Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[Qemu-devel] [PULL 00/21] target-arm queue
-The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
+The following changes since commit e5cd695266c5709308aa95b1baae499e4b5d4544:
-  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
+  Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-05-08 17:05:58 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
+  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180510
-for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
+for you to fetch changes up to 9a9f1f59521f46e8ff4527d9a2b52f83577e2aa3:
-  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
+  target/arm: Clear SVE high bits for FMOV (2018-05-10 18:10:58 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix coverity nit in int_to_float code
+ * hw/arm/iotkit.c: fix minor memory leak
- * Don't set Invalid for float-to-int(MAXINT)
+ * softfloat: fix wrong-exception-flags bug for multiply-add corner case
- * Fix fp_status_f16 tininess before rounding
+ * arm: isolate and clean up DTB generation
- * Add various missing insns from the v8.2-FP16 extension
+ * implement Arm v8.1-Atomics extension
- * Fix sqrt_f16 exception raising
+ * Fix some bugs and missing instructions in the v8.2-FP16 extension
  * sdcard: Correct CRC16 offset in sd_function_switch()
  * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Alex Bennée (5):
+Igor Mammedov (4):
-      fpu/softfloat: int_to_float ensure r fully initialised
+      pc: simplify MachineClass::get_hotplug_handler handling
-      target/arm: Implement FCMP for fp16
+      platform-bus-device: use device plug callback instead of machine_done notifier
-      target/arm: Implement FCSEL for fp16
+      arm/boot: split load_dtb() from arm_load_kernel()
-      target/arm: Implement FMOV (immediate) for fp16
+      make sure that we aren't overwriting mc->get_hotplug_handler by accident
       target/arm: Fix sqrt_f16 exception raising
 Peter Maydell (3):
-      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+      hw/arm/iotkit.c: fix minor memory leak
-      target/arm: Fix fp_status_f16 tininess before rounding
+      softfloat: Handle default NaN mode after pickNaNMulAdd, not before
-      tcg: Optionally log FPU state in TCG -d cpu logging
+      atomic.h: Work around gcc spurious "unused value" warning
-Philippe Mathieu-Daudé (1):
+Richard Henderson (14):
-      sdcard: Correct CRC16 offset in sd_function_switch()
+      tcg: Introduce helpers for integer min/max
       target/arm: Use new min/max expanders
       target/xtensa: Use new min/max expanders
       tcg: Introduce atomic helpers for integer min/max
       tcg: Use GEN_ATOMIC_HELPER_FN for opposite endian atomic add
       target/riscv: Use new atomic min/max expanders
       target/arm: Introduce ARM_FEATURE_V8_ATOMICS and initial decode
       target/arm: Fill in disas_ldst_atomic
       target/arm: Implement CAS and CASP
       target/arm: Enable ARM_FEATURE_V8_ATOMICS for user-only
       target/arm: Implement vector shifted SCVF/UCVF for fp16
       target/arm: Implement vector shifted FCVT for fp16
       target/arm: Fix float16 to/from int16
       target/arm: Clear SVE high bits for FMOV
-Richard Henderson (7):
+ accel/tcg/atomic_template.h | 112 ++++++----
-      target/arm: Implement FMOV (general) for fp16
+ accel/tcg/tcg-runtime.h     |   8 +
-      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+ hw/ppc/e500.h               |   5 +
-      target/arm: Implement FCVT (scalar, integer) for fp16
+ include/hw/arm/arm.h        |  45 +++-
-      target/arm: Implement FCVT (scalar, fixed-point) for fp16
+ include/hw/arm/sysbus-fdt.h |  37 +---
-      target/arm: Introduce and use read_fp_hreg
+ include/hw/arm/virt.h       |   1 +
-      target/arm: Implement FP data-processing (2 source) for fp16
+ include/hw/i386/pc.h        |   8 -
