-secure view */
      }
 +    val &= gic_fullprio_mask(s, cpu);
 +
      if (irq < GIC_INTERNAL) {
          s->priority1[irq][cpu] = val;
      } else {
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_get_priority(GICState *s, int cpu, int irq,
          }
          prio = (prio << 1) & 0xff; /* Non-secure view */
      }
 -    return prio;
 +    return prio & gic_fullprio_mask(s, cpu);
  }
  static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
@@ -XXX,XX +XXX,XX @@ static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
              return;
          }
      }
 -    s->priority_mask[cpu] = pmask;
 +    s->priority_mask[cpu] = pmask & gic_fullprio_mask(s, cpu);
  }
  static uint32_t gic_get_priority_mask(GICState *s, int cpu, MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
          return;
      }
 +    if (s->n_prio_bits > GIC_MAX_PRIORITY_BITS ||
 +       (s->virt_extn ? s->n_prio_bits < GIC_VIRT_MAX_GROUP_PRIO_BITS :
 +        s->n_prio_bits < GIC_MIN_PRIORITY_BITS)) {
 +        error_setg(errp, "num-priority-bits cannot be greater than %d"
 +                   " or less than %d", GIC_MAX_PRIORITY_BITS,
 +                   s->virt_extn ? GIC_VIRT_MAX_GROUP_PRIO_BITS :
 +                   GIC_MIN_PRIORITY_BITS);
 +        return;
 +    }
 +
      /* This creates distributor, main CPU interface (s->cpuiomem[0]) and if
       * enabled, virtualization extensions related interfaces (main virtual
       * interface (s->vifaceiomem[0]) and virtual CPU interface).
 diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic_common.c
 +++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
      DEFINE_PROP_BOOL("has-security-extensions", GICState, security_extn, 0),
      /* True if the GIC should implement the virtualization extensions */
      DEFINE_PROP_BOOL("has-virtualization-extensions", GICState, virt_extn, 0),
 +    DEFINE_PROP_UINT32("num-priority-bits", GICState, n_prio_bits, 8),
      DEFINE_PROP_END_OF_LIST(),
  };
- static const BCM283XInfo bcm283x_socs[] = {
-     {
-         .name = TYPE_BCM2836,
-+        .clusterid = 0xf,
-     },
-     {
-         .name = TYPE_BCM2837,
-+        .clusterid = 0x0,
-     },
- };
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
- static void bcm2836_realize(DeviceState *dev, Error **errp)
- {
-     BCM283XState *s = BCM283X(dev);
-+    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
-+    const BCM283XInfo *info = bc->info;
-     Object *obj;
-     Error *err = NULL;
-     int n;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
-         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
-     for (n = 0; n < BCM283X_NCPUS; n++) {
--        /* Mirror bcm2836, which has clusterid set to 0xf
--         * TODO: this should be converted to a property of ARM_CPU
--         */
--        s->cpus[n].mp_affinity = 0xF00 | n;
-+        /* TODO: this should be converted to a property of ARM_CPU */
-+        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
-         /* set periphbase/CBAR value for CPU-local registers */
-         object_property_set_int(OBJECT(&s->cpus[n]),
 --
-.16.2
+.20.1

-New patch
+[PULL 05/33] cpu/a9mpcore: Set number of GIC priority bits to 5
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+All A9 CPUs have a GIC with 5 bits of priority.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 1582537164-764-3-git-send-email-sai.pavan.boddu@xilinx.com
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/cpu/a9mpcore.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/cpu/a9mpcore.c
++++ b/hw/cpu/a9mpcore.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/qdev-properties.h"
+ #include "hw/core/cpu.h"
++#define A9_GIC_NUM_PRIORITY_BITS    5
++
+ static void a9mp_priv_set_irq(void *opaque, int irq, int level)
+ {
+     A9MPPrivState *s = (A9MPPrivState *)opaque;
+@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_realize(DeviceState *dev, Error **errp)
+     gicdev = DEVICE(&s->gic);
+     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
+     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
++    qdev_prop_set_uint32(gicdev, "num-priority-bits",
++                         A9_GIC_NUM_PRIORITY_BITS);
+     /* Make the GIC's TZ support match the CPUs. We assume that
+      * either all the CPUs have TZ, or none do.
+--
+.20.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+[PULL 06/33] cpu/arm11mpcore: Set number of GIC priority bits to 4
-If we're directly booting a Linux kernel and the CPU supports both
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 EL3 and EL2, we start the kernel in EL2, as it expects. We must also
 set the SCR_EL3.HCE bit in this situation, so that the HVC
 instruction is enabled rather than UNDEFing. Otherwise at least some
 kernels will panic when trying to initialize KVM in the guest.
+The GIC built into the ARM11MPCore is always implemented with 4
+priority bits; set the GIC property accordingly.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 1582537164-764-4-git-send-email-sai.pavan.boddu@xilinx.com
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: tweaked commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 5 +++++
+ hw/cpu/arm11mpcore.c | 5 +++++
 file changed, 5 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/cpu/arm11mpcore.c
-+++ b/hw/arm/boot.c
++++ b/hw/cpu/arm11mpcore.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@
-                     assert(!info->secure_board_setup);
+ #include "hw/irq.h"
-                 }
+ #include "hw/qdev-properties.h"
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
++#define ARM11MPCORE_NUM_GIC_PRIORITY_BITS    4
-+                    /* If we have EL2 then Linux expects the HVC insn to work */
-+                    env->cp15.scr_el3 |= SCR_HCE;
+ static void mpcore_priv_set_irq(void *opaque, int irq, int level)
-+                }
+ {
@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_realize(DeviceState *dev, Error **errp)
      qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
      qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
 +    qdev_prop_set_uint32(gicdev, "num-priority-bits",
 +                         ARM11MPCORE_NUM_GIC_PRIORITY_BITS);
 +
-                 /* Set to non-secure if not a secure boot */
++
-                 if (!info->secure_boot &&
+     object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
-                     (cs != first_cpu || !info->secure_board_setup)) {
+     if (err != NULL) {
          error_propagate(errp, err);
 --
-.16.2
+.20.1

-New patch
+[PULL 07/33] target/arm: Add isar_feature_aa32_vfp_simd
+From: Richard Henderson <richard.henderson@linaro.org>
 Use this in the places that were checking ARM_FEATURE_VFP, and
 are obviously testing for the existance of the register set
 as opposed to testing for some particular instruction extension.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200224222232.13807-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h        |  9 +++++++++
  hw/intc/armv7m_nvic.c   | 20 ++++++++++----------
  linux-user/arm/signal.c |  4 ++--
  target/arm/arch_dump.c  | 11 ++++++-----
  target/arm/cpu.c        |  4 ++--
  target/arm/helper.c     |  4 ++--
  target/arm/m_helper.c   | 11 ++++++-----
 files changed, 37 insertions(+), 26 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
  }
 +static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
 +{
 +    /*
 +     * Return true if either VFP or SIMD is implemented.
 +     * In this case, a minimum of VFP w/ D0-D15.
 +     */
 +    return FIELD_EX32(id->mvfr0, MVFR0, SIMDREG) > 0;
 +}
 +
  static inline bool isar_feature_aa32_simd_r32(const ARMISARegisters *id)
  {
      /* Return true if D16-D31 are implemented */
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
      case 0xd84: /* CSSELR */
          return cpu->env.v7m.csselr[attrs.secure];
      case 0xd88: /* CPACR */
 -        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
              return 0;
          }
          return cpu->env.v7m.cpacr[attrs.secure];
      case 0xd8c: /* NSACR */
 -        if (!attrs.secure || !arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
              return 0;
          }
          return cpu->env.v7m.nsacr;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
          }
          return cpu->env.v7m.sfar;
      case 0xf34: /* FPCCR */
 -        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
              return 0;
          }
          if (attrs.secure) {
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
              return value;
          }
      case 0xf38: /* FPCAR */
 -        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
              return 0;
          }
          return cpu->env.v7m.fpcar[attrs.secure];
      case 0xf3c: /* FPDSCR */
 -        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
              return 0;
          }
          return cpu->env.v7m.fpdscr[attrs.secure];
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          }
          break;
      case 0xd88: /* CPACR */
 -        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              /* We implement only the Floating Point extension's CP10/CP11 */
              cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
          }
          break;
      case 0xd8c: /* NSACR */
 -        if (attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
              /* We implement only the Floating Point extension's CP10/CP11 */
              cpu->env.v7m.nsacr = value & (3 << 10);
          }
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          break;
      }
      case 0xf34: /* FPCCR */
 -        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              /* Not all bits here are banked. */
              uint32_t fpccr_s;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          }
          break;
      case 0xf38: /* FPCAR */
 -        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              value &= ~7;
              cpu->env.v7m.fpcar[attrs.secure] = value;
          }
          break;
      case 0xf3c: /* FPDSCR */
 -        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              value &= 0x07c00000;
              cpu->env.v7m.fpdscr[attrs.secure] = value;
          }
 diff --git a/linux-user/arm/signal.c b/linux-user/arm/signal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/arm/signal.c
 +++ b/linux-user/arm/signal.c
@@ -XXX,XX +XXX,XX @@ static void setup_sigframe_v2(struct target_ucontext_v2 *uc,
      setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);
      /* Save coprocessor signal frame.  */
      regspace = uc->tuc_regspace;
 -    if (arm_feature(env, ARM_FEATURE_VFP)) {
 +    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
          regspace = setup_sigframe_v2_vfp(regspace, env);
      }
      if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -XXX,XX +XXX,XX @@ static int do_sigframe_return_v2(CPUARMState *env,
      /* Restore coprocessor signal frame */
      regspace = uc->tuc_regspace;
 -    if (arm_feature(env, ARM_FEATURE_VFP)) {
 +    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
          regspace = restore_sigframe_v2_vfp(env, regspace);
          if (!regspace) {
              return 1;
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arch_dump.c
 +++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
                               int cpuid, void *opaque)
  {
      struct arm_note note;
 -    CPUARMState *env = &ARM_CPU(cs)->env;
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
      DumpState *s = opaque;
 -    int ret, i, fpvalid = !!arm_feature(env, ARM_FEATURE_VFP);
 +    int ret, i;
 +    bool fpvalid = cpu_isar_feature(aa32_vfp_simd, cpu);
      arm_note_init(&note, s, "CORE", 5, NT_PRSTATUS, sizeof(note.prstatus));
@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
  ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
  {
      ARMCPU *cpu = ARM_CPU(first_cpu);
 -    CPUARMState *env = &cpu->env;
      size_t note_size;
      if (class == ELFCLASS64) {
@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
          note_size += AARCH64_PRFPREG_NOTE_SIZE;
  #ifdef TARGET_AARCH64
          if (cpu_isar_feature(aa64_sve, cpu)) {
 -            note_size += AARCH64_SVE_NOTE_SIZE(env);
 +            note_size += AARCH64_SVE_NOTE_SIZE(&cpu->env);
          }
  #endif
      } else {
          note_size = ARM_PRSTATUS_NOTE_SIZE;
 -        if (arm_feature(env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              note_size += ARM_VFP_NOTE_SIZE;
          }
      }
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
              env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
          }
 -        if (arm_feature(env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
              env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
                  R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
          int numvfpregs = 0;
          if (cpu_isar_feature(aa32_simd_r32, cpu)) {
              numvfpregs = 32;
 -        } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 +        } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
              numvfpregs = 16;
          }
          for (i = 0; i < numvfpregs; i++) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
           * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
           * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
           */
 -        if (arm_feature(env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
              /* VFP coprocessor: cp10 & cp11 [23:20] */
              mask |= (1 << 31) | (1 << 30) | (0xf << 20);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
      } else if (cpu_isar_feature(aa32_simd_r32, cpu)) {
          gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
 , "arm-vfp3.xml", 0);
 -    } else if (arm_feature(env, ARM_FEATURE_VFP)) {
 +    } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
          gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
 , "arm-vfp.xml", 0);
      }
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
       */
      uint32_t sig = 0xfefa125a;
 -    if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
 +    if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
 +        || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
          sig |= 1;
      }
      return sig;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
      if (dotailchain) {
          /* Sanitize LR FType and PREFIX bits */
 -        if (!arm_feature(env, ARM_FEATURE_VFP)) {
 +        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
              lr |= R_V7M_EXCRET_FTYPE_MASK;
          }
          lr = deposit32(lr, 24, 8, 0xff);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
 -    if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
 +    if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
          qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
                        "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
                        "if FPU not present\n",
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
               * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
               * RES0 if the FPU is not present, and is stored in the S bank
               */
 -            if (arm_feature(env, ARM_FEATURE_VFP) &&
 +            if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
                  extract32(env->v7m.nsacr, 10, 1)) {
                  env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
                  env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
              env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
          }
 -        if (arm_feature(env, ARM_FEATURE_VFP)) {
 +        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
              /*
               * SFPA is RAZ/WI from NS or if no FPU.
               * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
 --
 .20.1

-New patch
+[PULL 08/33] target/arm: Rename isar_feature_aa32_fpdp_v2
+From: Richard Henderson <richard.henderson@linaro.org>
 The old name, isar_feature_aa32_fpdp, does not reflect
 that the test includes VFPv2.  We will introduce another
 feature tests for VFPv3.
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h               |  4 ++--
  target/arm/translate-vfp.inc.c | 40 +++++++++++++++++-----------------
 files changed, 22 insertions(+), 22 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
      return FIELD_EX32(id->mvfr0, MVFR0, FPSHVEC) > 0;
  }
 -static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
 +static inline bool isar_feature_aa32_fpdp_v2(const ARMISARegisters *id)
  {
 -    /* Return true if CPU supports double precision floating point */
 +    /* Return true if CPU supports double precision floating point, VFPv2 */
      return FIELD_EX32(id->mvfr0, MVFR0, FPDP) > 0;
  }
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 --
 .20.1

-New patch
+[PULL 09/33] target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
+From: Richard Henderson <richard.henderson@linaro.org>
+We will shortly use these to test for VFPv2 and VFPv3
+in different situations.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200224222232.13807-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h | 18 ++++++++++++++++++
+file changed, 18 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
+     return FIELD_EX32(id->mvfr0, MVFR0, FPSHVEC) > 0;
+ }
++static inline bool isar_feature_aa32_fpsp_v2(const ARMISARegisters *id)
++{
++    /* Return true if CPU supports single precision floating point, VFPv2 */
++    return FIELD_EX32(id->mvfr0, MVFR0, FPSP) > 0;
++}
++
++static inline bool isar_feature_aa32_fpsp_v3(const ARMISARegisters *id)
++{
++    /* Return true if CPU supports single precision floating point, VFPv3 */
++    return FIELD_EX32(id->mvfr0, MVFR0, FPSP) >= 2;
++}
++
+ static inline bool isar_feature_aa32_fpdp_v2(const ARMISARegisters *id)
+ {
+     /* Return true if CPU supports double precision floating point, VFPv2 */
+     return FIELD_EX32(id->mvfr0, MVFR0, FPDP) > 0;
+ }
++static inline bool isar_feature_aa32_fpdp_v3(const ARMISARegisters *id)
++{
++    /* Return true if CPU supports double precision floating point, VFPv3 */
++    return FIELD_EX32(id->mvfr0, MVFR0, FPDP) >= 2;
++}
++
+ /*
+  * We always set the FP and SIMD FP16 fields to indicate identical
+  * levels of support (assuming SIMD is implemented at all), so
+--
+.20.1

-New patch
+[PULL 10/33] target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
+From: Richard Henderson <richard.henderson@linaro.org>
+We cannot easily create "any" functions for these, because the
+ID_AA64PFR0 fields for FP and SIMD signal "enabled" with zero.
+Which means that an aarch32-only cpu will return incorrect results
+when testing the aarch64 registers.
+To use these, we must either have context or additionally test
+vs ARM_FEATURE_AARCH64.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200224222232.13807-5-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h     | 11 +++++++++++
+ target/arm/cpu.c     |  9 ++++++---
+ target/arm/machine.c |  5 +++--
+files changed, 20 insertions(+), 5 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpdp_v3(const ARMISARegisters *id)
+     return FIELD_EX32(id->mvfr0, MVFR0, FPDP) >= 2;
+ }
++static inline bool isar_feature_aa32_vfp(const ARMISARegisters *id)
++{
++    return isar_feature_aa32_fpsp_v2(id) || isar_feature_aa32_fpdp_v2(id);
++}
++
+ /*
+  * We always set the FP and SIMD FP16 fields to indicate identical
+  * levels of support (assuming SIMD is implemented at all), so
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_dcpodp(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, DPB) >= 2;
+ }
++static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
++{
++    /* We always set the AdvSIMD and FP fields identically.  */
++    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) != 0xf;
++}
++
+ static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
+ {
+     /* We always set the AdvSIMD and FP fields identically wrt FP16.  */
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
+      * KVM does not currently allow us to lie to the guest about its
+      * ID/feature registers, so the guest always sees what the host has.
+      */
+-    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
++    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
++        ? cpu_isar_feature(aa64_fp_simd, cpu)
++        : cpu_isar_feature(aa32_vfp, cpu)) {
+         cpu->has_vfp = true;
+         if (!kvm_enabled()) {
+             qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+      * We rely on no XScale CPU having VFP so we can use the same bits in the
+      * TB flags field for VECSTRIDE and XSCALE_CPAR.
+      */
+-    assert(!(arm_feature(env, ARM_FEATURE_VFP) &&
+-             arm_feature(env, ARM_FEATURE_XSCALE)));
++    assert(arm_feature(&cpu->env, ARM_FEATURE_AARCH64) ||
++           !cpu_isar_feature(aa32_vfp_simd, cpu) ||
++           !arm_feature(env, ARM_FEATURE_XSCALE));
+     if (arm_feature(env, ARM_FEATURE_V7) &&
+         !arm_feature(env, ARM_FEATURE_M) &&
+diff --git a/target/arm/machine.c b/target/arm/machine.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/machine.c
++++ b/target/arm/machine.c
+@@ -XXX,XX +XXX,XX @@
+ static bool vfp_needed(void *opaque)
+ {
+     ARMCPU *cpu = opaque;
+-    CPUARMState *env = &cpu->env;
+-    return arm_feature(env, ARM_FEATURE_VFP);
++    return (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
++            ? cpu_isar_feature(aa64_fp_simd, cpu)
++            : cpu_isar_feature(aa32_vfp_simd, cpu));
+ }
+ static int get_fpscr(QEMUFile *f, void *opaque, size_t size,
+--
+.20.1

-New patch
+[PULL 11/33] target/arm: Perform fpdp_v2 check first
+From: Richard Henderson <richard.henderson@linaro.org>
 Shuffle the order of the checks so that we test the ISA
 before we test anything else, such as the register arguments.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 140 +++++++++++++++++----------------
 file changed, 71 insertions(+), 69 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
          return false;
      }
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 -        ((a->vm | a->vn | a->vd) & 0x10)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          return false;
      }
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 -        ((a->vm | a->vn | a->vd) & 0x10)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          return false;
      }
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 -        ((a->vm | a->vd) & 0x10)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vm | a->vd) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
          return false;
      }
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
      TCGv_i64 f0, f1, fd;
      TCGv_ptr fpst;
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
      int veclen = s->vec_len;
      TCGv_i64 f0, fd;
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vd | a->vn | a->vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
      vd = a->vd;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
  {
      TCGv_i64 vd, vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      /* Vm/M bits must be zero for the Z variant */
      if (a->z && a->vm != 0) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
      TCGv_i32 tmp;
      TCGv_i64 vd;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
      TCGv_i32 tmp;
      TCGv_i64 vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_vrint, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
      TCGv_i64 tmp;
      TCGv_i32 tcg_rmode;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_vrint, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_vrint, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
      TCGv_i64 vd;
      TCGv_i32 vm;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
      TCGv_i64 vm;
      TCGv_i32 vd;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
      TCGv_i64 vd;
      TCGv_ptr fpst;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
      TCGv_i32 vd;
      TCGv_i64 vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_jscvt, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
      TCGv_ptr fpst;
      int frac_bits;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
      TCGv_i64 vm;
      TCGv_ptr fpst;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
          return false;
      }
 --
 .20.1