-      target/arm: Implement FP data-processing (3 source) for fp16
+ include/hw/platform-bus.h   |   4 +-
  include/qemu/atomic.h       |   2 +-
  target/arm/cpu.h            |   1 +
  target/arm/helper-a64.h     |   2 +
  target/arm/helper.h         |   4 +-
  tcg/tcg-op.h                |  50 +++++
  tcg/tcg.h                   |   8 +
  fpu/softfloat.c             |  52 +++--
  hw/arm/boot.c               |  72 ++-----
  hw/arm/iotkit.c             |   1 +
  hw/arm/sysbus-fdt.c         |  64 +-----
  hw/arm/virt.c               |  96 ++++++---
  hw/core/platform-bus.c      |  29 +--
  hw/i386/pc.c                |   7 +-
  hw/ppc/e500.c               |  38 ++--
  hw/ppc/e500plat.c           |  32 +++
  hw/ppc/spapr.c              |   1 +
  hw/s390x/s390-virtio-ccw.c  |   1 +
  linux-user/elfload.c        |   1 +
  target/arm/cpu64.c          |   1 +
  target/arm/helper-a64.c     |  43 ++++
  target/arm/helper.c         |  53 ++++-
  target/arm/translate-a64.c  | 490 +++++++++++++++++++++++++++++++++-----------
  target/riscv/translate.c    |  72 ++-----
  target/xtensa/translate.c   |  50 +++--
  tcg/tcg-op.c                |  48 +++++
 files changed, 934 insertions(+), 504 deletions(-)
- include/qemu/log.h         |   1 +
- target/arm/helper-a64.h    |   2 +
- target/arm/helper.h        |   6 +
- accel/tcg/cpu-exec.c       |   9 +-
- fpu/softfloat.c            |   6 +-
- hw/sd/sd.c                 |   2 +-
- target/arm/cpu.c           |   2 +
- target/arm/helper-a64.c    |  10 ++
- target/arm/helper.c        |  38 +++-
- target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
- util/log.c                 |   2 +
-files changed, 428 insertions(+), 71 deletions(-)

-New patch
+[Qemu-devel] [PULL 01/21] hw/arm/iotkit.c: fix minor memory leak
+Coverity (CID1390573) spots that we forgot to free the
+gpioname strings in a loop in the iotkit realize function.
+Correct the error.
+This isn't a significant leak, because this function
+only ever runs once.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Peter Xu <peterx@redhat.com>
+Message-id: 20180427110137.19304-1-peter.maydell@linaro.org
+---
+ hw/arm/iotkit.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/arm/iotkit.c b/hw/arm/iotkit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/iotkit.c
++++ b/hw/arm/iotkit.c
+@@ -XXX,XX +XXX,XX @@ static void iotkit_realize(DeviceState *dev, Error **errp)
+                               qdev_get_gpio_in(DEVICE(&s->ppc_irq_orgate), i));
+         qdev_connect_gpio_out_named(DEVICE(ppc), "irq", 0,
+                                     qdev_get_gpio_in(devs, 0));
++        g_free(gpioname);
+     }
+     iotkit_forward_sec_resp_cfg(s);
+--
+.17.0

-[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+[Qemu-devel] [PULL 02/21] softfloat: Handle default NaN mode after pickNaNMulAdd, not before
-In float-to-integer conversion, if the floating point input
+It is implementation defined whether a multiply-add of
-converts exactly to the largest or smallest integer that
+(0,inf,qnan) or (inf,0,qnan) raises InvalidaOperation or
-fits in to the result type, this is not an overflow.
+not, so we let the target-specific pickNaNMulAdd function
-In this situation we were producing the correct result value,
+handle this. This means that we must do the "return the
-but were incorrectly setting the Invalid flag.
+default NaN in default NaN mode" check after the call,
-For example for Arm A64, "FCVTAS w0, d0" on an input of
+not before. Correct the ordering, and restore the comment
-x41dfffffffc00000 should produce 0x7fffffff and set no flags.
+from the old propagateFloat64MulAddNaN() that warned about
 this corner case.
-Fix the boundary case to take the right half of the if()
+This fixes a regression from 2.11 for Arm guests where we would
-statements.
+incorrectly fail to set the Invalid flag for these cases.
 This fixes a regression from 2.11 introduced by the softfloat
 refactoring.