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 12/33] target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+Sort this check to the start of a trans_* function.
-it is needed to support guests other than Linux.
+Merge this with any existing test for fpdp_v2.
-Based on the patch by Bill Paul as found here:
-https://bugs.launchpad.net/qemu/+bug/1753314
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: Bill Paul <wpaul@windriver.com>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Bill Paul <wpaul@windriver.com>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200224222232.13807-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/char/imx_serial.h |  3 +++
+ target/arm/translate-vfp.inc.c | 24 ++++++++----------------
- hw/char/imx_serial.c         | 20 +++++++++++++++++---
+file changed, 8 insertions(+), 16 deletions(-)
 files changed, 20 insertions(+), 3 deletions(-)
-diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/target/arm/translate-vfp.inc.c
-+++ b/include/hw/char/imx_serial.h
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
- #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+          * VFPv2 allows access to FPSID from userspace; VFPv3 restricts
- #define UCR2_SRST       (1<<0)    /* Reset complete */
+          * all ID registers to privileged access only.
+          */
-+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+-        if (IS_USER(s) && arm_dc_feature(s, ARM_FEATURE_VFP3)) {
-+
++        if (IS_USER(s) && dc_isar_feature(aa32_fpsp_v3, s)) {
- #define UTS1_TXEMPTY    (1<<6)
+             return false;
- #define UTS1_RXEMPTY    (1<<5)
+         }
- #define UTS1_TXFULL     (1<<4)
+         ignore_vfp_enabled = true;
-@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
-     uint32_t ubmr;
+     case ARM_VFP_FPINST:
-     uint32_t ubrc;
+     case ARM_VFP_FPINST2:
-     uint32_t ucr3;
+         /* Not present in VFPv3 */
-+    uint32_t ucr4;
+-        if (IS_USER(s) || arm_dc_feature(s, ARM_FEATURE_VFP3)) {
++        if (IS_USER(s) || dc_isar_feature(aa32_fpsp_v3, s)) {
-     qemu_irq irq;
+             return false;
      CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
  static const VMStateDescription vmstate_imx_serial = {
      .name = TYPE_IMX_SERIAL,
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_INT32(readbuff, IMXSerialState),
          VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
 +     * TCEN and TXDC are both bit 3
 +     */
 +    mask |= s->ucr4 & UCR4_TCEN;
 +
      usr2 = s->usr2 & mask;
      qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
          return s->ucr3;
      case 0x23: /* UCR4 */
 +        return s->ucr4;
 +
      case 0x29: /* BRM Incremental */
          return 0x0; /* TODO */
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
              s->usr1 &= ~USR1_TRDY;
 +            s->usr2 &= ~USR2_TXDC;
              imx_update(s);
              s->usr1 |= USR1_TRDY;
 +            s->usr2 |= USR2_TXDC;
              imx_update(s);
          }
          break;
-@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
-         s->ucr3 = value & 0xffff;
-         break;
+     vd = a->vd;
--    case 0x2d: /* UTS1 */
+-    if (!dc_isar_feature(aa32_fpshvec, s) &&
-     case 0x23: /* UCR4 */
+-        (veclen != 0 || s->vec_stride != 0)) {
-+        s->ucr4 = value & 0xffff;
++    if (!dc_isar_feature(aa32_fpsp_v3, s)) {
-+        imx_update(s);
+         return false;
-+        break;
+     }
-+
-+    case 0x2d: /* UTS1 */
+-    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
-         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
++    if (!dc_isar_feature(aa32_fpshvec, s) &&
-                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
++        (veclen != 0 || s->vec_stride != 0)) {
-         /* TODO */
+         return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
      vd = a->vd;
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v3, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
      TCGv_ptr fpst;
      int frac_bits;
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 +    if (!dc_isar_feature(aa32_fpsp_v3, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
      TCGv_ptr fpst;
      int frac_bits;
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 +    if (!dc_isar_feature(aa32_fpdp_v3, s)) {
          return false;
      }
 --
-.16.2
+.20.1

-New patch
+[PULL 13/33] target/arm: Add missing checks for fpsp_v2
+From: Richard Henderson <richard.henderson@linaro.org>
 We will eventually remove the early ARM_FEATURE_VFP test,
 so add a proper test for each trans_* that does not already
 have another ISA test.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 78 ++++++++++++++++++++++++++++++----
 file changed, 69 insertions(+), 9 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_to_gp(DisasContext *s, arg_VMOV_to_gp *a)
      int pass;
      uint32_t offset;
 +    /* SIZE == 2 is a VFP instruction; otherwise NEON.  */
 +    if (a->size == 2
 +        ? !dc_isar_feature(aa32_fpsp_v2, s)
 +        : !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 +        return false;
 +    }
 +
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vn & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_to_gp(DisasContext *s, arg_VMOV_to_gp *a)
      pass = extract32(offset, 2, 1);
      offset = extract32(offset, 0, 2) * 8;
 -    if (a->size != 2 && !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_from_gp(DisasContext *s, arg_VMOV_from_gp *a)
      int pass;
      uint32_t offset;
 +    /* SIZE == 2 is a VFP instruction; otherwise NEON.  */
 +    if (a->size == 2
 +        ? !dc_isar_feature(aa32_fpsp_v2, s)
 +        : !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 +        return false;
 +    }
 +
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vn & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_from_gp(DisasContext *s, arg_VMOV_from_gp *a)
      pass = extract32(offset, 2, 1);
      offset = extract32(offset, 0, 2) * 8;
 -    if (a->size != 2 && !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
      TCGv_i32 tmp;
      bool ignore_vfp_enabled = false;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (arm_dc_feature(s, ARM_FEATURE_M)) {
          /*
           * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_single(DisasContext *s, arg_VMOV_single *a)
  {
      TCGv_i32 tmp;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
  {
      TCGv_i32 tmp;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /*
       * VMOV between two general-purpose registers and two single precision
       * floating point registers
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
      /*
       * VMOV between two general-purpose registers and one double precision
 -     * floating point register
 +     * floating point register.  Note that this does not require support
 +     * for double precision arithmetic.
       */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
      uint32_t offset;
      TCGv_i32 addr, tmp;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
      TCGv_i32 addr;
      TCGv_i64 tmp;
 +    /* Note that this does not require support for double arithmetic.  */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, arg_VLDM_VSTM_sp *a)
      TCGv_i32 addr, tmp;
      int i, n;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      n = a->imm;
      if (n == 0 || (a->vd + n) > 32) {
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, arg_VLDM_VSTM_dp *a)
      TCGv_i64 tmp;
      int i, n;
 +    /* Note that this does not require support for double arithmetic.  */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      n = a->imm >> 1;
      if (n == 0 || (a->vd + n) > 32 || n > 16) {
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
      TCGv_i32 f0, f1, fd;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_sp(DisasContext *s, VFPGen2OpSPFn *fn, int vd, int vm)
      int veclen = s->vec_len;
      TCGv_i32 f0, fd;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_sp(DisasContext *s, arg_VCMP_sp *a)
  {
      TCGv_i32 vd, vm;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /* Vm/M bits must be zero for the Z variant */
      if (a->z && a->vm != 0) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
      TCGv_i32 vm;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
      TCGv_i32 vm;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

-New patch
+[PULL 14/33] target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
+From: Richard Henderson <richard.henderson@linaro.org>
+All remaining tests for VFP4 are for fused multiply-add insns.
+Since the MVFR1 field is used for both VFP and NEON, move its adjustment
+from the !has_neon block to the (!has_vfp && !has_neon) block.
+Test for vfp of the appropraite width alongside the test for simdfmac
+within translate-vfp.inc.c.  Within disas_neon_data_insn, we have
+already tested for ARM_FEATURE_NEON.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200224222232.13807-10-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h               | 12 ++++++++++++
+ target/arm/cpu.c               |  6 +++++-
+ target/arm/translate-vfp.inc.c | 22 ++++++++++++++++++----
+ target/arm/translate.c         |  2 +-
+files changed, 36 insertions(+), 6 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
+     return FIELD_EX32(id->mvfr1, MVFR1, FPHP) > 1;
+ }
++/*
++ * Note that this ID register field covers both VFP and Neon FMAC,
++ * so should usually be tested in combination with some other
++ * check that confirms the presence of whichever of VFP or Neon is
++ * relevant, to avoid accidentally enabling a Neon feature on
++ * a VFP-no-Neon core or vice-versa.
++ */
++static inline bool isar_feature_aa32_simdfmac(const ARMISARegisters *id)
++{
++    return FIELD_EX32(id->mvfr1, MVFR1, SIMDFMAC) != 0;
++}
++
+ static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id)
+ {
+     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 1;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+         u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+         u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+         u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+-        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+         cpu->isar.mvfr1 = u;
+         u = cpu->isar.mvfr2;
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+         u = cpu->isar.mvfr0;
+         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
+         cpu->isar.mvfr0 = u;
++
++        /* Despite the name, this field covers both VFP and Neon */
++        u = cpu->isar.mvfr1;
++        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
++        cpu->isar.mvfr1 = u;
+     }
+     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
+     /*
+      * Present in VFPv4 only.
++     * Note that we can't rely on the SIMDFMAC check alone, because
++     * in a Neon-no-VFP core that ID register field will be non-zero.
++     */
++    if (!dc_isar_feature(aa32_simdfmac, s) ||
++        !dc_isar_feature(aa32_fpsp_v2, s)) {
++        return false;
++    }
++    /*
+      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
+      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
+      */
+-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
+-        (s->vec_len != 0 || s->vec_stride != 0)) {
++    if (s->vec_len != 0 || s->vec_stride != 0) {
+         return false;
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
+     /*
+      * Present in VFPv4 only.
++     * Note that we can't rely on the SIMDFMAC check alone, because
++     * in a Neon-no-VFP core that ID register field will be non-zero.
++     */
++    if (!dc_isar_feature(aa32_simdfmac, s) ||
++        !dc_isar_feature(aa32_fpdp_v2, s)) {
++        return false;
++    }
++    /*
+      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
+      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
+      */
+-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
+-        (s->vec_len != 0 || s->vec_stride != 0)) {
++    if (s->vec_len != 0 || s->vec_stride != 0) {
+         return false;
+     }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+             }
+             break;
+         case NEON_3R_VFM_VQRDMLSH:
+-            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
++            if (!dc_isar_feature(aa32_simdfmac, s)) {
+                 return 1;
+             }
+             break;
+--
+.20.1

-New patch
+[PULL 15/33] target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
+From: Richard Henderson <richard.henderson@linaro.org>
+We now have proper ISA checks within each trans_* function.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200224222232.13807-11-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 4 ----
+file changed, 4 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
+  */
+ static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+ {
+-    if (!arm_dc_feature(s, ARM_FEATURE_VFP)) {
+-        return 1;
+-    }
+-
+     /*
+      * If the decodetree decoder handles this insn it will always
+      * emit code to either execute the insn or generate an appropriate
+--
+.20.1

-New patch
+[PULL 16/33] target/arm: Move VLLDM and VLSTM to vfp.decode
+From: Richard Henderson <richard.henderson@linaro.org>
+Now that we no longer have an early check for ARM_FEATURE_VFP,
+we can use the proper ISA check in trans_VLLDM_VLSTM.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200224222232.13807-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-vfp.inc.c | 39 +++++++++++++++++++++++++
+ target/arm/translate.c         | 53 ++++++----------------------------
+ target/arm/vfp.decode          |  2 ++
+files changed, 50 insertions(+), 44 deletions(-)
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+     tcg_temp_free_ptr(fpst);
+     return true;
+ }
++
++/*
++ * Decode VLLDM and VLSTM are nonstandard because:
++ *  * if there is no FPU then these insns must NOP in
++ *    Secure state and UNDEF in Nonsecure state
++ *  * if there is an FPU then these insns do not have
++ *    the usual behaviour that vfp_access_check() provides of
++ *    being controlled by CPACR/NSACR enable bits or the
++ *    lazy-stacking logic.
++ */
++static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
++{
++    TCGv_i32 fptr;
++
++    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
++        !arm_dc_feature(s, ARM_FEATURE_V8)) {
++        return false;
++    }
++    /* If not secure, UNDEF. */
++    if (!s->v8m_secure) {
++        return false;
++    }
++    /* If no fpu, NOP. */
++    if (!dc_isar_feature(aa32_vfp, s)) {
++        return true;
++    }
++
++    fptr = load_reg(s, a->rn);
++    if (a->l) {
++        gen_helper_v7m_vlldm(cpu_env, fptr);
++    } else {
++        gen_helper_v7m_vlstm(cpu_env, fptr);
++    }
++    tcg_temp_free_i32(fptr);
++
++    /* End the TB, because we have updated FP control bits */
++    s->base.is_jmp = DISAS_UPDATE;
++    return true;
++}
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+                 goto illegal_op; /* op0 = 0b11 : unallocated */
+             }
+-            /*
+-             * Decode VLLDM and VLSTM first: these are nonstandard because:
+-             *  * if there is no FPU then these insns must NOP in
+-             *    Secure state and UNDEF in Nonsecure state
+-             *  * if there is an FPU then these insns do not have
+-             *    the usual behaviour that disas_vfp_insn() provides of
+-             *    being controlled by CPACR/NSACR enable bits or the
+-             *    lazy-stacking logic.
+-             */
+-            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
+-                (insn & 0xffa00f00) == 0xec200a00) {
+-                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
+-                 *  - VLLDM, VLSTM
+-                 * We choose to UNDEF if the RAZ bits are non-zero.
+-                 */
+-                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
++            if (disas_vfp_insn(s, insn)) {
++                if (((insn >> 8) & 0xe) == 10 &&
++                    dc_isar_feature(aa32_fpsp_v2, s)) {
++                    /* FP, and the CPU supports it */
+                     goto illegal_op;
++                } else {
++                    /* All other insns: NOCP */
++                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                                       syn_uncategorized(),
++                                       default_exception_el(s));
+                 }
+-
+-                if (arm_dc_feature(s, ARM_FEATURE_VFP)) {
+-                    uint32_t rn = (insn >> 16) & 0xf;
+-                    TCGv_i32 fptr = load_reg(s, rn);
+-
+-                    if (extract32(insn, 20, 1)) {
+-                        gen_helper_v7m_vlldm(cpu_env, fptr);
+-                    } else {
+-                        gen_helper_v7m_vlstm(cpu_env, fptr);
+-                    }
+-                    tcg_temp_free_i32(fptr);
+-
+-                    /* End the TB, because we have updated FP control bits */
+-                    s->base.is_jmp = DISAS_UPDATE;
+-                }
+-                break;
+             }
+-            if (arm_dc_feature(s, ARM_FEATURE_VFP) &&
+-                ((insn >> 8) & 0xe) == 10) {
+-                /* FP, and the CPU supports it */
+-                if (disas_vfp_insn(s, insn)) {
+-                    goto illegal_op;
+-                }
+-                break;
+-            }
+-
+-            /* All other insns: NOCP */
+-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
+-                               default_exception_el(s));
+             break;
+         }
+         if ((insn & 0xfe000a00) == 0xfc000800
+diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp.decode
++++ b/target/arm/vfp.decode
+@@ -XXX,XX +XXX,XX @@ VCVT_sp_int  ---- 1110 1.11 110 s:1 .... 1010 rz:1 1.0 .... \
+              vd=%vd_sp vm=%vm_sp
+ VCVT_dp_int  ---- 1110 1.11 110 s:1 .... 1011 rz:1 1.0 .... \
+              vd=%vd_sp vm=%vm_dp
++
++VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
+--
+.20.1

-New patch
+[PULL 17/33] target/arm: Move the vfp decodetree calls next to the base isa
+From: Richard Henderson <richard.henderson@linaro.org>
+Have the calls adjacent as an intermediate step toward
+actually merging the decodes.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200224222232.13807-13-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 83 +++++++++++++++---------------------------
+file changed, 29 insertions(+), 54 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
+     tcg_temp_free_i32(tmp);
+ }
+-/*
+- * Disassemble a VFP instruction.  Returns nonzero if an error occurred
+- * (ie. an undefined instruction).
+- */
+-static int disas_vfp_insn(DisasContext *s, uint32_t insn)
+-{
+-    /*
+-     * If the decodetree decoder handles this insn it will always
+-     * emit code to either execute the insn or generate an appropriate
+-     * exception; so we don't need to ever return non-zero to tell
+-     * the calling code to emit an UNDEF exception.
+-     */
+-    if (extract32(insn, 28, 4) == 0xf) {
+-        if (disas_vfp_uncond(s, insn)) {
+-            return 0;
+-        }
+-    } else {
+-        if (disas_vfp(s, insn)) {
+-            return 0;
+-        }
+-    }
+-    /* If the decodetree decoder didn't handle this insn, it must be UNDEF */
+-    return 1;
+-}
+-
+ static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
+ {
+ #ifndef CONFIG_USER_ONLY
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+         ARCH(5);
+         /* Unconditional instructions.  */
+-        if (disas_a32_uncond(s, insn)) {
++        /* TODO: Perhaps merge these into one decodetree output file.  */
++        if (disas_a32_uncond(s, insn) ||
++            disas_vfp_uncond(s, insn)) {
+             return;
+         }
+         /* fall back to legacy decoder */
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+             }
+             return;
+         }
+-        if ((insn & 0x0f000e10) == 0x0e000a00) {
+-            /* VFP.  */
+-            if (disas_vfp_insn(s, insn)) {
+-                goto illegal_op;
+-            }
+-            return;
+-        }
+         if ((insn & 0x0e000f00) == 0x0c000100) {
+             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
+                 /* iWMMXt register transfer.  */
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+         arm_skip_unless(s, cond);
+     }
+-    if (disas_a32(s, insn)) {
++    /* TODO: Perhaps merge these into one decodetree output file.  */
++    if (disas_a32(s, insn) ||
++        disas_vfp(s, insn)) {
+         return;
+     }
+     /* fall back to legacy decoder */
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+     case 0xd:
+     case 0xe:
+         if (((insn >> 8) & 0xe) == 10) {
+-            /* VFP.  */
+-            if (disas_vfp_insn(s, insn)) {
+-                goto illegal_op;
+-            }
+-        } else if (disas_coproc_insn(s, insn)) {
++            /* VFP, but failed disas_vfp.  */
++            goto illegal_op;
++        }
++        if (disas_coproc_insn(s, insn)) {
+             /* Coprocessor.  */
+             goto illegal_op;
+         }
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+         ARCH(6T2);
+     }
+-    if (disas_t32(s, insn)) {
++    /*
++     * TODO: Perhaps merge these into one decodetree output file.
++     * Note disas_vfp is written for a32 with cond field in the
++     * top nibble.  The t32 encoding requires 0xe in the top nibble.
++     */
++    if (disas_t32(s, insn) ||
++        disas_vfp_uncond(s, insn) ||
++        ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
+         return;
+     }
+     /* fall back to legacy decoder */
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+                 goto illegal_op; /* op0 = 0b11 : unallocated */
+             }
+-            if (disas_vfp_insn(s, insn)) {
+-                if (((insn >> 8) & 0xe) == 10 &&
+-                    dc_isar_feature(aa32_fpsp_v2, s)) {
+-                    /* FP, and the CPU supports it */
+-                    goto illegal_op;
+-                } else {
+-                    /* All other insns: NOCP */
+-                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+-                                       syn_uncategorized(),
+-                                       default_exception_el(s));
+-                }
++            if (((insn >> 8) & 0xe) == 10 &&
++                dc_isar_feature(aa32_fpsp_v2, s)) {
++                /* FP, and the CPU supports it */
++                goto illegal_op;
++            } else {
++                /* All other insns: NOCP */
++                gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
++                                   syn_uncategorized(),
++                                   default_exception_el(s));
+             }
+             break;
+         }
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+                 goto illegal_op;
+             }
+         } else if (((insn >> 8) & 0xe) == 10) {
+-            if (disas_vfp_insn(s, insn)) {
+-                goto illegal_op;
+-            }
++            /* VFP, but failed disas_vfp.  */
++            goto illegal_op;
+         } else {
+             if (insn & (1 << 28))
+                 goto illegal_op;
+--
+.20.1

-New patch
+[PULL 18/33] linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
+From: Richard Henderson <richard.henderson@linaro.org>
+Use isar feature tests instead of feature bit tests.
+Although none of QEMUs current cpus have VFPv3 without D32,
+replace the large comment explaining why with one line that
+sets ARM_HWCAP_ARM_VFPv3D16 under the correct conditions.
+Mirror the test sequence used in the linux kernel.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200224222232.13807-14-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ linux-user/elfload.c | 23 +++++++++++++----------
+file changed, 13 insertions(+), 10 deletions(-)
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/elfload.c
++++ b/linux-user/elfload.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
+     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
+     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
+-    GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
+     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
+     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
+     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
+-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
+     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
+-    GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);
++    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
+     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
+     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
+-    /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.
+-     * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of
+-     * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated
+-     * to our VFP_FP16 feature bit.
+-     */
+-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPD32);
+-    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
++    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
++
++    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
++        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
++        hwcaps |= ARM_HWCAP_ARM_VFPv3;
++        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
++            hwcaps |= ARM_HWCAP_ARM_VFPD32;
++        } else {
++            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
++        }
++    }
++    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
+     return hwcaps;
+ }
+--
+.20.1

-New patch
+[PULL 19/33] target/arm: Remove ARM_FEATURE_VFP*
+From: Richard Henderson <richard.henderson@linaro.org>
 We have converted all tests against these features
 to ISAR tests.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-15-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h   |  3 ---
  target/arm/cpu.c   | 25 -------------------------
  target/arm/cpu64.c |  3 ---
  target/arm/kvm32.c |  5 -----
  target/arm/kvm64.c |  1 -
 files changed, 37 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
   * mapping in linux-user/elfload.c:get_elf_hwcap().
   */
  enum arm_features {
 -    ARM_FEATURE_VFP,
      ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
      ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
      ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_V7,
      ARM_FEATURE_THUMB2,
      ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
 -    ARM_FEATURE_VFP3,
      ARM_FEATURE_NEON,
      ARM_FEATURE_M, /* Microcontroller profile.  */
      ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_V5,
      ARM_FEATURE_STRONGARM,
      ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
 -    ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
      ARM_FEATURE_GENERIC_TIMER,
      ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
      ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
          set_feature(&cpu->env, ARM_FEATURE_PMSA);
      }
 -    /* Similarly for the VFP feature bits */
 -    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
 -        set_feature(&cpu->env, ARM_FEATURE_VFP3);
 -    }
 -    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
 -        set_feature(&cpu->env, ARM_FEATURE_VFP);
 -    }
      if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
          arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          uint64_t t;
          uint32_t u;
 -        unset_feature(env, ARM_FEATURE_VFP);
 -        unset_feature(env, ARM_FEATURE_VFP3);
 -        unset_feature(env, ARM_FEATURE_VFP4);
 -
          t = cpu->isar.id_aa64isar1;
          t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
          cpu->isar.id_aa64isar1 = t;
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm926";
      set_feature(&cpu->env, ARM_FEATURE_V5);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
      cpu->midr = 0x41069265;
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm1026";
      set_feature(&cpu->env, ARM_FEATURE_V5);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_AUXCR);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm1136";
      set_feature(&cpu->env, ARM_FEATURE_V6);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm1136";
      set_feature(&cpu->env, ARM_FEATURE_V6K);
      set_feature(&cpu->env, ARM_FEATURE_V6);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm1176";
      set_feature(&cpu->env, ARM_FEATURE_V6K);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_VAPA);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
      set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
      cpu->dtb_compatible = "arm,arm11mpcore";
      set_feature(&cpu->env, ARM_FEATURE_V6K);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP);
      set_feature(&cpu->env, ARM_FEATURE_VAPA);
      set_feature(&cpu->env, ARM_FEATURE_MPIDR);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M);
      set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      cpu->midr = 0x410fc240; /* r0p0 */
      cpu->pmsav7_dregion = 8;
      cpu->isar.mvfr0 = 0x10110021;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M);
      set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      cpu->midr = 0x411fc272; /* r1p2 */
      cpu->pmsav7_dregion = 8;
      cpu->isar.mvfr0 = 0x10110221;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
      set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
      set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
      set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      cpu->midr = 0x410fd213; /* r0p3 */
      cpu->pmsav7_dregion = 16;
      cpu->sau_sregion = 8;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5f_initfn(Object *obj)
      ARMCPU *cpu = ARM_CPU(obj);
      cortex_r5_initfn(obj);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP3);
      cpu->isar.mvfr0 = 0x10110221;
      cpu->isar.mvfr1 = 0x00000011;
  }
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a8";
      set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP3);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
      set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a9";
      set_feature(&cpu->env, ARM_FEATURE_V7);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP3);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
      set_feature(&cpu->env, ARM_FEATURE_EL3);
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a7";
      set_feature(&cpu->env, ARM_FEATURE_V7VE);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
      set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a15";
      set_feature(&cpu->env, ARM_FEATURE_V7VE);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
      set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a57";
      set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
      set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a53";
      set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
      set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      cpu->dtb_compatible = "arm,cortex-a72";
      set_feature(&cpu->env, ARM_FEATURE_V8);
 -    set_feature(&cpu->env, ARM_FEATURE_VFP4);
      set_feature(&cpu->env, ARM_FEATURE_NEON);
      set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
      set_feature(&cpu->env, ARM_FEATURE_AARCH64);
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
       * bits, but a few must be tested.
       */
      set_feature(&features, ARM_FEATURE_V7VE);
 -    set_feature(&features, ARM_FEATURE_VFP3);
      set_feature(&features, ARM_FEATURE_GENERIC_TIMER);
      if (extract32(id_pfr0, 12, 4) == 1) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
          set_feature(&features, ARM_FEATURE_NEON);
      }
 -    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
 -        /* FMAC support implies VFPv4 */
 -        set_feature(&features, ARM_FEATURE_VFP4);
 -    }
      ahcf->features = features;
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
       * feature bits.
       */
      set_feature(&features, ARM_FEATURE_V8);
 -    set_feature(&features, ARM_FEATURE_VFP4);
      set_feature(&features, ARM_FEATURE_NEON);
      set_feature(&features, ARM_FEATURE_AARCH64);
      set_feature(&features, ARM_FEATURE_PMU);
 --
 .20.1

-New patch
+[PULL 20/33] target/arm: Add formats for some vfp 2 and 3-register insns
+From: Richard Henderson <richard.henderson@linaro.org>
 Those vfp instructions without extra opcode fields can
 share a common @format for brevity.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-16-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/vfp.decode | 134 ++++++++++++++++--------------------------
 file changed, 52 insertions(+), 82 deletions(-)
 diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp.decode
 +++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@
  %vmov_imm 16:4 0:4
 +@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
 +@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +
 +@vfp_dm_ss   ................................ vm=%vm_sp vd=%vd_sp
 +@vfp_dm_dd   ................................ vm=%vm_dp vd=%vd_dp
 +@vfp_dm_ds   ................................ vm=%vm_sp vd=%vd_dp
 +@vfp_dm_sd   ................................ vm=%vm_dp vd=%vd_sp
 +
  # VMOV scalar to general-purpose register; note that this does
  # include some Neon cases.
  VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
@@ -XXX,XX +XXX,XX @@ VDUP         ---- 1110 1 b:1 q:1 0 .... rt:4 1011 . 0 e:1 1 0000 \
               vn=%vn_dp
  VMSR_VMRS    ---- 1110 111 l:1 reg:4 rt:4 1010 0001 0000
 -VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000 \
 -             vn=%vn_sp
 +VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000    vn=%vn_sp
 -VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 .... \
 -             vm=%vm_sp
 -VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 .... \
 -             vm=%vm_dp
 +VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 ....   vm=%vm_sp
 +VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 ....   vm=%vm_dp
  # Note that the half-precision variants of VLDR and VSTR are
  # not part of this decodetree at all because they have bits [9:8] == 0b01
 -VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8 \
 -             vd=%vd_sp
 -VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8 \
 -             vd=%vd_dp
 +VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
 +VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
  # We split the load/store multiple up into two patterns to avoid
  # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
@@ -XXX,XX +XXX,XX @@ VLDM_VSTM_dp ---- 1101 0.1 l:1 rn:4 .... 1011 imm:8 \
               vd=%vd_dp p=1 u=0 w=1
  # 3-register VFP data-processing; bits [23,21:20,6] identify the operation.
 -VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
 +VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 ....        @vfp_dnm_s
 +VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 ....        @vfp_dnm_d
 -VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 ....        @vfp_dnm_s
 +VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 ....        @vfp_dnm_s
 +VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
 -VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 ....        @vfp_dnm_s
 +VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 ....        @vfp_dnm_s
 +VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
 -VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 ....        @vfp_dnm_s
 +VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 ....        @vfp_dnm_s
 +VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
 -VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp
 -VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
 +VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
  VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
               vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
@@ -XXX,XX +XXX,XX @@ VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
  VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
               vd=%vd_dp imm=%vmov_imm
 -VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 ....        @vfp_dm_ss
 +VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 ....        @vfp_dm_dd
 -VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 ....        @vfp_dm_ss
 +VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 ....        @vfp_dm_dd
 -VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 ....        @vfp_dm_ss
 +VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 ....        @vfp_dm_dd
 -VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 ....        @vfp_dm_ss
 +VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 ....        @vfp_dm_dd
  VCMP_sp      ---- 1110 1.11 010 z:1 .... 1010 e:1 1.0 .... \
               vd=%vd_sp vm=%vm_sp
@@ -XXX,XX +XXX,XX @@ VCVT_f32_f16 ---- 1110 1.11 0010 .... 1010 t:1 1.0 .... \
  VCVT_f64_f16 ---- 1110 1.11 0010 .... 1011 t:1 1.0 .... \
               vd=%vd_dp vm=%vm_sp
 -# VCVTB and VCVTT to f16: Vd format is always vd_sp; Vm format depends on size bit
 +# VCVTB and VCVTT to f16: Vd format is always vd_sp;
 +# Vm format depends on size bit
  VCVT_f16_f32 ---- 1110 1.11 0011 .... 1010 t:1 1.0 .... \
               vd=%vd_sp vm=%vm_sp
  VCVT_f16_f64 ---- 1110 1.11 0011 .... 1011 t:1 1.0 .... \
               vd=%vd_sp vm=%vm_dp
 -VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 ....        @vfp_dm_ss
 +VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 ....        @vfp_dm_dd
 -VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 ....        @vfp_dm_ss
 +VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 ....        @vfp_dm_dd
 -VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 .... \
 -             vd=%vd_sp vm=%vm_sp
 -VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 .... \
 -             vd=%vd_dp vm=%vm_dp
 +VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 ....        @vfp_dm_ss
 +VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 ....        @vfp_dm_dd
 -# VCVT between single and double: Vm precision depends on size; Vd is its reverse
 -VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 .... \
 -             vd=%vd_dp vm=%vm_sp
 -VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 .... \
 -             vd=%vd_sp vm=%vm_dp
 +# VCVT between single and double:
 +# Vm precision depends on size; Vd is its reverse
 +VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 ....        @vfp_dm_ds
 +VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 ....        @vfp_dm_sd
  # VCVT from integer to floating point: Vm always single; Vd depends on size
  VCVT_int_sp  ---- 1110 1.11 1000 .... 1010 s:1 1.0 .... \
@@ -XXX,XX +XXX,XX @@ VCVT_int_dp  ---- 1110 1.11 1000 .... 1011 s:1 1.0 .... \
               vd=%vd_dp vm=%vm_sp
  # VJCVT is always dp to sp
 -VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 .... \
 -             vd=%vd_sp vm=%vm_dp
 +VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 ....        @vfp_dm_sd
  # VCVT between floating-point and fixed-point. The immediate value
  # is in the same format as a Vm single-precision register number.
 --
 .20.1