 Cc: qemu-stable@nongnu.org
-Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180504100547.14621-1-peter.maydell@linaro.org
 ---
- fpu/softfloat.c | 4 ++--
+ fpu/softfloat.c | 52 ++++++++++++++++++++++++++++---------------------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 30 insertions(+), 22 deletions(-)
 diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat.c
 +++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+@@ -XXX,XX +XXX,XX @@ static FloatParts pick_nan(FloatParts a, FloatParts b, float_status *s)
-             r = UINT64_MAX;
+ static FloatParts pick_nan_muladd(FloatParts a, FloatParts b, FloatParts c,
-         }
+                                   bool inf_zero, float_status *s)
-         if (p.sign) {
+ {
--            if (r < -(uint64_t) min) {
++    int which;
-+            if (r <= -(uint64_t) min) {
++
-                 return -r;
+     if (is_snan(a.cls) || is_snan(b.cls) || is_snan(c.cls)) {
-             } else {
+         s->float_exception_flags |= float_flag_invalid;
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
+     }
-                 return min;
-             }
+-    if (s->default_nan_mode) {
-         } else {
+-        a.cls = float_class_dnan;
--            if (r < max) {
+-    } else {
-+            if (r <= max) {
+-        switch (pickNaNMulAdd(is_qnan(a.cls), is_snan(a.cls),
-                 return r;
+-                              is_qnan(b.cls), is_snan(b.cls),
-             } else {
+-                              is_qnan(c.cls), is_snan(c.cls),
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
+-                              inf_zero, s)) {
 -        case 0:
 -            break;
 -        case 1:
 -            a = b;
 -            break;
 -        case 2:
 -            a = c;
 -            break;
 -        case 3:
 -            a.cls = float_class_dnan;
 -            return a;
 -        default:
 -            g_assert_not_reached();
 -        }
 +    which = pickNaNMulAdd(is_qnan(a.cls), is_snan(a.cls),
 +                          is_qnan(b.cls), is_snan(b.cls),
 +                          is_qnan(c.cls), is_snan(c.cls),
 +                          inf_zero, s);
 -        a.cls = float_class_msnan;
 +    if (s->default_nan_mode) {
 +        /* Note that this check is after pickNaNMulAdd so that function
 +         * has an opportunity to set the Invalid flag.
 +         */
 +        a.cls = float_class_dnan;
 +        return a;
      }
 +
 +    switch (which) {
 +    case 0:
 +        break;
 +    case 1:
 +        a = b;
 +        break;
 +    case 2:
 +        a = c;
 +        break;
 +    case 3:
 +        a.cls = float_class_dnan;
 +        return a;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    a.cls = float_class_msnan;
 +
      return a;
  }
 --
 .17.0

-[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+[Qemu-devel] [PULL 03/21] pc: simplify MachineClass::get_hotplug_handler handling
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Igor Mammedov <imammedo@redhat.com>
-Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+By default MachineClass::get_hotplug_handler is NULL and concrete board
 should set it to it's own handler.
 Considering there isn't any default handler, drop saving empty
 MachineClass::get_hotplug_handler in child class and make PC code
 consistent with spapr/s390x boards.
-  The block length is predefined to 512 bits
+We can bring this back when actual usecase surfaces and do it
 consistently across boards that use get_hotplug_handler().
-and "4.10.2 SD Status":
+Suggested-by: David Gibson <david@gibson.dropbear.id.au>
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
-  The SD Status contains status bits that are related to the SD Memory Card
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-  proprietary features and may be used for future application-specific usage.
+Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
-  The size of the SD Status is one data block of 512 bit. The content of this
+Message-id: 1525691524-32265-2-git-send-email-imammedo@redhat.com
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 2 +-
+ include/hw/i386/pc.h | 8 --------
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/i386/pc.c         | 6 +-----
 files changed, 1 insertion(+), 13 deletions(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/include/hw/i386/pc.h
-+++ b/hw/sd/sd.c
++++ b/include/hw/i386/pc.h
-@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+@@ -XXX,XX +XXX,XX @@ struct PCMachineState {
-         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+ /**
   * PCMachineClass:
   *
 - * Methods:
 - *
 - * @get_hotplug_handler: pointer to parent class callback @get_hotplug_handler
 - *
   * Compat fields:
   *
   * @enforce_aligned_dimm: check that DIMM's address/size is aligned by
@@ -XXX,XX +XXX,XX @@ struct PCMachineClass {
      /*< public >*/
 -    /* Methods: */
 -    HotplugHandler *(*get_hotplug_handler)(MachineState *machine,
 -                                           DeviceState *dev);
 -
      /* Device configuration: */
      bool pci_enabled;
      bool kvmclock_enabled;
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
  static HotplugHandler *pc_get_hotpug_handler(MachineState *machine,
                                               DeviceState *dev)
  {
 -    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(machine);
 -
      if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
          object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
          return HOTPLUG_HANDLER(machine);
      }
-     memset(&sd->data[17], 0, 47);
--    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+-    return pcmc->get_hotplug_handler ?