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 21/33] target/arm: Split VFM decode
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Code of imx_update() is slightly confusing since the "flags" variable
+Passing the raw o1 and o2 fields from the manual is less
-doesn't really corespond to anything in real hardware and server as a
+instructive than it might be.  Do the full decode and let
-kitchensink accumulating events normally reported via USR1 and USR2
+the trans_* functions pass in booleans to a helper.
 registers.
-Change the code to explicitly evaluate state of interrupts reported
-via USR1 and USR2 against corresponding masking bits and use the to
-detemine if IRQ line should be asserted or not.
-NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
-reasons:
-. Emulation code implements a single character FIFO, so this flag
-       will always be set since characters are trasmitted as a part of
-       the code emulating "push" into the FIFO
-. imx_update() is really just a function doing ORing and maksing
-       of reported events, so checking for UTS1_TXEMPTY should happen,
-       if it's ever really needed should probably happen outside of
-       it.
-Cc: qemu-devel@nongnu.org
-Cc: qemu-arm@nongnu.org
-Cc: Bill Paul <wpaul@windriver.com>
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
-Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200224222232.13807-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/imx_serial.c | 24 ++++++++++++++++--------
+ target/arm/translate-vfp.inc.c | 52 ++++++++++++++++++++++++++++++----
-file changed, 16 insertions(+), 8 deletions(-)
+ target/arm/vfp.decode          | 17 +++++------
 files changed, 55 insertions(+), 14 deletions(-)
-diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/hw/char/imx_serial.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
+     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
- static void imx_update(IMXSerialState *s)
+ }
 -static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
 +static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
  {
--    uint32_t flags;
+     /*
-+    uint32_t usr1;
+      * VFNMA : fd = muladd(-fd,  fn, fm)
-+    uint32_t usr2;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
-+    uint32_t mask;
+     neon_load_reg32(vn, a->vn);
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
+     neon_load_reg32(vm, a->vm);
--    if (s->ucr1 & UCR1_TXMPTYEN) {
+-    if (a->o2) {
--        flags |= (s->uts1 & UTS1_TXEMPTY);
++    if (neg_n) {
--    } else {
+         /* VFNMS, VFMS */
--        flags &= ~USR1_TRDY;
+         gen_helper_vfp_negs(vn, vn);
--    }
+     }
-+    /*
+     neon_load_reg32(vd, a->vd);
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+-    if (a->o1 & 1) {
-+     * UCR1, so we can get away with something as simple as the
++    if (neg_d) {
-+     * following:
+         /* VFNMA, VFNMS */
-+     */
+         gen_helper_vfp_negs(vd, vd);
-+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+     }
-+    /*
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
-+     * Bits that we want in USR2 are not as conveniently laid out,
+     return true;
 +     * unfortunately.
 +     */
 +    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    usr2 = s->usr2 & mask;
 -    qemu_set_irq(s->irq, !!flags);
 +    qemu_set_irq(s->irq, usr1 || usr2);
  }
- static void imx_serial_reset(IMXSerialState *s)
+-static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 +static bool trans_VFMA_sp(DisasContext *s, arg_VFMA_sp *a)
 +{
 +    return do_vfm_sp(s, a, false, false);
 +}
 +
 +static bool trans_VFMS_sp(DisasContext *s, arg_VFMS_sp *a)
 +{
 +    return do_vfm_sp(s, a, true, false);
 +}
 +
 +static bool trans_VFNMA_sp(DisasContext *s, arg_VFNMA_sp *a)
 +{
 +    return do_vfm_sp(s, a, false, true);
 +}
 +
 +static bool trans_VFNMS_sp(DisasContext *s, arg_VFNMS_sp *a)
 +{
 +    return do_vfm_sp(s, a, true, true);
 +}
 +
 +static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
  {
      /*
       * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
      neon_load_reg64(vn, a->vn);
      neon_load_reg64(vm, a->vm);
 -    if (a->o2) {
 +    if (neg_n) {
          /* VFNMS, VFMS */
          gen_helper_vfp_negd(vn, vn);
      }
      neon_load_reg64(vd, a->vd);
 -    if (a->o1 & 1) {
 +    if (neg_d) {
          /* VFNMA, VFNMS */
          gen_helper_vfp_negd(vd, vd);
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
      return true;
  }
 +static bool trans_VFMA_dp(DisasContext *s, arg_VFMA_dp *a)
 +{
 +    return do_vfm_dp(s, a, false, false);
 +}
 +
 +static bool trans_VFMS_dp(DisasContext *s, arg_VFMS_dp *a)
 +{
 +    return do_vfm_dp(s, a, true, false);
 +}
 +
 +static bool trans_VFNMA_dp(DisasContext *s, arg_VFNMA_dp *a)
 +{
 +    return do_vfm_dp(s, a, false, true);
 +}
 +
 +static bool trans_VFNMS_dp(DisasContext *s, arg_VFNMS_dp *a)
 +{
 +    return do_vfm_dp(s, a, true, true);
 +}
 +
  static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
  {
      uint32_t delta_d = 0;
 diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp.decode
 +++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@ VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
  VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
  VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
 -VFM_dp       ---- 1110 1.01 .... .... 1011 . o2:1 . 0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=1
 -VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=2
 -VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
 +VFMA_sp      ---- 1110 1.10 .... .... 1010 .0. 0 ....       @vfp_dnm_s
 +VFMS_sp      ---- 1110 1.10 .... .... 1010 .1. 0 ....       @vfp_dnm_s
 +VFNMA_sp     ---- 1110 1.01 .... .... 1010 .0. 0 ....       @vfp_dnm_s
 +VFNMS_sp     ---- 1110 1.01 .... .... 1010 .1. 0 ....       @vfp_dnm_s
 +
 +VFMA_dp      ---- 1110 1.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
 +VFMS_dp      ---- 1110 1.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
 +VFNMA_dp     ---- 1110 1.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
 +VFNMS_dp     ---- 1110 1.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
  VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
               vd=%vd_sp imm=%vmov_imm
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 22/33] target/arm: Split VMINMAXNM decode
-Now we have separate types for BCM2386 and BCM2387, we might as well
+From: Richard Henderson <richard.henderson@linaro.org>
 just hard-code the CPU type they use rather than having it passed
 through as an object property. This then lets us put the initialization
 of the CPU object in init rather than realize.
-Note that this change means that it's no longer possible on
+Passing the raw op field from the manual is less instructive
-the command line to use -cpu to ask for a different kind of
+than it might be.  Do the full decode and use the existing
-CPU than the SoC supports. This was never a supported thing to
+helpers to perform the expansion.
 do anyway; we were just not sanity-checking the command line.
-This does require us to only build the bcm2837 object on
+Since these are v8 insns, VECLEN+VECSTRIDE are already RES0.
 TARGET_AARCH64 configs, since otherwise it won't instantiate
 due to the missing cortex-a53 device and "make check" will fail.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200224222232.13807-18-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 24 +++++++++++++++---------
+ target/arm/translate-vfp.inc.c | 109 +++++++++++----------------------
- hw/arm/raspi.c   |  2 --
+ target/arm/vfp-uncond.decode   |  12 ++--
-files changed, 15 insertions(+), 11 deletions(-)
+files changed, 44 insertions(+), 77 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
+     return true;
- struct BCM283XInfo {
+ }
-     const char *name;
-+    const char *cpu_type;
+-static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
-     int clusterid;
+-{
- };
+-    uint32_t rd, rn, rm;
+-    bool dp = a->dp;
- static const BCM283XInfo bcm283x_socs[] = {
+-    bool vmin = a->op;
-     {
+-    TCGv_ptr fpst;
-         .name = TYPE_BCM2836,
+-
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
+-    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
-         .clusterid = 0xf,
+-        return false;
      },
 +#ifdef TARGET_AARCH64
      {
          .name = TYPE_BCM2837,
 +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
          .clusterid = 0x0,
      },
 +#endif
  };
  static void bcm2836_init(Object *obj)
  {
      BCM283XState *s = BCM283X(obj);
 +    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
 +    const BCM283XInfo *info = bc->info;
 +    int n;
 +
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
 +        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 +                          info->cpu_type);
 +        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 +                                  &error_abort);
 +    }
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
 -    obj = OBJECT(dev);
 -    for (n = 0; n < BCM283X_NCPUS; n++) {
 -        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 -                          s->cpu_type);
 -        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 -                                  &error_abort);
 -    }
 -
-     obj = object_property_get_link(OBJECT(dev), "ram", &err);
+-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
-     if (obj == NULL) {
+-        return false;
-         error_setg(errp, "%s: required ram link not found: %s",
+-    }
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+-
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 -        ((a->vm | a->vn | a->vd) & 0x10)) {
 -        return false;
 -    }
 -
 -    rd = a->vd;
 -    rn = a->vn;
 -    rm = a->vm;
 -
 -    if (!vfp_access_check(s)) {
 -        return true;
 -    }
 -
 -    fpst = get_fpstatus_ptr(0);
 -
 -    if (dp) {
 -        TCGv_i64 frn, frm, dest;
 -
 -        frn = tcg_temp_new_i64();
 -        frm = tcg_temp_new_i64();
 -        dest = tcg_temp_new_i64();
 -
 -        neon_load_reg64(frn, rn);
 -        neon_load_reg64(frm, rm);
 -        if (vmin) {
 -            gen_helper_vfp_minnumd(dest, frn, frm, fpst);
 -        } else {
 -            gen_helper_vfp_maxnumd(dest, frn, frm, fpst);
 -        }
 -        neon_store_reg64(dest, rd);
 -        tcg_temp_free_i64(frn);
 -        tcg_temp_free_i64(frm);
 -        tcg_temp_free_i64(dest);
 -    } else {
 -        TCGv_i32 frn, frm, dest;
 -
 -        frn = tcg_temp_new_i32();
 -        frm = tcg_temp_new_i32();
 -        dest = tcg_temp_new_i32();
 -
 -        neon_load_reg32(frn, rn);
 -        neon_load_reg32(frm, rm);
 -        if (vmin) {
 -            gen_helper_vfp_minnums(dest, frn, frm, fpst);
 -        } else {
 -            gen_helper_vfp_maxnums(dest, frn, frm, fpst);
 -        }
 -        neon_store_reg32(dest, rd);
 -        tcg_temp_free_i32(frn);
 -        tcg_temp_free_i32(frm);
 -        tcg_temp_free_i32(dest);
 -    }
 -
 -    tcg_temp_free_ptr(fpst);
 -    return true;
 -}
 -
  /*
   * Table for converting the most common AArch32 encoding of
   * rounding mode to arm_fprounding order (which matches the
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
      return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
  }
- static Property bcm2836_props[] = {
++static bool trans_VMINNM_sp(DisasContext *s, arg_VMINNM_sp *a)
--    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
++{
-     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
++    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
-                        BCM283X_NCPUS),
++        return false;
-     DEFINE_PROP_END_OF_LIST()
++    }
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
++    return do_vfp_3op_sp(s, gen_helper_vfp_minnums,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
 +static bool trans_VMAXNM_sp(DisasContext *s, arg_VMAXNM_sp *a)
 +{
 +    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
 +        return false;
 +    }
 +    return do_vfp_3op_sp(s, gen_helper_vfp_maxnums,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
 +static bool trans_VMINNM_dp(DisasContext *s, arg_VMINNM_dp *a)
 +{
 +    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
 +        return false;
 +    }
 +    return do_vfp_3op_dp(s, gen_helper_vfp_minnumd,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
 +static bool trans_VMAXNM_dp(DisasContext *s, arg_VMAXNM_dp *a)
 +{
 +    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
 +        return false;
 +    }
 +    return do_vfp_3op_dp(s, gen_helper_vfp_maxnumd,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
  static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
  {
      /*
 diff --git a/target/arm/vfp-uncond.decode b/target/arm/vfp-uncond.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/vfp-uncond.decode
-+++ b/hw/arm/raspi.c
++++ b/target/arm/vfp-uncond.decode
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+@@ -XXX,XX +XXX,XX @@
-     /* Setup the SOC */
+ %vd_dp  22:1 12:4
-     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
+ %vd_sp  12:4 22:1
-                                    &error_abort);
--    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
++@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
--                            &error_abort);
++@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
-     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
++
-                             &error_abort);
+ VSEL        1111 1110 0. cc:2 .... .... 1010 .0.0 .... \
-     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
+             vm=%vm_sp vn=%vn_sp vd=%vd_sp dp=0
  VSEL        1111 1110 0. cc:2 .... .... 1011 .0.0 .... \
              vm=%vm_dp vn=%vn_dp vd=%vd_dp dp=1
 -VMINMAXNM   1111 1110 1.00 .... .... 1010 . op:1 .0 .... \
 -            vm=%vm_sp vn=%vn_sp vd=%vd_sp dp=0
 -VMINMAXNM   1111 1110 1.00 .... .... 1011 . op:1 .0 .... \
 -            vm=%vm_dp vn=%vn_dp vd=%vd_dp dp=1
 +VMAXNM_sp   1111 1110 1.00 .... .... 1010 .0.0 ....         @vfp_dnm_s
 +VMINNM_sp   1111 1110 1.00 .... .... 1010 .1.0 ....         @vfp_dnm_s
 +
 +VMAXNM_dp   1111 1110 1.00 .... .... 1011 .0.0 ....         @vfp_dnm_d
 +VMINNM_dp   1111 1110 1.00 .... .... 1011 .1.0 ....         @vfp_dnm_d
  VRINT       1111 1110 1.11 10 rm:2 .... 1010 01.0 .... \
              vm=%vm_sp vd=%vd_sp dp=0
 --
-.16.2
+.20.1

-New patch
+[PULL 23/33] hw/arm/xilinx_zynq: Fix USB port instantiation
+From: Guenter Roeck <linux@roeck-us.net>
+USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
+Linux expects and checks various chipidea registers, which do not exist
+with the basic ehci emulation. This patch series fixes the problem.
+Without this patch, USB ports fail to instantiate under Linux.
+ci_hdrc ci_hdrc.0: doesn't support host
+ci_hdrc ci_hdrc.0: no supported roles
+With this patch, USB ports are instantiated, and it is possible
+to boot from USB drive.
+ci_hdrc ci_hdrc.0: EHCI Host Controller
+ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
+ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
+usb 1-1: new full-speed USB device number 2 using ci_hdrc
+usb 1-1: not running at top speed; connect to a high speed hub
+usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
+usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
+usb-storage 1-1:1.0: USB Mass Storage device detected
+scsi host0: usb-storage 1-1:1.0
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
+Message-id: 20200215122354.13706-2-linux@roeck-us.net
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xilinx_zynq.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xilinx_zynq.c
++++ b/hw/arm/xilinx_zynq.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/loader.h"
+ #include "hw/misc/zynq-xadc.h"
+ #include "hw/ssi/ssi.h"
++#include "hw/usb/chipidea.h"
+ #include "qemu/error-report.h"
+ #include "hw/sd/sdhci.h"
+ #include "hw/char/cadence_uart.h"
+@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)
+     zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
+     zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
+-    sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
+-    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
++    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
++    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
+     cadence_uart_create(0xE0000000, pic[59 - IRQ_OFFSET], serial_hd(0));
+     cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
+--
+.20.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 24/33] hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class
 From: Guenter Roeck <linux@roeck-us.net>
-The sabrelite machine model used by qemu-system-arm is based on the
+Xilinx USB devices are now instantiated through TYPE_CHIPIDEA,
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+and xlnx support in the EHCI code is no longer needed.
 controller which is supported in QEMU using the imx_fec.c module
 (actually called imx.enet for this model.)
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
-imx.enet device like this:
- #define FSL_IMX6_ENET_MAC_1588_IRQ 118
- #define FSL_IMX6_ENET_MAC_IRQ 119
-According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
-page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
-interrupts are as follows.
-ENET MAC 0 IRQ
-ENET MAC 0 1588 Timer interrupt
-where
-- 32 == 118
-- 32 == 119
-In other words, the vector definitions in the fsl-imx6.h file are reversed.
-Fixing the interrupts alone causes problems with older Linux kernels:
-The Ethernet interface will fail to probe with Linux v4.9 and earlier.
-Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
-error handling. This is a Linux kernel problem, not a qemu problem:
-the Linux kernel only worked by accident since it requested both interrupts.
-For backward compatibility, generate the Ethernet interrupt on both interrupt
-lines. This was shown to work from all Linux kernel releases starting with
-v3.16.
-Link: https://bugs.launchpad.net/qemu/+bug/1753309
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
+Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20200215122354.13706-3-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ hw/usb/hcd-ehci-sysbus.c | 17 -----------------
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+file changed, 17 deletions(-)
 files changed, 29 insertions(+), 3 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/hw/usb/hcd-ehci-sysbus.c
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/hw/usb/hcd-ehci-sysbus.c
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_platform_type_info = {
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+     .class_init    = ehci_platform_class_init,
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+ };
- #define FSL_IMX6_MLB150_LOW_IRQ 117
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
+-static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
--#define FSL_IMX6_ENET_MAC_IRQ 119
+-{
-+#define FSL_IMX6_ENET_MAC_IRQ 118
+-    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
+-    DeviceClass *dc = DEVICE_CLASS(oc);
- #define FSL_IMX6_PCIE1_IRQ 120
+-
- #define FSL_IMX6_PCIE2_IRQ 121
+-    set_bit(DEVICE_CATEGORY_USB, dc->categories);
- #define FSL_IMX6_PCIE3_IRQ 122
+-    sec->capsbase = 0x100;
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+-    sec->opregbase = 0x140;
-index XXXXXXX..XXXXXXX 100644
+-}
---- a/hw/net/imx_fec.c
+-
-+++ b/hw/net/imx_fec.c
+-static const TypeInfo ehci_xlnx_type_info = {
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
+-    .name          = "xlnx,ps7-usb",
+-    .parent        = TYPE_SYS_BUS_EHCI,
- static void imx_eth_update(IMXFECState *s)
+-    .class_init    = ehci_xlnx_class_init,
 -};
 -
  static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
  {
--    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-+    /*
+@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
-+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+ {
-+     * interrupts swapped. This worked with older versions of Linux (4.14
+     type_register_static(&ehci_type_info);
-+     * and older) since Linux associated both interrupt lines with Ethernet
+     type_register_static(&ehci_platform_type_info);
-+     * MAC interrupts. Specifically,
+-    type_register_static(&ehci_xlnx_type_info);
-+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     type_register_static(&ehci_exynos4210_type_info);
-+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     type_register_static(&ehci_tegra2_type_info);
-+     *   with swapped interrupt assignments.
+     type_register_static(&ehci_ppc4xx_type_info);
 +     * - In linux 4.14, both interrupt lines were registered with the Ethernet
 +     *   MAC interrupt handler. As a result, all versions of qemu happen to
 +     *   work, though that is accidental.
 +     * - In Linux 4.9 and older, the timer interrupt was registered directly
 +     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
 +     *   redirected to a GPIO interrupt to work around erratum ERR006687.
 +     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
 +     *   interrupt never fired since IOMUX is currently not supported in qemu.
 +     *   Linux instead received MAC interrupts on the timer interrupt.
 +     *   As a result, qemu versions with the swapped interrupt assignment work,
 +     *   albeit accidentally, but qemu versions with the correct interrupt
 +     *   assignment fail.
 +     *
 +     * To ensure that all versions of Linux work, generate ENET_INT_MAC
 +     * interrrupts on both interrupt lines. This should be changed if and when
 +     * qemu supports IOMUX.
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.20.1

-New patch
+[PULL 25/33] tests/acceptance: Add a test for the N800 and N810 arm machines
+From: Thomas Huth <thuth@redhat.com>
+Old kernels from the Meego project can be used to check that Linux
+is at least starting on these machines.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200225172501.29609-2-philmd@redhat.com
+Message-Id: <20200129131920.22302-1-thuth@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ MAINTAINERS                          |  1 +
+ tests/acceptance/machine_arm_n8x0.py | 49 ++++++++++++++++++++++++++++
+files changed, 50 insertions(+)
+ create mode 100644 tests/acceptance/machine_arm_n8x0.py
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: hw/rtc/twl92230.c
+ F: include/hw/display/blizzard.h
+ F: include/hw/input/tsc2xxx.h
+ F: include/hw/misc/cbus.h
++F: tests/acceptance/machine_arm_n8x0.py
+ Palm
+ M: Andrzej Zaborowski <balrogg@gmail.com>
+diff --git a/tests/acceptance/machine_arm_n8x0.py b/tests/acceptance/machine_arm_n8x0.py
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/acceptance/machine_arm_n8x0.py
+@@ -XXX,XX +XXX,XX @@
++# Functional test that boots a Linux kernel and checks the console
++#
++# Copyright (c) 2020 Red Hat, Inc.
++#
++# Author:
++#  Thomas Huth <thuth@redhat.com>
++#
++# This work is licensed under the terms of the GNU GPL, version 2 or
++# later.  See the COPYING file in the top-level directory.
++
++import os
++
++from avocado import skipUnless
++from avocado_qemu import Test
++from avocado_qemu import wait_for_console_pattern
++
++class N8x0Machine(Test):
++    """Boots the Linux kernel and checks that the console is operational"""
++
++    timeout = 90
++
++    def __do_test_n8x0(self):
++        kernel_url = ('http://stskeeps.subnetmask.net/meego-n8x0/'
++                      'meego-arm-n8x0-1.0.80.20100712.1431-'
++                      'vmlinuz-2.6.35~rc4-129.1-n8x0')
++        kernel_hash = 'e9d5ab8d7548923a0061b6fbf601465e479ed269'
++        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
++
++        self.vm.set_console(console_index=1)
++        self.vm.add_args('-kernel', kernel_path,
++                         '-append', 'printk.time=0 console=ttyS1')
++        self.vm.launch()
++        wait_for_console_pattern(self, 'TSC2005 driver initializing')
++
++    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
++    def test_n800(self):
++        """
++        :avocado: tags=arch:arm
++        :avocado: tags=machine:n800
++        """
++        self.__do_test_n8x0()
++
++    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
++    def test_n810(self):
++        """
++        :avocado: tags=arch:arm
++        :avocado: tags=machine:n810
++        """
++        self.__do_test_n8x0()
+--
+.20.1

-New patch
+[PULL 26/33] tests/acceptance: Add a test for the integratorcp arm machine
+From: Thomas Huth <thuth@redhat.com>
+There is a kernel and initrd available on github which we can use
+for testing this machine.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200225172501.29609-3-philmd@redhat.com
+Message-Id: <20200131170233.14584-1-thuth@redhat.com>
+[PMD: Renamed test method, moved description from class to method]
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ MAINTAINERS                                  |  1 +
+ tests/acceptance/machine_arm_integratorcp.py | 43 ++++++++++++++++++++
+files changed, 44 insertions(+)
+ create mode 100644 tests/acceptance/machine_arm_integratorcp.py
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ S: Maintained
+ F: hw/arm/integratorcp.c
+ F: hw/misc/arm_integrator_debug.c
+ F: include/hw/misc/arm_integrator_debug.h
++F: tests/acceptance/machine_arm_integratorcp.py
+ MCIMX6UL EVK / i.MX6ul
+ M: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/acceptance/machine_arm_integratorcp.py
+@@ -XXX,XX +XXX,XX @@
++# Functional test that boots a Linux kernel and checks the console
++#
++# Copyright (c) 2020 Red Hat, Inc.
++#
++# Author:
++#  Thomas Huth <thuth@redhat.com>
++#
++# This work is licensed under the terms of the GNU GPL, version 2 or
++# later.  See the COPYING file in the top-level directory.
++
++import os
++
++from avocado import skipUnless
++from avocado_qemu import Test
++from avocado_qemu import wait_for_console_pattern
++
++class IntegratorMachine(Test):
++
++    timeout = 90
++
++    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
++    def test_integratorcp_console(self):
++        """
++        Boots the Linux kernel and checks that the console is operational
++        :avocado: tags=arch:arm
++        :avocado: tags=machine:integratorcp
++        """
++        kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
++                      'arm-test/kernel/zImage.integrator')
++        kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
++        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
++
++        initrd_url = ('https://github.com/zayac/qemu-arm/raw/master/'
++                      'arm-test/kernel/arm_root.img')
++        initrd_hash = 'b51e4154285bf784e017a37586428332d8c7bd8b'
++        initrd_path = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
++
++        self.vm.set_console()
++        self.vm.add_args('-kernel', kernel_path,
++                         '-initrd', initrd_path,
++                         '-append', 'printk.time=0 console=ttyAMA0')
++        self.vm.launch()
++        wait_for_console_pattern(self, 'Log in as root')
+--
+.20.1

-New patch
+[PULL 27/33] tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+As we want to re-use this code, extract it as a new function.
+Since we are using the PL011 serial console, add a Avocado tag
+to ease filtering of tests.
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200225172501.29609-4-philmd@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ tests/acceptance/machine_arm_integratorcp.py | 18 +++++++++++-------
+file changed, 11 insertions(+), 7 deletions(-)
+diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/acceptance/machine_arm_integratorcp.py
++++ b/tests/acceptance/machine_arm_integratorcp.py
+@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
+     timeout = 90
+-    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+-    def test_integratorcp_console(self):
+-        """
+-        Boots the Linux kernel and checks that the console is operational
+-        :avocado: tags=arch:arm
+-        :avocado: tags=machine:integratorcp
+-        """
++    def boot_integratorcp(self):
+         kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
+                       'arm-test/kernel/zImage.integrator')
+         kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
+@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
+                          '-initrd', initrd_path,
+                          '-append', 'printk.time=0 console=ttyAMA0')
+         self.vm.launch()
++
++    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
++    def test_integratorcp_console(self):
++        """
++        Boots the Linux kernel and checks that the console is operational
++        :avocado: tags=arch:arm
++        :avocado: tags=machine:integratorcp
++        :avocado: tags=device:pl011
++        """
++        self.boot_integratorcp()
+         wait_for_console_pattern(self, 'Log in as root')
+--
+.20.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+[PULL 28/33] tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer
-From: Wei Huang <wei@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-For guest kernel that supports KASLR, the load address can change every
+Add a test that verifies the Tux logo is displayed on the framebuffer.
 time when guest VM runs. To find the physical base address correctly,
 current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
 However this string pattern is only available on x86_64. AArch64 uses a
 different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
 QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
+We simply follow the OpenCV "Template Matching with Multiple Objects"
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+tutorial, replacing Lionel Messi by Tux:
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
+https://docs.opencv.org/4.2.0/d4/dc6/tutorial_py_template_matching.html
 When OpenCV and NumPy are installed, this test can be run using:
   $ AVOCADO_ALLOW_UNTRUSTED_CODE=hmmm \
     avocado --show=app,framebuffer run -t device:framebuffer \
       tests/acceptance/machine_arm_integratorcp.py
   JOB ID     : 8c46b0f8269242e87d738247883ea2a470df949e
   JOB LOG    : avocado/job-results/job-2020-01-31T21.38-8c46b0f/job.log
    (1/1) tests/acceptance/machine_arm_integratorcp.py:IntegratorMachine.test_framebuffer_tux_logo:
   framebuffer: found Tux at position [x, y] = (0, 0)
   PASS (3.96 s)
   RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
   JOB TIME   : 4.23 s
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
 Message-id: 20200225172501.29609-5-philmd@redhat.com
 Message-Id: <20200131211102.29612-3-f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- dump.c | 14 +++++++++++---
+ tests/acceptance/machine_arm_integratorcp.py | 52 ++++++++++++++++++++
-file changed, 11 insertions(+), 3 deletions(-)
+file changed, 52 insertions(+)
-diff --git a/dump.c b/dump.c
+diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
 index XXXXXXX..XXXXXXX 100644
---- a/dump.c
+--- a/tests/acceptance/machine_arm_integratorcp.py
-+++ b/dump.c
++++ b/tests/acceptance/machine_arm_integratorcp.py
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
+@@ -XXX,XX +XXX,XX @@
+ # later.  See the COPYING file in the top-level directory.
-     lines = g_strsplit((char *)vmci, "\n", -1);
-     for (i = 0; lines[i]; i++) {
+ import os
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
++import logging
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
-+        const char *prefix = NULL;
+ from avocado import skipUnless
  from avocado_qemu import Test
  from avocado_qemu import wait_for_console_pattern
 +
-+        if (s->dump_info.d_machine == EM_X86_64) {
++NUMPY_AVAILABLE = True
-+            prefix = "NUMBER(phys_base)=";
++try:
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
++    import numpy as np
-+            prefix = "NUMBER(PHYS_OFFSET)=";
++except ImportError:
-+        }
++    NUMPY_AVAILABLE = False
 +
-+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
++CV2_AVAILABLE = True
-+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
++try:
-                               &phys_base) < 0) {
++    import cv2
--                warn_report("Failed to read NUMBER(phys_base)=");
++except ImportError:
-+                warn_report("Failed to read %s", prefix);
++    CV2_AVAILABLE = False
-             } else {
++
-                 s->dump_info.phys_base = phys_base;
++
-             }
+ class IntegratorMachine(Test):
      timeout = 90
@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
          """
          self.boot_integratorcp()
          wait_for_console_pattern(self, 'Log in as root')
 +
 +    @skipUnless(NUMPY_AVAILABLE, 'Python NumPy not installed')
 +    @skipUnless(CV2_AVAILABLE, 'Python OpenCV not installed')
 +    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
 +    def test_framebuffer_tux_logo(self):
 +        """
 +        Boot Linux and verify the Tux logo is displayed on the framebuffer.
 +        :avocado: tags=arch:arm
 +        :avocado: tags=machine:integratorcp
 +        :avocado: tags=device:pl110
 +        :avocado: tags=device:framebuffer
 +        """
 +        screendump_path = os.path.join(self.workdir, "screendump.pbm")
 +        tuxlogo_url = ('https://github.com/torvalds/linux/raw/v2.6.12/'
 +                       'drivers/video/logo/logo_linux_vga16.ppm')
 +        tuxlogo_hash = '3991c2ddbd1ddaecda7601f8aafbcf5b02dc86af'
 +        tuxlogo_path = self.fetch_asset(tuxlogo_url, asset_hash=tuxlogo_hash)
 +
 +        self.boot_integratorcp()
 +        framebuffer_ready = 'Console: switching to colour frame buffer device'
 +        wait_for_console_pattern(self, framebuffer_ready)
 +        self.vm.command('human-monitor-command', command_line='stop')
 +        self.vm.command('human-monitor-command',
 +                        command_line='screendump %s' % screendump_path)
 +        logger = logging.getLogger('framebuffer')
 +
 +        cpu_count = 1
 +        match_threshold = 0.92
 +        screendump_bgr = cv2.imread(screendump_path)
 +        screendump_gray = cv2.cvtColor(screendump_bgr, cv2.COLOR_BGR2GRAY)
 +        result = cv2.matchTemplate(screendump_gray, cv2.imread(tuxlogo_path, 0),
 +                                   cv2.TM_CCOEFF_NORMED)
 +        loc = np.where(result >= match_threshold)
 +        tux_count = 0
 +        for tux_count, pt in enumerate(zip(*loc[::-1]), start=1):
 +            logger.debug('found Tux at position [x, y] = %s', pt)
 +        self.assertGreaterEqual(tux_count, cpu_count)
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+[PULL 29/33] target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
-Our BCM2836 type is really a generic one that can be any of
+We missed an instance of using FIELD_EX32 on a 64-bit ID
-the bcm283x family. Rename it accordingly. We change only
+register, in isar_feature_aa64_pmu_8_4(). Fix it.
 the names which are visible via the header file to the
 rest of the QEMU code, leaving private function names
 in bcm2836.c as they are.
 This is a preliminary to making bcm283x be an abstract
 parent class to specific types for the bcm2836 and bcm2837.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
+Message-id: 20200224172846.13053-2-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 12 ++++++------
+ target/arm/cpu.h | 4 ++--
- hw/arm/bcm2836.c         | 17 +++++++++--------
+file changed, 2 insertions(+), 2 deletions(-)
  hw/arm/raspi.c           | 16 ++++++++--------
 files changed, 23 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_1(const ARMISARegisters *id)
- #include "hw/arm/bcm2835_peripherals.h"
- #include "hw/intc/bcm2836_control.h"
+ static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
 -#define TYPE_BCM2836 "bcm2836"
 -#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
 +#define TYPE_BCM283X "bcm283x"
 +#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 -#define BCM2836_NCPUS 4
 +#define BCM283X_NCPUS 4
 -typedef struct BCM2836State {
 +typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
      /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
      char *cpu_type;
      uint32_t enabled_cpus;
 -    ARMCPU cpus[BCM2836_NCPUS];
 +    ARMCPU cpus[BCM283X_NCPUS];
      BCM2836ControlState control;
      BCM2835PeripheralState peripherals;
 -} BCM2836State;
 +} BCM283XState;
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2836.c
 +++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
  static void bcm2836_init(Object *obj)
  {
--    BCM2836State *s = BCM2836(obj);
+-    return FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
-+    BCM283XState *s = BCM283X(obj);
+-        FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
++    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
++        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
  static void bcm2836_realize(DeviceState *dev, Error **errp)
  {
 -    BCM2836State *s = BCM2836(dev);
 +    BCM283XState *s = BCM283X(dev);
      Object *obj;
      Error *err = NULL;
      int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
      obj = OBJECT(dev);
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                            s->cpu_type);
          object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          /* Mirror bcm2836, which has clusterid set to 0xf
           * TODO: this should be converted to a property of ARM_CPU
           */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
- static Property bcm2836_props[] = {
+ /*
 -    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
 -    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
 +    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
 +    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
 +                       BCM283X_NCPUS),
      DEFINE_PROP_END_OF_LIST()
  };
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
  }
  static const TypeInfo bcm2836_type_info = {
 -    .name = TYPE_BCM2836,
 +    .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
 -    .instance_size = sizeof(BCM2836State),
 +    .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
      .class_init = bcm2836_class_init,
  };
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
  typedef struct RasPiState {
 -    BCM2836State soc;
 +    BCM283XState soc;
      MemoryRegion ram;
  } RasPiState;
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
  }
  DEFINE_MACHINE("raspi3", raspi3_machine_init)
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+[PULL 30/33] target/arm: Implement v8.3-RCPC
-The TypeInfo and state struct for bcm2386 disagree about what the
+The v8.3-RCPC extension implements three new load instructions
-parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
+which provide slightly weaker consistency guarantees than the
-but the BCM2386State struct only defines the parent_obj field
+existing load-acquire operations. For QEMU we choose to simply
-as DeviceState. This would have caused problems if anything
+implement them with a full LDAQ barrier.
 actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
 Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
 need any of the additional functionality TYPE_SYS_BUS_DEVICE
 provides.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200224172846.13053-3-peter.maydell@linaro.org
 Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 2 +-
+ target/arm/cpu.h           |  5 +++++
-file changed, 1 insertion(+), 1 deletion(-)
+ linux-user/elfload.c       |  1 +
  target/arm/cpu64.c         |  1 +
  target/arm/translate-a64.c | 24 ++++++++++++++++++++++++
 files changed, 31 insertions(+)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
+         FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
- static const TypeInfo bcm2836_type_info = {
+ }
-     .name = TYPE_BCM2836,
--    .parent = TYPE_SYS_BUS_DEVICE,
++static inline bool isar_feature_aa64_rcpc_8_3(const ARMISARegisters *id)
-+    .parent = TYPE_DEVICE,
++{
-     .instance_size = sizeof(BCM2836State),
++    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) != 0;
-     .instance_init = bcm2836_init,
++}
-     .class_init = bcm2836_class_init,
++
  /*
   * Feature tests for "does this exist in either 32-bit or 64-bit?"
   */
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
      GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
      GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
      GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
 +    GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
      return hwcaps;
  }
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
 +        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 1); /* ARMv8.3-RCPC */
          cpu->isar.id_aa64isar1 = t;
          t = cpu->isar.id_aa64pfr0;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
      int rs = extract32(insn, 16, 5);
      int rn = extract32(insn, 5, 5);
      int o3_opc = extract32(insn, 12, 4);
 +    bool r = extract32(insn, 22, 1);
 +    bool a = extract32(insn, 23, 1);
      TCGv_i64 tcg_rs, clean_addr;
      AtomicThreeOpFn *fn;
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
      case 010: /* SWP */
          fn = tcg_gen_atomic_xchg_i64;
          break;
 +    case 014: /* LDAPR, LDAPRH, LDAPRB */
 +        if (!dc_isar_feature(aa64_rcpc_8_3, s) ||
 +            rs != 31 || a != 1 || r != 0) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        break;
      default:
          unallocated_encoding(s);
          return;
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
          gen_check_sp_alignment(s);
      }
      clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
 +
 +    if (o3_opc == 014) {
 +        /*
 +         * LDAPR* are a special case because they are a simple load, not a
 +         * fetch-and-do-something op.
 +         * The architectural consistency requirements here are weaker than
 +         * full load-acquire (we only need "load-acquire processor consistent"),
 +         * but we choose to implement them as full LDAQ.
 +         */
 +        do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, false,
 +                  true, rt, disas_ldst_compute_iss_sf(size, false, 0), true);
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 +        return;
 +    }
 +
      tcg_rs = read_cpu_reg(s, rs, true);
      if (o3_opc == 1) { /* LDCLR */
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 31/33] target/arm: Implement v8.4-RCPC
-Add some assertions that if we're about to boot an AArch64 kernel,
+The v8.4-RCPC extension implements some new instructions:
-the board code has not mistakenly set either secure_boot or
+ * LDAPUR, LDAPURB, LDAPURH, LDAPRSB, LDAPRSH, LDAPRSW
-secure_board_setup. It doesn't make sense to set secure_boot,
+ * STLUR, STLURB, STLURH
 because all AArch64 kernels must be booted in non-secure mode.
-It might in theory make sense to set secure_board_setup, but
+These are all in a new subgroup of encodings that sits below the
-we don't currently support that, because only the AArch32
+top-level "Loads and Stores" group in the Arm ARM.
-bootloader[] code calls this hook; bootloader_aarch64[] does not.
-Since we don't have a current need for this functionality, just
+The STLUR* instructions have standard store-release semantics; the
-assert that we don't try to use it. If it's needed we'll add
+LDAPUR* have Load-AcquirePC semantics, but (as with LDAPR*) we choose
-it later.
+to implement them as the slightly stronger Load-Acquire.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
+Message-id: 20200224172846.13053-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ target/arm/cpu.h           |  5 +++
-file changed, 7 insertions(+)
+ linux-user/elfload.c       |  1 +
  target/arm/cpu64.c         |  2 +-
  target/arm/translate-a64.c | 90 ++++++++++++++++++++++++++++++++++++++
 files changed, 97 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/boot.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_3(const ARMISARegisters *id)
-                     } else {
+     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) != 0;
-                         env->pstate = PSTATE_MODE_EL1h;
+ }
-                     }
-+                    /* AArch64 kernels never boot in secure mode */
++static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
-+                    assert(!info->secure_boot);
++{
-+                    /* This hook is only supported for AArch32 currently:
++    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
-+                     * bootloader_aarch64[] will not call the hook, and
++}
-+                     * the code above has already dropped us into EL2 or EL1.
++
-+                     */
+ /*
-+                    assert(!info->secure_board_setup);
+  * Feature tests for "does this exist in either 32-bit or 64-bit?"
-                 }
+  */
+diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-                 /* Set to non-secure if not a secure boot */
+index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
      GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
      GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
      GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
 +    GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
      return hwcaps;
  }
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
 -        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 1); /* ARMv8.3-RCPC */
 +        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2); /* ARMv8.4-RCPC */
          cpu->isar.id_aa64isar1 = t;
          t = cpu->isar.id_aa64pfr0;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pac(DisasContext *s, uint32_t insn,
      }
  }
 +/*
 + * LDAPR/STLR (unscaled immediate)
 + *
 + *  31  30            24    22  21       12    10    5     0
 + * +------+-------------+-----+---+--------+-----+----+-----+
 + * | size | 0 1 1 0 0 1 | opc | 0 |  imm9  | 0 0 | Rn |  Rt |
 + * +------+-------------+-----+---+--------+-----+----+-----+
 + *
 + * Rt: source or destination register
 + * Rn: base register
 + * imm9: unscaled immediate offset
 + * opc: 00: STLUR*, 01/10/11: various LDAPUR*
 + * size: size of load/store
 + */
 +static void disas_ldst_ldapr_stlr(DisasContext *s, uint32_t insn)
 +{
 +    int rt = extract32(insn, 0, 5);
 +    int rn = extract32(insn, 5, 5);
 +    int offset = sextract32(insn, 12, 9);
 +    int opc = extract32(insn, 22, 2);
 +    int size = extract32(insn, 30, 2);
 +    TCGv_i64 clean_addr, dirty_addr;
 +    bool is_store = false;
 +    bool is_signed = false;
 +    bool extend = false;
 +    bool iss_sf;
 +
 +    if (!dc_isar_feature(aa64_rcpc_8_4, s)) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (opc) {
 +    case 0: /* STLURB */
 +        is_store = true;
 +        break;
 +    case 1: /* LDAPUR* */
 +        break;
 +    case 2: /* LDAPURS* 64-bit variant */
 +        if (size == 3) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        is_signed = true;
 +        break;
 +    case 3: /* LDAPURS* 32-bit variant */
 +        if (size > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        is_signed = true;
 +        extend = true; /* zero-extend 32->64 after signed load */
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
 +
 +    if (rn == 31) {
 +        gen_check_sp_alignment(s);
 +    }
 +
 +    dirty_addr = read_cpu_reg_sp(s, rn, 1);
 +    tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
 +    clean_addr = clean_data_tbi(s, dirty_addr);
 +
 +    if (is_store) {
 +        /* Store-Release semantics */
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 +        do_gpr_st(s, cpu_reg(s, rt), clean_addr, size, true, rt, iss_sf, true);
 +    } else {
 +        /*
 +         * Load-AcquirePC semantics; we implement as the slightly more
 +         * restrictive Load-Acquire.
 +         */
 +        do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, is_signed, extend,
 +                  true, rt, iss_sf, true);
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 +    }
 +}
 +
  /* Load/store register (all forms) */
  static void disas_ldst_reg(DisasContext *s, uint32_t insn)
  {
@@ -XXX,XX +XXX,XX @@ static void disas_ldst(DisasContext *s, uint32_t insn)
      case 0x0d: /* AdvSIMD load/store single structure */
          disas_ldst_single_struct(s, insn);
          break;
 +    case 0x19: /* LDAPR/STLR (unscaled immediate) */
 +        if (extract32(insn, 10, 2) != 0 ||
 +            extract32(insn, 21, 1) != 0) {
 +            unallocated_encoding(s);
 +            break;
 +        }
 +        disas_ldst_ldapr_stlr(s, insn);
 +        break;
      default:
          unallocated_encoding(s);
          break;
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 32/33] target/arm: Implement ARMv8.3-CCIDX
-The raspi3 has AArch64 CPUs, which means that our smpboot
+The ARMv8.3-CCIDX extension makes the CCSIDR_EL1 system ID registers
-code for keeping the secondary CPUs in a pen needs to have
+have a format that uses the full 64 bit width of the register, and
-a version for A64 as well as A32. Without this, the
+adds a new CCSIDR2 register so AArch32 can get at the high 32 bits.
-secondary CPUs go into an infinite loop of taking undefined
-instruction exceptions.
+QEMU doesn't implement caches, so we just treat these ID registers as
 opaque values that are set to the correct constant values for each
 CPU.  The only thing we need to do is allow 64-bit values in our
 cssidr[] array and provide the CCSIDR2 accessors.
 We don't set the CCIDX field in our 'max' CPU because the CCSIDR
 constant values we use are the same as the ones used by the
 Cortex-A57 and they are in the old 32-bit format. This means
 that the extra regdef added here is unused currently, but it
 means that whenever in the future we add a CPU that does need
 the new 64-bit format it will just work when we set the cssidr
 values and the ID registers for it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
+Message-id: 20200224182626.29252-1-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ target/arm/cpu.h    | 17 ++++++++++++++++-
-file changed, 40 insertions(+), 1 deletion(-)
+ target/arm/helper.c | 19 +++++++++++++++++++
 files changed, 35 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/raspi.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+     /* The elements of this array are the CCSIDR values for each cache,
- #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
+      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
- #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+      */
-+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
+-    uint32_t ccsidr[16];
++    uint64_t ccsidr[16];
- /* Table of Linux board IDs for different Pi versions */
+     uint64_t reset_cbar;
- static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
+     uint32_t reset_auxcr;
-@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
+     bool reset_hivecs;
-                        info->smp_loader_start);
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ac2(const ARMISARegisters *id)
      return FIELD_EX32(id->id_mmfr4, ID_MMFR4, AC2) != 0;
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
++static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
 +{
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
++    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
 +     * The mechanism for doing the spin-table is also entirely different.
 +     * We must have four 64-bit fields at absolute addresses
 +     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
 +     * our CPUs, and which we must ensure are zero initialized before
 +     * the primary CPU goes into the kernel. We put these variables inside
 +     * a rom blob, so that the reset for ROM contents zeroes them for us.
 +     */
 +    static const uint32_t smpboot[] = {
 +        0xd2801b05, /*        mov     x5, 0xd8 */
 +        0xd53800a6, /*        mrs     x6, mpidr_el1 */
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
 +    static const uint64_t spintables[] = {
 +        0, 0, 0, 0
 +    };
 +
 +    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
 +                       info->smp_loader_start);
 +    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
 +                       SPINTABLE_ADDR);
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
+ /*
   * 64-bit feature tests via id registers.
   */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
  }
 +static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
 +}
 +
  /*
   * Feature tests for "does this exist in either 32-bit or 64-bit?"
   */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_pmu_8_4(const ARMISARegisters *id)
      return isar_feature_aa64_pmu_8_4(id) || isar_feature_aa32_pmu_8_4(id);
  }
 +static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
 +{
 +    return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
 +}
 +
  /*
   * Forward to the above feature tests given an ARMCPU pointer.
   */
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
      REGINFO_SENTINEL
  };
 +static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
 +{
 +    /* Read the high 32 bits of the current CCSIDR */
 +    return extract64(ccsidr_read(env, ri), 32, 32);
 +}
 +
 +static const ARMCPRegInfo ccsidr2_reginfo[] = {
 +    { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2,
 +      .access = PL1_R,
 +      .accessfn = access_aa64_tid2,
 +      .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
 +    REGINFO_SENTINEL
 +};
 +
  static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
                                         bool isread)
  {
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+         define_arm_cp_regs(cpu, predinv_reginfo);
      /* Pi2 and Pi3 requires SMP setup */
      if (version >= 2) {
          binfo.smp_loader_start = SMPBOOT_ADDR;
 -        binfo.write_secondary_boot = write_smpboot;
 +        if (version == 2) {
 +            binfo.write_secondary_boot = write_smpboot;
 +        } else {
 +            binfo.write_secondary_boot = write_smpboot64;
 +        }
          binfo.secondary_cpu_reset_hook = reset_secondary;
      }
++    if (cpu_isar_feature(any_ccidx, cpu)) {
++        define_arm_cp_regs(cpu, ccsidr2_reginfo);
++    }
++
+ #ifndef CONFIG_USER_ONLY
+     /*
+      * Register redirections and aliases must be done last,
 --
-.16.2
+.20.1

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+[PULL 33/33] hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2
-For the rpi1 and 2 we want to boot the Linux kernel via some
+In our KVM GICv2 realize function, we try to cope with old kernels
-custom setup code that makes sure that the SMC instruction
+that don't provide the device control API (KVM_CAP_DEVICE_CTRL): we
-acts as a no-op, because it's used for cache maintenance.
+try to use the device control, and if that fails we fall back to
-The rpi3 boots AArch64 kernels, which don't need SMC for
+assuming that the kernel has the old style KVM_CREATE_IRQCHIP and
-cache maintenance and always expect to be booted non-secure.
+that it will provide a GICv2.
-Don't fill in the aarch32-specific parts of the binfo struct.
 This doesn't cater for the possibility of a kernel and hardware which
 only provide a GICv3, which is very common now.  On that setup we
 will abort() later on in kvm_arm_pmu_set_irq() when we try to wire up
 an interrupt to the GIC we failed to create:
 qemu-system-aarch64: PMU: KVM_SET_DEVICE_ATTR: Invalid argument
 qemu-system-aarch64: failed to set irq for PMU
 Aborted
 If the kernel advertises KVM_CAP_DEVICE_CTRL we should trust it if it
 says it can't create a GICv2, rather than assuming it has one.  We
 can then produce a more helpful error message including a hint about
 the most probable reason for the failure.
 If the kernel doesn't advertise KVM_CAP_DEVICE_CTRL then it is truly
 ancient by this point but we might as well still fall back to a
 KVM_CREATE_IRQCHIP GICv2.
 With this patch then the user misconfiguration which previously
 caused an abort now prints:
 qemu-system-aarch64: Initialization of device kvm-arm-gic failed: error creating in-kernel VGIC: No such device
 Perhaps the host CPU does not support GICv2?
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
+Tested-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20200225182435.1131-1-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 17 +++++++++++++----
+ hw/intc/arm_gic_kvm.c | 9 +++++++++
-file changed, 13 insertions(+), 4 deletions(-)
+file changed, 9 insertions(+)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/hw/intc/arm_gic_kvm.c
-+++ b/hw/arm/raspi.c
++++ b/hw/intc/arm_gic_kvm.c
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
-     binfo.board_id = raspi_boardid[version];
+                               KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
-     binfo.ram_size = ram_size;
+                               &error_abort);
-     binfo.nb_cpus = smp_cpus;
+         }
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
++    } else if (kvm_check_extension(kvm_state, KVM_CAP_DEVICE_CTRL)) {
--    binfo.write_board_setup = write_board_setup;
++        error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
--    binfo.secure_board_setup = true;
++        error_append_hint(errp,
--    binfo.secure_boot = true;
++                          "Perhaps the host CPU does not support GICv2?\n");
-+
+     } else if (ret != -ENODEV && ret != -ENOTSUP) {
-+    if (version <= 2) {
++        /*
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
++         * Very ancient kernel without KVM_CAP_DEVICE_CTRL: assume that
-+         * mode before booting a kernel (to set up the SMC vectors so
++         * ENODEV or ENOTSUP mean "can't create GICv2 with KVM_CREATE_DEVICE",
-+         * that we get a no-op SMC; this is used by Linux to call the
++         * and that we will get a GICv2 via KVM_CREATE_IRQCHIP.
 +         * firmware for some cache maintenance operations.
 +         * The rpi3 doesn't need this.
 +         */
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
-+        binfo.write_board_setup = write_board_setup;
+         return;
-+        binfo.secure_board_setup = true;
+     }
 +        binfo.secure_boot = true;
 +    }
      /* Pi2 and Pi3 requires SMP setup */
      if (version >= 2) {
 --
-.16.2
+.20.1

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

Another arm pullreq; nothing particularly exciting here.

-- PMM

The following changes since commit e27d5b488ef08408691bfed61f34ee2858136287:

Merge remote-tracking branch 'remotes/juanquintela/tags/pull-migration-pull-request' into staging (2020-02-28 14:02:31 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200228

for you to fetch changes up to 1904f9b5f1d94fe12fe021db6b504c87d684f6db:

hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2 (2020-02-28 16:14:57 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Use TYPE_PL011 to create serial port
 * target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
 * hw/arm/integratorcp: Map the audio codec controller
 * GICv2: Correctly implement the limited number of priority bits
 * target/arm: refactoring of VFP related feature checks and decode
 * xilinx_zynq: Fix USB port instantiation
 * acceptance tests for n800, n810, integratorcp
 * Implement v8.3-RCPC, v8.4-RCPC, v8.3-CCIDX
 * arm_gic_kvm: Don't assume kernel can provide a GICv2
   (provide better error message for user error)

----------------------------------------------------------------
Gavin Shan (1):
      hw/arm: Use TYPE_PL011 to create serial port

Guenter Roeck (2):
      hw/arm/xilinx_zynq: Fix USB port instantiation
      hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class

Peter Maydell (5):
      target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
      target/arm: Implement v8.3-RCPC
      target/arm: Implement v8.4-RCPC
      target/arm: Implement ARMv8.3-CCIDX
      hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2

Philippe Mathieu-Daudé (3):
      hw/arm/integratorcp: Map the audio codec controller
      tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
      tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer

Richard Henderson (17):
      target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
      target/arm: Add isar_feature_aa32_vfp_simd
      target/arm: Rename isar_feature_aa32_fpdp_v2
      target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
      target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
      target/arm: Perform fpdp_v2 check first
      target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
      target/arm: Add missing checks for fpsp_v2
      target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
      target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
      target/arm: Move VLLDM and VLSTM to vfp.decode
      target/arm: Move the vfp decodetree calls next to the base isa
      linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
      target/arm: Remove ARM_FEATURE_VFP*
      target/arm: Add formats for some vfp 2 and 3-register insns
      target/arm: Split VFM decode
      target/arm: Split VMINMAXNM decode

Sai Pavan Boddu (3):
      arm_gic: Mask the un-supported priority bits
      cpu/a9mpcore: Set number of GIC priority bits to 5
      cpu/arm11mpcore: Set number of GIC priority bits to 4

Thomas Huth (2):
      tests/acceptance: Add a test for the N800 and N810 arm machines
      tests/acceptance: Add a test for the integratorcp arm machine

From: Gavin Shan <gshan@redhat.com>

This uses TYPE_PL011 when creating the serial port so that the code
looks cleaner.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200224222223.4128-1-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c    | 3 ++-
 hw/arm/virt.c        | 3 ++-
 hw/arm/xlnx-versal.c | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci-host/gpex.h"
 #include "hw/qdev-properties.h"
 #include "hw/usb.h"
+#include "hw/char/pl011.h"
 #include "net/net.h"
 
 #define RAMLIMIT_GB 8192
@@ -XXX,XX +XXX,XX @@ static void create_uart(const SBSAMachineState *sms, int uart,
 {
     hwaddr base = sbsa_ref_memmap[uart].base;
     int irq = sbsa_ref_irqmap[uart];
-    DeviceState *dev = qdev_create(NULL, "pl011");
+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
 
     qdev_prop_set_chr(dev, "chardev", chr);
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/mem/nvdimm.h"
 #include "hw/acpi/generic_event_device.h"
 #include "hw/virtio/virtio-iommu.h"
+#include "hw/char/pl011.h"
 
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, int uart,
     int irq = vms->irqmap[uart];
     const char compat[] = "arm,pl011\0arm,primecell";
     const char clocknames[] = "uartclk\0apb_pclk";
-    DeviceState *dev = qdev_create(NULL, "pl011");
+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
 
     qdev_prop_set_chr(dev, "chardev", chr);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "hw/arm/xlnx-versal.h"
+#include "hw/char/pl011.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define GEM_REVISION        0x40070106
@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
         DeviceState *dev;
         MemoryRegion *mr;
 
-        dev = qdev_create(NULL, "pl011");
+        dev = qdev_create(NULL, TYPE_PL011);
         s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
         object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The Linux kernel displays errors why trying to detect the PL041
audio interface:

Linux version 4.16.0 (linus@genomnajs) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #142 PREEMPT Wed May 9 13:24:55 CEST 2018
  CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00093177
  CPU: VIVT data cache, VIVT instruction cache
  OF: fdt: Machine model: ARM Integrator/CP
  ...
  OF: amba_device_add() failed (-19) for /fpga/aaci@1d000000

Since we have it already modelled, simply plug it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200223233033.15371-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/integratorcp.c | 1 +
 hw/arm/Kconfig        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_WPROT, 0));
     qdev_connect_gpio_out(dev, 1,
                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_CARDIN, 0));
+    sysbus_create_varargs("pl041", 0x1d000000, pic[25], NULL);
 
     if (nd_table[0].used)
         smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
     select INTEGRATOR_DEBUG
     select PL011 # UART
     select PL031 # RTC
+    select PL041 # audio
     select PL050 # keyboard/mouse
     select PL110 # pl111 LCD controller
     select PL181 # display
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

The GICv2 allows the implementation to implement a variable number
of priority bits; unimplemented bits in the priority registers
are read as zeros, writes ignored. We were previously always
implementing a full 8 bits of priority, which is allowed but not
what the real hardware typically does (which is usually to have
4 or 5 bits of priority).

Add a new device property to allow the number of implemented
property bits to be specified.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Message-id: 1582537164-764-2-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: improved commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gic.h        |  2 ++
 include/hw/intc/arm_gic_common.h |  1 +
 hw/intc/arm_gic.c                | 33 ++++++++++++++++++++++++++++++--
 hw/intc/arm_gic_common.c         |  1 +
 4 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gic.h
+++ b/include/hw/intc/arm_gic.h
@@ -XXX,XX +XXX,XX @@
 
 /* Number of SGI target-list bits */
 #define GIC_TARGETLIST_BITS 8
+#define GIC_MAX_PRIORITY_BITS 8
+#define GIC_MIN_PRIORITY_BITS 4
 
 #define TYPE_ARM_GIC "arm_gic"
 #define ARM_GIC(obj) \
diff --git a/include/hw/intc/arm_gic_common.h b/include/hw/intc/arm_gic_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gic_common.h
+++ b/include/hw/intc/arm_gic_common.h
@@ -XXX,XX +XXX,XX @@ typedef struct GICState {
     uint16_t priority_mask[GIC_NCPU_VCPU];
     uint16_t running_priority[GIC_NCPU_VCPU];
     uint16_t current_pending[GIC_NCPU_VCPU];
+    uint32_t n_prio_bits;
 
     /* If we present the GICv2 without security extensions to a guest,
      * the guest can configure the GICC_CTLR to configure group 1 binary point
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
     return ret;
 }
 
+static uint32_t gic_fullprio_mask(GICState *s, int cpu)
+{
+    /*
+     * Return a mask word which clears the unimplemented priority
+     * bits from a priority value for an interrupt. (Not to be
+     * confused with the group priority, whose mask depends on BPR.)
+     */
+    int priBits;
+
+    if (gic_is_vcpu(cpu)) {
+        priBits = GIC_VIRT_MAX_GROUP_PRIO_BITS;
+    } else {
+        priBits = s->n_prio_bits;
+    }
+    return ~0U << (8 - priBits);
+}
+
 void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
                       MemTxAttrs attrs)
 {
@@ -XXX,XX +XXX,XX @@ void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
         val = 0x80 | (val >> 1); /* Non-secure view */
     }
 
+    val &= gic_fullprio_mask(s, cpu);
+
     if (irq < GIC_INTERNAL) {
         s->priority1[irq][cpu] = val;
     } else {
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_get_priority(GICState *s, int cpu, int irq,
         }
         prio = (prio << 1) & 0xff; /* Non-secure view */
     }
-    return prio;
+    return prio & gic_fullprio_mask(s, cpu);
 }
 
 static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
@@ -XXX,XX +XXX,XX @@ static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
             return;
         }
     }
-    s->priority_mask[cpu] = pmask;
+    s->priority_mask[cpu] = pmask & gic_fullprio_mask(s, cpu);
 }
 
 static uint32_t gic_get_priority_mask(GICState *s, int cpu, MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->n_prio_bits > GIC_MAX_PRIORITY_BITS ||
+       (s->virt_extn ? s->n_prio_bits < GIC_VIRT_MAX_GROUP_PRIO_BITS :
+        s->n_prio_bits < GIC_MIN_PRIORITY_BITS)) {
+        error_setg(errp, "num-priority-bits cannot be greater than %d"
+                   " or less than %d", GIC_MAX_PRIORITY_BITS,
+                   s->virt_extn ? GIC_VIRT_MAX_GROUP_PRIO_BITS :
+                   GIC_MIN_PRIORITY_BITS);
+        return;
+    }
+
     /* This creates distributor, main CPU interface (s->cpuiomem[0]) and if
      * enabled, virtualization extensions related interfaces (main virtual
      * interface (s->vifaceiomem[0]) and virtual CPU interface).
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
     DEFINE_PROP_BOOL("has-security-extensions", GICState, security_extn, 0),
     /* True if the GIC should implement the virtualization extensions */
     DEFINE_PROP_BOOL("has-virtualization-extensions", GICState, virt_extn, 0),
+    DEFINE_PROP_UINT32("num-priority-bits", GICState, n_prio_bits, 8),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

All A9 CPUs have a GIC with 5 bits of priority.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1582537164-764-3-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/a9mpcore.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/core/cpu.h"
 
+#define A9_GIC_NUM_PRIORITY_BITS    5
+
 static void a9mp_priv_set_irq(void *opaque, int irq, int level)
 {
     A9MPPrivState *s = (A9MPPrivState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_realize(DeviceState *dev, Error **errp)
     gicdev = DEVICE(&s->gic);
     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
+                         A9_GIC_NUM_PRIORITY_BITS);
 
     /* Make the GIC's TZ support match the CPUs. We assume that
      * either all the CPUs have TZ, or none do.
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

The GIC built into the ARM11MPCore is always implemented with 4
priority bits; set the GIC property accordingly.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1582537164-764-4-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/arm11mpcore.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 
+#define ARM11MPCORE_NUM_GIC_PRIORITY_BITS    4
 
 static void mpcore_priv_set_irq(void *opaque, int irq, int level)
 {
@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_realize(DeviceState *dev, Error **errp)
 
     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
+                         ARM11MPCORE_NUM_GIC_PRIORITY_BITS);
+
+
     object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
     if (err != NULL) {
         error_propagate(errp, err);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Use this in the places that were checking ARM_FEATURE_VFP, and
are obviously testing for the existance of the register set
as opposed to testing for some particular instruction extension.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        |  9 +++++++++
 hw/intc/armv7m_nvic.c   | 20 ++++++++++----------
 linux-user/arm/signal.c |  4 ++--
 target/arm/arch_dump.c  | 11 ++++++-----
 target/arm/cpu.c        |  4 ++--
 target/arm/helper.c     |  4 ++--
 target/arm/m_helper.c   | 11 ++++++-----
 7 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
 }
 
+static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
+{
+    /*
+     * Return true if either VFP or SIMD is implemented.
+     * In this case, a minimum of VFP w/ D0-D15.
+     */
+    return FIELD_EX32(id->mvfr0, MVFR0, SIMDREG) > 0;
+}
+
 static inline bool isar_feature_aa32_simd_r32(const ARMISARegisters *id)
 {
     /* Return true if D16-D31 are implemented */
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
     case 0xd84: /* CSSELR */
         return cpu->env.v7m.csselr[attrs.secure];
     case 0xd88: /* CPACR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.cpacr[attrs.secure];
     case 0xd8c: /* NSACR */
-        if (!attrs.secure || !arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.nsacr;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return cpu->env.v7m.sfar;
     case 0xf34: /* FPCCR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         if (attrs.secure) {
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             return value;
         }
     case 0xf38: /* FPCAR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.fpcar[attrs.secure];
     case 0xf3c: /* FPDSCR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.fpdscr[attrs.secure];
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     case 0xd88: /* CPACR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* We implement only the Floating Point extension's CP10/CP11 */
             cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
         }
         break;
     case 0xd8c: /* NSACR */
-        if (attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* We implement only the Floating Point extension's CP10/CP11 */
             cpu->env.v7m.nsacr = value & (3 << 10);
         }
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         break;
     }
     case 0xf34: /* FPCCR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* Not all bits here are banked. */
             uint32_t fpccr_s;
 
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     case 0xf38: /* FPCAR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             value &= ~7;
             cpu->env.v7m.fpcar[attrs.secure] = value;
         }
         break;
     case 0xf3c: /* FPDSCR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             value &= 0x07c00000;
             cpu->env.v7m.fpdscr[attrs.secure] = value;
         }
diff --git a/linux-user/arm/signal.c b/linux-user/arm/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/signal.c
+++ b/linux-user/arm/signal.c
@@ -XXX,XX +XXX,XX @@ static void setup_sigframe_v2(struct target_ucontext_v2 *uc,
     setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);
     /* Save coprocessor signal frame.  */
     regspace = uc->tuc_regspace;
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
         regspace = setup_sigframe_v2_vfp(regspace, env);
     }
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -XXX,XX +XXX,XX @@ static int do_sigframe_return_v2(CPUARMState *env,
 
     /* Restore coprocessor signal frame */
     regspace = uc->tuc_regspace;
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
         regspace = restore_sigframe_v2_vfp(env, regspace);
         if (!regspace) {
             return 1;
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
                              int cpuid, void *opaque)
 {
     struct arm_note note;
-    CPUARMState *env = &ARM_CPU(cs)->env;
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     DumpState *s = opaque;
-    int ret, i, fpvalid = !!arm_feature(env, ARM_FEATURE_VFP);
+    int ret, i;
+    bool fpvalid = cpu_isar_feature(aa32_vfp_simd, cpu);
 
     arm_note_init(&note, s, "CORE", 5, NT_PRSTATUS, sizeof(note.prstatus));
 
@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
 ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
 {
     ARMCPU *cpu = ARM_CPU(first_cpu);
-    CPUARMState *env = &cpu->env;
     size_t note_size;
 
     if (class == ELFCLASS64) {
@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
         note_size += AARCH64_PRFPREG_NOTE_SIZE;
 #ifdef TARGET_AARCH64
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            note_size += AARCH64_SVE_NOTE_SIZE(env);
+            note_size += AARCH64_SVE_NOTE_SIZE(&cpu->env);
         }
 #endif
     } else {
         note_size = ARM_PRSTATUS_NOTE_SIZE;
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             note_size += ARM_VFP_NOTE_SIZE;
         }
     }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
         }
 
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
         int numvfpregs = 0;
         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
             numvfpregs = 32;
-        } else if (arm_feature(env, ARM_FEATURE_VFP)) {
+        } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             numvfpregs = 16;
         }
         for (i = 0; i < numvfpregs; i++) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
          */
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
             /* VFP coprocessor: cp10 & cp11 [23:20] */
             mask |= (1 << 31) | (1 << 30) | (0xf << 20);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
     } else if (cpu_isar_feature(aa32_simd_r32, cpu)) {
         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  35, "arm-vfp3.xml", 0);
-    } else if (arm_feature(env, ARM_FEATURE_VFP)) {
+    } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  19, "arm-vfp.xml", 0);
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
      */
     uint32_t sig = 0xfefa125a;
 
-    if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
+    if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
+        || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
         sig |= 1;
     }
     return sig;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
 
     if (dotailchain) {
         /* Sanitize LR FType and PREFIX bits */
-        if (!arm_feature(env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             lr |= R_V7M_EXCRET_FTYPE_MASK;
         }
         lr = deposit32(lr, 24, 8, 0xff);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
 
-    if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
+    if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
                       "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
                       "if FPU not present\n",
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
              * RES0 if the FPU is not present, and is stored in the S bank
              */
-            if (arm_feature(env, ARM_FEATURE_VFP) &&
+            if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
                 extract32(env->v7m.nsacr, 10, 1)) {
                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
             env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
         }
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
             /*
              * SFPA is RAZ/WI from NS or if no FPU.
              * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The old name, isar_feature_aa32_fpdp, does not reflect
that the test includes VFPv2.  We will introduce another
feature tests for VFPv3.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               |  4 ++--
 target/arm/translate-vfp.inc.c | 40 +++++++++++++++++-----------------
 2 files changed, 22 insertions(+), 22 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

We will shortly use these to test for VFPv2 and VFPv3
in different situations.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

We cannot easily create "any" functions for these, because the
ID_AA64PFR0 fields for FP and SIMD signal "enabled" with zero.
Which means that an aarch32-only cpu will return incorrect results
when testing the aarch64 registers.

To use these, we must either have context or additionally test
vs ARM_FEATURE_AARCH64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 11 +++++++++++
 target/arm/cpu.c     |  9 ++++++---
 target/arm/machine.c |  5 +++--
 3 files changed, 20 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Shuffle the order of the checks so that we test the ISA
before we test anything else, such as the register arguments.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 140 +++++++++++++++++----------------
 1 file changed, 71 insertions(+), 69 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vn | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vn | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
     TCGv_i64 f0, f1, fd;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
     int veclen = s->vec_len;
     TCGv_i64 f0, fd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
 
     vd = a->vd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
 {
     TCGv_i64 vd, vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     /* Vm/M bits must be zero for the Z variant */
     if (a->z && a->vm != 0) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
     TCGv_i32 tmp;
     TCGv_i64 vd;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
     TCGv_i32 tmp;
     TCGv_i64 vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
     TCGv_ptr fpst;
     TCGv_i64 tmp;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
     TCGv_i64 tmp;
     TCGv_i32 tcg_rmode;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
     TCGv_ptr fpst;
     TCGv_i64 tmp;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
     TCGv_i64 vd;
     TCGv_i32 vm;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
     TCGv_i64 vm;
     TCGv_i32 vd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
     TCGv_i64 vd;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
     TCGv_i32 vd;
     TCGv_i64 vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_jscvt, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
     TCGv_ptr fpst;
     int frac_bits;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     TCGv_i64 vm;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Sort this check to the start of a trans_* function.
Merge this with any existing test for fpdp_v2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

We will eventually remove the early ARM_FEATURE_VFP test,
so add a proper test for each trans_* that does not already
have another ISA test.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 78 ++++++++++++++++++++++++++++++----
 1 file changed, 69 insertions(+), 9 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

All remaining tests for VFP4 are for fused multiply-add insns.

Since the MVFR1 field is used for both VFP and NEON, move its adjustment
from the !has_neon block to the (!has_vfp && !has_neon) block.

Test for vfp of the appropraite width alongside the test for simdfmac
within translate-vfp.inc.c.  Within disas_neon_data_insn, we have
already tested for ARM_FEATURE_NEON.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               | 12 ++++++++++++
 target/arm/cpu.c               |  6 +++++-
 target/arm/translate-vfp.inc.c | 22 ++++++++++++++++++----
 target/arm/translate.c         |  2 +-
 4 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
     return FIELD_EX32(id->mvfr1, MVFR1, FPHP) > 1;
 }
 
+/*
+ * Note that this ID register field covers both VFP and Neon FMAC,
+ * so should usually be tested in combination with some other
+ * check that confirms the presence of whichever of VFP or Neon is
+ * relevant, to avoid accidentally enabling a Neon feature on
+ * a VFP-no-Neon core or vice-versa.
+ */
+static inline bool isar_feature_aa32_simdfmac(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->mvfr1, MVFR1, SIMDFMAC) != 0;
+}
+
 static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 1;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
         u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
         u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
-        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
         cpu->isar.mvfr1 = u;
 
         u = cpu->isar.mvfr2;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         u = cpu->isar.mvfr0;
         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
         cpu->isar.mvfr0 = u;
+
+        /* Despite the name, this field covers both VFP and Neon */
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
     }
 
     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
 
     /*
      * Present in VFPv4 only.
+     * Note that we can't rely on the SIMDFMAC check alone, because
+     * in a Neon-no-VFP core that ID register field will be non-zero.
+     */
+    if (!dc_isar_feature(aa32_simdfmac, s) ||
+        !dc_isar_feature(aa32_fpsp_v2, s)) {
+        return false;
+    }
+    /*
      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
      */
-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
-        (s->vec_len != 0 || s->vec_stride != 0)) {
+    if (s->vec_len != 0 || s->vec_stride != 0) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 
     /*
      * Present in VFPv4 only.
+     * Note that we can't rely on the SIMDFMAC check alone, because
+     * in a Neon-no-VFP core that ID register field will be non-zero.
+     */
+    if (!dc_isar_feature(aa32_simdfmac, s) ||
+        !dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+    /*
      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
      */
-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
-        (s->vec_len != 0 || s->vec_stride != 0)) {
+    if (s->vec_len != 0 || s->vec_stride != 0) {
         return false;
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             break;
         case NEON_3R_VFM_VQRDMLSH:
-            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
+            if (!dc_isar_feature(aa32_simdfmac, s)) {
                 return 1;
             }
             break;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Now that we no longer have an early check for ARM_FEATURE_VFP,
we can use the proper ISA check in trans_VLLDM_VLSTM.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 39 +++++++++++++++++++++++++
 target/arm/translate.c         | 53 ++++++----------------------------
 target/arm/vfp.decode          |  2 ++
 3 files changed, 50 insertions(+), 44 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     tcg_temp_free_ptr(fpst);
     return true;
 }
+
+/*
+ * Decode VLLDM and VLSTM are nonstandard because:
+ *  * if there is no FPU then these insns must NOP in
+ *    Secure state and UNDEF in Nonsecure state
+ *  * if there is an FPU then these insns do not have
+ *    the usual behaviour that vfp_access_check() provides of
+ *    being controlled by CPACR/NSACR enable bits or the
+ *    lazy-stacking logic.
+ */
+static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+{
+    TCGv_i32 fptr;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+        return false;
+    }
+    /* If not secure, UNDEF. */
+    if (!s->v8m_secure) {
+        return false;
+    }
+    /* If no fpu, NOP. */
+    if (!dc_isar_feature(aa32_vfp, s)) {
+        return true;
+    }
+
+    fptr = load_reg(s, a->rn);
+    if (a->l) {
+        gen_helper_v7m_vlldm(cpu_env, fptr);
+    } else {
+        gen_helper_v7m_vlstm(cpu_env, fptr);
+    }
+    tcg_temp_free_i32(fptr);
+
+    /* End the TB, because we have updated FP control bits */
+    s->base.is_jmp = DISAS_UPDATE;
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op; /* op0 = 0b11 : unallocated */
             }
 
-            /*
-             * Decode VLLDM and VLSTM first: these are nonstandard because:
-             *  * if there is no FPU then these insns must NOP in
-             *    Secure state and UNDEF in Nonsecure state
-             *  * if there is an FPU then these insns do not have
-             *    the usual behaviour that disas_vfp_insn() provides of
-             *    being controlled by CPACR/NSACR enable bits or the
-             *    lazy-stacking logic.
-             */
-            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
-                (insn & 0xffa00f00) == 0xec200a00) {
-                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
-                 *  - VLLDM, VLSTM
-                 * We choose to UNDEF if the RAZ bits are non-zero.
-                 */
-                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+            if (disas_vfp_insn(s, insn)) {
+                if (((insn >> 8) & 0xe) == 10 &&
+                    dc_isar_feature(aa32_fpsp_v2, s)) {
+                    /* FP, and the CPU supports it */
                     goto illegal_op;
+                } else {
+                    /* All other insns: NOCP */
+                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                                       syn_uncategorized(),
+                                       default_exception_el(s));
                 }
-
-                if (arm_dc_feature(s, ARM_FEATURE_VFP)) {
-                    uint32_t rn = (insn >> 16) & 0xf;
-                    TCGv_i32 fptr = load_reg(s, rn);
-
-                    if (extract32(insn, 20, 1)) {
-                        gen_helper_v7m_vlldm(cpu_env, fptr);
-                    } else {
-                        gen_helper_v7m_vlstm(cpu_env, fptr);
-                    }
-                    tcg_temp_free_i32(fptr);
-
-                    /* End the TB, because we have updated FP control bits */
-                    s->base.is_jmp = DISAS_UPDATE;
-                }
-                break;
             }
-            if (arm_dc_feature(s, ARM_FEATURE_VFP) &&
-                ((insn >> 8) & 0xe) == 10) {
-                /* FP, and the CPU supports it */
-                if (disas_vfp_insn(s, insn)) {
-                    goto illegal_op;
-                }
-                break;
-            }
-
-            /* All other insns: NOCP */
-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
-                               default_exception_el(s));
             break;
         }
         if ((insn & 0xfe000a00) == 0xfc000800
diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp.decode
+++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@ VCVT_sp_int  ---- 1110 1.11 110 s:1 .... 1010 rz:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
 VCVT_dp_int  ---- 1110 1.11 110 s:1 .... 1011 rz:1 1.0 .... \
              vd=%vd_sp vm=%vm_dp
+
+VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Have the calls adjacent as an intermediate step toward
actually merging the decodes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 83 +++++++++++++++---------------------------
 1 file changed, 29 insertions(+), 54 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
     tcg_temp_free_i32(tmp);
 }
 
-/*
- * Disassemble a VFP instruction.  Returns nonzero if an error occurred
- * (ie. an undefined instruction).
- */
-static int disas_vfp_insn(DisasContext *s, uint32_t insn)
-{
-    /*
-     * If the decodetree decoder handles this insn it will always
-     * emit code to either execute the insn or generate an appropriate
-     * exception; so we don't need to ever return non-zero to tell
-     * the calling code to emit an UNDEF exception.
-     */
-    if (extract32(insn, 28, 4) == 0xf) {
-        if (disas_vfp_uncond(s, insn)) {
-            return 0;
-        }
-    } else {
-        if (disas_vfp(s, insn)) {
-            return 0;
-        }
-    }
-    /* If the decodetree decoder didn't handle this insn, it must be UNDEF */
-    return 1;
-}
-
 static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
 {
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         ARCH(5);
 
         /* Unconditional instructions.  */
-        if (disas_a32_uncond(s, insn)) {
+        /* TODO: Perhaps merge these into one decodetree output file.  */
+        if (disas_a32_uncond(s, insn) ||
+            disas_vfp_uncond(s, insn)) {
             return;
         }
         /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             }
             return;
         }
-        if ((insn & 0x0f000e10) == 0x0e000a00) {
-            /* VFP.  */
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
-            return;
-        }
         if ((insn & 0x0e000f00) == 0x0c000100) {
             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
                 /* iWMMXt register transfer.  */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         arm_skip_unless(s, cond);
     }
 
-    if (disas_a32(s, insn)) {
+    /* TODO: Perhaps merge these into one decodetree output file.  */
+    if (disas_a32(s, insn) ||
+        disas_vfp(s, insn)) {
         return;
     }
     /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     case 0xd:
     case 0xe:
         if (((insn >> 8) & 0xe) == 10) {
-            /* VFP.  */
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
-        } else if (disas_coproc_insn(s, insn)) {
+            /* VFP, but failed disas_vfp.  */
+            goto illegal_op;
+        }
+        if (disas_coproc_insn(s, insn)) {
             /* Coprocessor.  */
             goto illegal_op;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         ARCH(6T2);
     }
 
-    if (disas_t32(s, insn)) {
+    /*
+     * TODO: Perhaps merge these into one decodetree output file.
+     * Note disas_vfp is written for a32 with cond field in the
+     * top nibble.  The t32 encoding requires 0xe in the top nibble.
+     */
+    if (disas_t32(s, insn) ||
+        disas_vfp_uncond(s, insn) ||
+        ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
         return;
     }
     /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op; /* op0 = 0b11 : unallocated */
             }
 
-            if (disas_vfp_insn(s, insn)) {
-                if (((insn >> 8) & 0xe) == 10 &&
-                    dc_isar_feature(aa32_fpsp_v2, s)) {
-                    /* FP, and the CPU supports it */
-                    goto illegal_op;
-                } else {
-                    /* All other insns: NOCP */
-                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                                       syn_uncategorized(),
-                                       default_exception_el(s));
-                }
+            if (((insn >> 8) & 0xe) == 10 &&
+                dc_isar_feature(aa32_fpsp_v2, s)) {
+                /* FP, and the CPU supports it */
+                goto illegal_op;
+            } else {
+                /* All other insns: NOCP */
+                gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                                   syn_uncategorized(),
+                                   default_exception_el(s));
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op;
             }
         } else if (((insn >> 8) & 0xe) == 10) {
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
+            /* VFP, but failed disas_vfp.  */
+            goto illegal_op;
         } else {
             if (insn & (1 << 28))
                 goto illegal_op;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Use isar feature tests instead of feature bit tests.

Although none of QEMUs current cpus have VFPv3 without D32,
replace the large comment explaining why with one line that
sets ARM_HWCAP_ARM_VFPv3D16 under the correct conditions.
Mirror the test sequence used in the linux kernel.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/elfload.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 
     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
-    GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
-    GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);
+    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
-    /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.
-     * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of
-     * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated
-     * to our VFP_FP16 feature bit.
-     */
-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPD32);
-    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
+    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
+
+    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
+        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
+        hwcaps |= ARM_HWCAP_ARM_VFPv3;
+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
+            hwcaps |= ARM_HWCAP_ARM_VFPD32;
+        } else {
+            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
+        }
+    }
+    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
 
     return hwcaps;
 }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We have converted all tests against these features
to ISAR tests.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   |  3 ---
 target/arm/cpu.c   | 25 -------------------------
 target/arm/cpu64.c |  3 ---
 target/arm/kvm32.c |  5 -----
 target/arm/kvm64.c |  1 -
 5 files changed, 37 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
  * mapping in linux-user/elfload.c:get_elf_hwcap().
  */
 enum arm_features {
-    ARM_FEATURE_VFP,
     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V7,
     ARM_FEATURE_THUMB2,
     ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
-    ARM_FEATURE_VFP3,
     ARM_FEATURE_NEON,
     ARM_FEATURE_M, /* Microcontroller profile.  */
     ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V5,
     ARM_FEATURE_STRONGARM,
     ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
-    ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
     ARM_FEATURE_GENERIC_TIMER,
     ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
     ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
-    /* Similarly for the VFP feature bits */
-    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
-        set_feature(&cpu->env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
-        set_feature(&cpu->env, ARM_FEATURE_VFP);
-    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         uint64_t t;
         uint32_t u;
 
-        unset_feature(env, ARM_FEATURE_VFP);
-        unset_feature(env, ARM_FEATURE_VFP3);
-        unset_feature(env, ARM_FEATURE_VFP4);
-
         t = cpu->isar.id_aa64isar1;
         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
         cpu->isar.id_aa64isar1 = t;
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm926";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
     cpu->midr = 0x41069265;
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1026";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_AUXCR);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1136";
     set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
     cpu->dtb_compatible = "arm,arm1136";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
     set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1176";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_VAPA);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm11mpcore";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_VAPA);
     set_feature(&cpu->env, ARM_FEATURE_MPIDR);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x410fc240; /* r0p0 */
     cpu->pmsav7_dregion = 8;
     cpu->isar.mvfr0 = 0x10110021;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x411fc272; /* r1p2 */
     cpu->pmsav7_dregion = 8;
     cpu->isar.mvfr0 = 0x10110221;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x410fd213; /* r0p3 */
     cpu->pmsav7_dregion = 16;
     cpu->sau_sregion = 8;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5f_initfn(Object *obj)
     ARMCPU *cpu = ARM_CPU(obj);
 
     cortex_r5_initfn(obj);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x00000011;
 }
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a8";
     set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a9";
     set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_EL3);
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a7";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a15";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a57";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a53";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a72";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * bits, but a few must be tested.
      */
     set_feature(&features, ARM_FEATURE_V7VE);
-    set_feature(&features, ARM_FEATURE_VFP3);
     set_feature(&features, ARM_FEATURE_GENERIC_TIMER);
 
     if (extract32(id_pfr0, 12, 4) == 1) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
-    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
-        /* FMAC support implies VFPv4 */
-        set_feature(&features, ARM_FEATURE_VFP4);
-    }
 
     ahcf->features = features;
 
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * feature bits.
      */
     set_feature(&features, ARM_FEATURE_V8);
-    set_feature(&features, ARM_FEATURE_VFP4);
     set_feature(&features, ARM_FEATURE_NEON);
     set_feature(&features, ARM_FEATURE_AARCH64);
     set_feature(&features, ARM_FEATURE_PMU);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Those vfp instructions without extra opcode fields can
share a common @format for brevity.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/vfp.decode | 134 ++++++++++++++++--------------------------
 1 file changed, 52 insertions(+), 82 deletions(-)

diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp.decode
+++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@
 
 %vmov_imm 16:4 0:4
 
+@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
+@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+@vfp_dm_ss   ................................ vm=%vm_sp vd=%vd_sp
+@vfp_dm_dd   ................................ vm=%vm_dp vd=%vd_dp
+@vfp_dm_ds   ................................ vm=%vm_sp vd=%vd_dp
+@vfp_dm_sd   ................................ vm=%vm_dp vd=%vd_sp
+
 # VMOV scalar to general-purpose register; note that this does
 # include some Neon cases.
 VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
@@ -XXX,XX +XXX,XX @@ VDUP         ---- 1110 1 b:1 q:1 0 .... rt:4 1011 . 0 e:1 1 0000 \
              vn=%vn_dp
 
 VMSR_VMRS    ---- 1110 111 l:1 reg:4 rt:4 1010 0001 0000
-VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000 \
-             vn=%vn_sp
+VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000    vn=%vn_sp
 
-VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 .... \
-             vm=%vm_sp
-VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 .... \
-             vm=%vm_dp
+VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 ....   vm=%vm_sp
+VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 ....   vm=%vm_dp
 
 # Note that the half-precision variants of VLDR and VSTR are
 # not part of this decodetree at all because they have bits [9:8] == 0b01
-VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8 \
-             vd=%vd_sp
-VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8 \
-             vd=%vd_dp
+VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
+VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
 
 # We split the load/store multiple up into two patterns to avoid
 # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
@@ -XXX,XX +XXX,XX @@ VLDM_VSTM_dp ---- 1101 0.1 l:1 rn:4 .... 1011 imm:8 \
              vd=%vd_dp p=1 u=0 w=1
 
 # 3-register VFP data-processing; bits [23,21:20,6] identify the operation.
-VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
 VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
              vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
@@ -XXX,XX +XXX,XX @@ VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
 VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
              vd=%vd_dp imm=%vmov_imm
 
-VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 ....        @vfp_dm_ss
+VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 ....        @vfp_dm_dd
 
-VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 ....        @vfp_dm_ss
+VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 ....        @vfp_dm_dd
 
-VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 ....        @vfp_dm_ss
+VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 ....        @vfp_dm_dd
 
-VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 ....        @vfp_dm_ss
+VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 ....        @vfp_dm_dd
 
 VCMP_sp      ---- 1110 1.11 010 z:1 .... 1010 e:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
@@ -XXX,XX +XXX,XX @@ VCVT_f32_f16 ---- 1110 1.11 0010 .... 1010 t:1 1.0 .... \
 VCVT_f64_f16 ---- 1110 1.11 0010 .... 1011 t:1 1.0 .... \
              vd=%vd_dp vm=%vm_sp
 
-# VCVTB and VCVTT to f16: Vd format is always vd_sp; Vm format depends on size bit
+# VCVTB and VCVTT to f16: Vd format is always vd_sp;
+# Vm format depends on size bit
 VCVT_f16_f32 ---- 1110 1.11 0011 .... 1010 t:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
 VCVT_f16_f64 ---- 1110 1.11 0011 .... 1011 t:1 1.0 .... \
              vd=%vd_sp vm=%vm_dp
 
-VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 ....        @vfp_dm_ss
+VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 ....        @vfp_dm_dd
 
-VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 ....        @vfp_dm_ss
+VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 ....        @vfp_dm_dd
 
-VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 ....        @vfp_dm_ss
+VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 ....        @vfp_dm_dd
 
-# VCVT between single and double: Vm precision depends on size; Vd is its reverse
-VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 .... \
-             vd=%vd_dp vm=%vm_sp
-VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 .... \
-             vd=%vd_sp vm=%vm_dp
+# VCVT between single and double:
+# Vm precision depends on size; Vd is its reverse
+VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 ....        @vfp_dm_ds
+VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 ....        @vfp_dm_sd
 
 # VCVT from integer to floating point: Vm always single; Vd depends on size
 VCVT_int_sp  ---- 1110 1.11 1000 .... 1010 s:1 1.0 .... \
@@ -XXX,XX +XXX,XX @@ VCVT_int_dp  ---- 1110 1.11 1000 .... 1011 s:1 1.0 .... \
              vd=%vd_dp vm=%vm_sp
 
 # VJCVT is always dp to sp
-VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 .... \
-             vd=%vd_sp vm=%vm_dp
+VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 ....        @vfp_dm_sd
 
 # VCVT between floating-point and fixed-point. The immediate value
 # is in the same format as a Vm single-precision register number.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Passing the raw o1 and o2 fields from the manual is less
instructive than it might be.  Do the full decode and let
the trans_* functions pass in booleans to a helper.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 52 ++++++++++++++++++++++++++++++----
 target/arm/vfp.decode          | 17 +++++------
 2 files changed, 55 insertions(+), 14 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Passing the raw op field from the manual is less instructive
than it might be.  Do the full decode and use the existing
helpers to perform the expansion.

Since these are v8 insns, VECLEN+VECSTRIDE are already RES0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 109 +++++++++++----------------------
 target/arm/vfp-uncond.decode   |  12 ++--
 2 files changed, 44 insertions(+), 77 deletions(-)

From: Guenter Roeck <linux@roeck-us.net>

USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
Linux expects and checks various chipidea registers, which do not exist
with the basic ehci emulation. This patch series fixes the problem.

Without this patch, USB ports fail to instantiate under Linux.

ci_hdrc ci_hdrc.0: doesn't support host
ci_hdrc ci_hdrc.0: no supported roles

With this patch, USB ports are instantiated, and it is possible
to boot from USB drive.

ci_hdrc ci_hdrc.0: EHCI Host Controller
ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
usb 1-1: new full-speed USB device number 2 using ci_hdrc
usb 1-1: not running at top speed; connect to a high speed hub
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi host0: usb-storage 1-1:1.0

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200215122354.13706-2-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xilinx_zynq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/loader.h"
 #include "hw/misc/zynq-xadc.h"
 #include "hw/ssi/ssi.h"
+#include "hw/usb/chipidea.h"
 #include "qemu/error-report.h"
 #include "hw/sd/sdhci.h"
 #include "hw/char/cadence_uart.h"
@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)
     zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
     zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
 
-    sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
-    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
 
     cadence_uart_create(0xE0000000, pic[59 - IRQ_OFFSET], serial_hd(0));
     cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Xilinx USB devices are now instantiated through TYPE_CHIPIDEA,
and xlnx support in the EHCI code is no longer needed.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200215122354.13706-3-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/hcd-ehci-sysbus.c | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_platform_type_info = {
     .class_init    = ehci_platform_class_init,
 };
 
-static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
-{
-    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    set_bit(DEVICE_CATEGORY_USB, dc->categories);
-    sec->capsbase = 0x100;
-    sec->opregbase = 0x140;
-}
-
-static const TypeInfo ehci_xlnx_type_info = {
-    .name          = "xlnx,ps7-usb",
-    .parent        = TYPE_SYS_BUS_EHCI,
-    .class_init    = ehci_xlnx_class_init,
-};
-
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
 {
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_platform_type_info);
-    type_register_static(&ehci_xlnx_type_info);
     type_register_static(&ehci_exynos4210_type_info);
     type_register_static(&ehci_tegra2_type_info);
     type_register_static(&ehci_ppc4xx_type_info);
-- 
2.20.1

From: Thomas Huth <thuth@redhat.com>

Old kernels from the Meego project can be used to check that Linux
is at least starting on these machines.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-2-philmd@redhat.com
Message-Id: <20200129131920.22302-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                          |  1 +
 tests/acceptance/machine_arm_n8x0.py | 49 ++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/acceptance/machine_arm_n8x0.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/rtc/twl92230.c
 F: include/hw/display/blizzard.h
 F: include/hw/input/tsc2xxx.h
 F: include/hw/misc/cbus.h
+F: tests/acceptance/machine_arm_n8x0.py
 
 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
diff --git a/tests/acceptance/machine_arm_n8x0.py b/tests/acceptance/machine_arm_n8x0.py
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/acceptance/machine_arm_n8x0.py
@@ -XXX,XX +XXX,XX @@
+# Functional test that boots a Linux kernel and checks the console
+#
+# Copyright (c) 2020 Red Hat, Inc.
+#
+# Author:
+#  Thomas Huth <thuth@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+import os
+
+from avocado import skipUnless
+from avocado_qemu import Test
+from avocado_qemu import wait_for_console_pattern
+
+class N8x0Machine(Test):
+    """Boots the Linux kernel and checks that the console is operational"""
+
+    timeout = 90
+
+    def __do_test_n8x0(self):
+        kernel_url = ('http://stskeeps.subnetmask.net/meego-n8x0/'
+                      'meego-arm-n8x0-1.0.80.20100712.1431-'
+                      'vmlinuz-2.6.35~rc4-129.1-n8x0')
+        kernel_hash = 'e9d5ab8d7548923a0061b6fbf601465e479ed269'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        self.vm.set_console(console_index=1)
+        self.vm.add_args('-kernel', kernel_path,
+                         '-append', 'printk.time=0 console=ttyS1')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'TSC2005 driver initializing')
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_n800(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:n800
+        """
+        self.__do_test_n8x0()
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_n810(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:n810
+        """
+        self.__do_test_n8x0()
-- 
2.20.1

From: Thomas Huth <thuth@redhat.com>

There is a kernel and initrd available on github which we can use
for testing this machine.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-3-philmd@redhat.com
Message-Id: <20200131170233.14584-1-thuth@redhat.com>
[PMD: Renamed test method, moved description from class to method]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                                  |  1 +
 tests/acceptance/machine_arm_integratorcp.py | 43 ++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 tests/acceptance/machine_arm_integratorcp.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 F: include/hw/misc/arm_integrator_debug.h
+F: tests/acceptance/machine_arm_integratorcp.py
 
 MCIMX6UL EVK / i.MX6ul
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/acceptance/machine_arm_integratorcp.py
@@ -XXX,XX +XXX,XX @@
+# Functional test that boots a Linux kernel and checks the console
+#
+# Copyright (c) 2020 Red Hat, Inc.
+#
+# Author:
+#  Thomas Huth <thuth@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+import os
+
+from avocado import skipUnless
+from avocado_qemu import Test
+from avocado_qemu import wait_for_console_pattern
+
+class IntegratorMachine(Test):
+
+    timeout = 90
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_integratorcp_console(self):
+        """
+        Boots the Linux kernel and checks that the console is operational
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:integratorcp
+        """
+        kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
+                      'arm-test/kernel/zImage.integrator')
+        kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        initrd_url = ('https://github.com/zayac/qemu-arm/raw/master/'
+                      'arm-test/kernel/arm_root.img')
+        initrd_hash = 'b51e4154285bf784e017a37586428332d8c7bd8b'
+        initrd_path = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+
+        self.vm.set_console()
+        self.vm.add_args('-kernel', kernel_path,
+                         '-initrd', initrd_path,
+                         '-append', 'printk.time=0 console=ttyAMA0')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Log in as root')
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As we want to re-use this code, extract it as a new function.
Since we are using the PL011 serial console, add a Avocado tag
to ease filtering of tests.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-4-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/machine_arm_integratorcp.py | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add a test that verifies the Tux logo is displayed on the framebuffer.

We simply follow the OpenCV "Template Matching with Multiple Objects"
tutorial, replacing Lionel Messi by Tux:
https://docs.opencv.org/4.2.0/d4/dc6/tutorial_py_template_matching.html

When OpenCV and NumPy are installed, this test can be run using:

$ AVOCADO_ALLOW_UNTRUSTED_CODE=hmmm \
    avocado --show=app,framebuffer run -t device:framebuffer \
      tests/acceptance/machine_arm_integratorcp.py
  JOB ID     : 8c46b0f8269242e87d738247883ea2a470df949e
  JOB LOG    : avocado/job-results/job-2020-01-31T21.38-8c46b0f/job.log
   (1/1) tests/acceptance/machine_arm_integratorcp.py:IntegratorMachine.test_framebuffer_tux_logo:
  framebuffer: found Tux at position [x, y] = (0, 0)
  PASS (3.96 s)
  RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
  JOB TIME   : 4.23 s

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-id: 20200225172501.29609-5-philmd@redhat.com
Message-Id: <20200131211102.29612-3-f4bug@amsat.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/machine_arm_integratorcp.py | 52 ++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/machine_arm_integratorcp.py
+++ b/tests/acceptance/machine_arm_integratorcp.py
@@ -XXX,XX +XXX,XX @@
 # later.  See the COPYING file in the top-level directory.
 
 import os
+import logging
 
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import wait_for_console_pattern
 
+
+NUMPY_AVAILABLE = True
+try:
+    import numpy as np
+except ImportError:
+    NUMPY_AVAILABLE = False
+
+CV2_AVAILABLE = True
+try:
+    import cv2
+except ImportError:
+    CV2_AVAILABLE = False
+
+
 class IntegratorMachine(Test):
 
     timeout = 90
@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
         """
         self.boot_integratorcp()
         wait_for_console_pattern(self, 'Log in as root')
+
+    @skipUnless(NUMPY_AVAILABLE, 'Python NumPy not installed')
+    @skipUnless(CV2_AVAILABLE, 'Python OpenCV not installed')
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_framebuffer_tux_logo(self):
+        """
+        Boot Linux and verify the Tux logo is displayed on the framebuffer.
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:integratorcp
+        :avocado: tags=device:pl110
+        :avocado: tags=device:framebuffer
+        """
+        screendump_path = os.path.join(self.workdir, "screendump.pbm")
+        tuxlogo_url = ('https://github.com/torvalds/linux/raw/v2.6.12/'
+                       'drivers/video/logo/logo_linux_vga16.ppm')
+        tuxlogo_hash = '3991c2ddbd1ddaecda7601f8aafbcf5b02dc86af'
+        tuxlogo_path = self.fetch_asset(tuxlogo_url, asset_hash=tuxlogo_hash)
+
+        self.boot_integratorcp()
+        framebuffer_ready = 'Console: switching to colour frame buffer device'
+        wait_for_console_pattern(self, framebuffer_ready)
+        self.vm.command('human-monitor-command', command_line='stop')
+        self.vm.command('human-monitor-command',
+                        command_line='screendump %s' % screendump_path)
+        logger = logging.getLogger('framebuffer')
+
+        cpu_count = 1
+        match_threshold = 0.92
+        screendump_bgr = cv2.imread(screendump_path)
+        screendump_gray = cv2.cvtColor(screendump_bgr, cv2.COLOR_BGR2GRAY)
+        result = cv2.matchTemplate(screendump_gray, cv2.imread(tuxlogo_path, 0),
+                                   cv2.TM_CCOEFF_NORMED)
+        loc = np.where(result >= match_threshold)
+        tux_count = 0
+        for tux_count, pt in enumerate(zip(*loc[::-1]), start=1):
+            logger.debug('found Tux at position [x, y] = %s', pt)
+        self.assertGreaterEqual(tux_count, cpu_count)
-- 
2.20.1

We missed an instance of using FIELD_EX32 on a 64-bit ID
register, in isar_feature_aa64_pmu_8_4(). Fix it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-2-peter.maydell@linaro.org
---
 target/arm/cpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_1(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
-        FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
+    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
+        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
 }
 
 /*
-- 
2.20.1

The v8.3-RCPC extension implements three new load instructions
which provide slightly weaker consistency guarantees than the
existing load-acquire operations. For QEMU we choose to simply
implement them with a full LDAQ barrier.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-3-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  5 +++++
 linux-user/elfload.c       |  1 +
 target/arm/cpu64.c         |  1 +
 target/arm/translate-a64.c | 24 ++++++++++++++++++++++++
 4 files changed, 31 insertions(+)

The v8.4-RCPC extension implements some new instructions:
 * LDAPUR, LDAPURB, LDAPURH, LDAPRSB, LDAPRSH, LDAPRSW
 * STLUR, STLURB, STLURH

These are all in a new subgroup of encodings that sits below the
top-level "Loads and Stores" group in the Arm ARM.

The STLUR* instructions have standard store-release semantics; the
LDAPUR* have Load-AcquirePC semantics, but (as with LDAPR*) we choose
to implement them as the slightly stronger Load-Acquire.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-4-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  5 +++
 linux-user/elfload.c       |  1 +
 target/arm/cpu64.c         |  2 +-
 target/arm/translate-a64.c | 90 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 1 deletion(-)

The ARMv8.3-CCIDX extension makes the CCSIDR_EL1 system ID registers
have a format that uses the full 64 bit width of the register, and
adds a new CCSIDR2 register so AArch32 can get at the high 32 bits.

QEMU doesn't implement caches, so we just treat these ID registers as
opaque values that are set to the correct constant values for each
CPU.  The only thing we need to do is allow 64-bit values in our
cssidr[] array and provide the CCSIDR2 accessors.

We don't set the CCIDX field in our 'max' CPU because the CCSIDR
constant values we use are the same as the ones used by the
Cortex-A57 and they are in the old 32-bit format. This means
that the extra regdef added here is unused currently, but it
means that whenever in the future we add a CPU that does need
the new 64-bit format it will just work when we set the cssidr
values and the ID registers for it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224182626.29252-1-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 17 ++++++++++++++++-
 target/arm/helper.c | 19 +++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* The elements of this array are the CCSIDR values for each cache,
      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
      */
-    uint32_t ccsidr[16];
+    uint64_t ccsidr[16];
     uint64_t reset_cbar;
     uint32_t reset_auxcr;
     bool reset_hivecs;
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ac2(const ARMISARegisters *id)
     return FIELD_EX32(id->id_mmfr4, ID_MMFR4, AC2) != 0;
 }
 
+static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
 }
 
+static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_pmu_8_4(const ARMISARegisters *id)
     return isar_feature_aa64_pmu_8_4(id) || isar_feature_aa32_pmu_8_4(id);
 }
 
+static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* Read the high 32 bits of the current CCSIDR */
+    return extract64(ccsidr_read(env, ri), 32, 32);
+}
+
+static const ARMCPRegInfo ccsidr2_reginfo[] = {
+    { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2,
+      .access = PL1_R,
+      .accessfn = access_aa64_tid2,
+      .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
+    REGINFO_SENTINEL
+};
+
 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
                                        bool isread)
 {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, predinv_reginfo);
     }
 
+    if (cpu_isar_feature(any_ccidx, cpu)) {
+        define_arm_cp_regs(cpu, ccsidr2_reginfo);
+    }
+
 #ifndef CONFIG_USER_ONLY
     /*
      * Register redirections and aliases must be done last,
-- 
2.20.1

In our KVM GICv2 realize function, we try to cope with old kernels
that don't provide the device control API (KVM_CAP_DEVICE_CTRL): we
try to use the device control, and if that fails we fall back to
assuming that the kernel has the old style KVM_CREATE_IRQCHIP and
that it will provide a GICv2.

This doesn't cater for the possibility of a kernel and hardware which
only provide a GICv3, which is very common now.  On that setup we
will abort() later on in kvm_arm_pmu_set_irq() when we try to wire up
an interrupt to the GIC we failed to create:

qemu-system-aarch64: PMU: KVM_SET_DEVICE_ATTR: Invalid argument
qemu-system-aarch64: failed to set irq for PMU
Aborted

If the kernel advertises KVM_CAP_DEVICE_CTRL we should trust it if it
says it can't create a GICv2, rather than assuming it has one.  We
can then produce a more helpful error message including a hint about
the most probable reason for the failure.

If the kernel doesn't advertise KVM_CAP_DEVICE_CTRL then it is truly
ancient by this point but we might as well still fall back to a
KVM_CREATE_IRQCHIP GICv2.

With this patch then the user misconfiguration which previously
caused an abort now prints:
qemu-system-aarch64: Initialization of device kvm-arm-gic failed: error creating in-kernel VGIC: No such device
Perhaps the host CPU does not support GICv2?

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200225182435.1131-1-peter.maydell@linaro.org
---
 hw/intc/arm_gic_kvm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
                               KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
                               &error_abort);
         }
+    } else if (kvm_check_extension(kvm_state, KVM_CAP_DEVICE_CTRL)) {
+        error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
+        error_append_hint(errp,
+                          "Perhaps the host CPU does not support GICv2?\n");
     } else if (ret != -ENODEV && ret != -ENOTSUP) {
+        /*
+         * Very ancient kernel without KVM_CAP_DEVICE_CTRL: assume that
+         * ENODEV or ENOTSUP mean "can't create GICv2 with KVM_CREATE_DEVICE",
+         * and that we will get a GICv2 via KVM_CREATE_IRQCHIP.
+         */
         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
         return;
     }
-- 
2.20.1