-+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
+-        pcmc->get_hotplug_handler(machine, dev) : NULL;
 +    return NULL;
  }
- static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
+ static void
@@ -XXX,XX +XXX,XX @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
      HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
      NMIClass *nc = NMI_CLASS(oc);
 -    pcmc->get_hotplug_handler = mc->get_hotplug_handler;
      pcmc->pci_enabled = true;
      pcmc->has_acpi_build = true;
      pcmc->rsdp_in_ram = true;
 --
 .17.0

-New patch
+[Qemu-devel] [PULL 04/21] platform-bus-device: use device plug callback instead of machine_done notifier
+From: Igor Mammedov <imammedo@redhat.com>
 platform-bus were using machine_done notifier to get and map
 (assign irq/mmio resources) dynamically added sysbus devices
 after all '-device' options had been processed.
 That however creates non obvious dependencies on ordering of
 machine_done notifiers and requires carefull line juggling
 to keep it working. For example see comment above
 create_platform_bus() and 'straitforward' arm_load_kernel()
 had to converted to machine_done notifier and that lead to
 yet another machine_done notifier to keep it working
 arm_register_platform_bus_fdt_creator().
 Instead of hiding resource assignment in platform-bus-device
 to magically initialize sysbus devices, use device plug
 callback and assign resources explicitly at board level
 at the moment each -device option is being processed.
 That adds a bunch of machine declaration boiler plate to
 e500plat board, similar to ARM/x86 but gets rid of hidden
 machine_done notifier and would allow to remove the dependent
 notifiers in ARM code simplifying it and making code flow
 easier to follow.
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Acked-by: David Gibson <david@gibson.dropbear.id.au>
 Message-id: 1525691524-32265-3-git-send-email-imammedo@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ppc/e500.h             |  5 +++++
  include/hw/arm/virt.h     |  1 +
  include/hw/platform-bus.h |  4 ++--
  hw/arm/sysbus-fdt.c       |  3 ---
  hw/arm/virt.c             | 31 +++++++++++++++++++++++++++++++
  hw/core/platform-bus.c    | 29 +++++------------------------
  hw/ppc/e500.c             | 38 +++++++++++++++++---------------------
  hw/ppc/e500plat.c         | 31 +++++++++++++++++++++++++++++++
 files changed, 92 insertions(+), 50 deletions(-)
 diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/e500.h
 +++ b/hw/ppc/e500.h
@@ -XXX,XX +XXX,XX @@
  #define PPCE500_H
  #include "hw/boards.h"
 +#include "hw/platform-bus.h"
  typedef struct PPCE500MachineState {
      /*< private >*/
      MachineState parent_obj;
 +    /* points to instance of TYPE_PLATFORM_BUS_DEVICE if
 +     * board supports dynamic sysbus devices
 +     */
 +    PlatformBusDevice *pbus_dev;
  } PPCE500MachineState;
  typedef struct PPCE500MachineClass {
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  typedef struct {
      MachineState parent;
      Notifier machine_done;
 +    DeviceState *platform_bus_dev;
      FWCfgState *fw_cfg;
      bool secure;
      bool highmem;
 diff --git a/include/hw/platform-bus.h b/include/hw/platform-bus.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/platform-bus.h
 +++ b/include/hw/platform-bus.h
@@ -XXX,XX +XXX,XX @@ typedef struct PlatformBusDevice PlatformBusDevice;
  struct PlatformBusDevice {
      /*< private >*/
      SysBusDevice parent_obj;
 -    Notifier notifier;
 -    bool done_gathering;
      /*< public >*/
      uint32_t mmio_size;
@@ -XXX,XX +XXX,XX @@ int platform_bus_get_irqn(PlatformBusDevice *platform_bus, SysBusDevice *sbdev,
  hwaddr platform_bus_get_mmio_addr(PlatformBusDevice *pbus, SysBusDevice *sbdev,
                                    int n);
 +void platform_bus_link_device(PlatformBusDevice *pbus, SysBusDevice *sbdev);
 +
  #endif /* HW_PLATFORM_BUS_H */
 diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/sysbus-fdt.c
 +++ b/hw/arm/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
      dev = qdev_find_recursive(sysbus_get_default(), TYPE_PLATFORM_BUS_DEVICE);
      pbus = PLATFORM_BUS_DEVICE(dev);
 -    /* We can only create dt nodes for dynamic devices when they're ready */
 -    assert(pbus->done_gathering);
 -
      PlatformBusFDTData data = {
          .fdt = fdt,
          .irq_start = irq_start,
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_platform_bus(VirtMachineState *vms, qemu_irq *pic)
      qdev_prop_set_uint32(dev, "mmio_size",
          platform_bus_params.platform_bus_size);
      qdev_init_nofail(dev);
 +    vms->platform_bus_dev = dev;
      s = SYS_BUS_DEVICE(dev);
      for (i = 0; i < platform_bus_params.platform_bus_num_irqs; i++) {
@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
      return ms->possible_cpus;
  }
 +static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
 +                                        DeviceState *dev, Error **errp)
 +{
 +    VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
 +
 +    if (vms->platform_bus_dev) {
 +        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
 +            platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
 +                                     SYS_BUS_DEVICE(dev));
 +        }
 +    }
 +}
 +
 +static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
 +                                                        DeviceState *dev)
 +{
 +    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
 +        return HOTPLUG_HANDLER(machine);
 +    }
 +
 +    return NULL;
 +}
 +
  static void virt_machine_class_init(ObjectClass *oc, void *data)
  {
      MachineClass *mc = MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
      mc->init = machvirt_init;
      /* Start max_cpus at the maximum QEMU supports. We'll further restrict
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
      mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
      mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
 +    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
 +    hc->plug = virt_machine_device_plug_cb;
  }
  static const TypeInfo virt_machine_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo virt_machine_info = {
      .instance_size = sizeof(VirtMachineState),
      .class_size    = sizeof(VirtMachineClass),
      .class_init    = virt_machine_class_init,
 +    .interfaces = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    },
  };
  static void machvirt_machine_init(void)
 diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/platform-bus.c
 +++ b/hw/core/platform-bus.c
@@ -XXX,XX +XXX,XX @@ static void plaform_bus_refresh_irqs(PlatformBusDevice *pbus)
  {
      bitmap_zero(pbus->used_irqs, pbus->num_irqs);
      foreach_dynamic_sysbus_device(platform_bus_count_irqs, pbus);
 -    pbus->done_gathering = true;
  }
  static void platform_bus_map_irq(PlatformBusDevice *pbus, SysBusDevice *sbdev,
@@ -XXX,XX +XXX,XX @@ static void platform_bus_map_mmio(PlatformBusDevice *pbus, SysBusDevice *sbdev,
  }
  /*
 - * For each sysbus device, look for unassigned IRQ lines as well as
 - * unassociated MMIO regions. Connect them to the platform bus if available.
 + * Look for unassigned IRQ lines as well as unassociated MMIO regions.
 + * Connect them to the platform bus if available.
   */
 -static void link_sysbus_device(SysBusDevice *sbdev, void *opaque)
 +void platform_bus_link_device(PlatformBusDevice *pbus, SysBusDevice *sbdev)
  {
 -    PlatformBusDevice *pbus = opaque;
      int i;
      for (i = 0; sysbus_has_irq(sbdev, i); i++) {
@@ -XXX,XX +XXX,XX @@ static void link_sysbus_device(SysBusDevice *sbdev, void *opaque)
      }
  }
 -static void platform_bus_init_notify(Notifier *notifier, void *data)
 -{
 -    PlatformBusDevice *pb = container_of(notifier, PlatformBusDevice, notifier);
 -
 -    /*
 -     * Generate a bitmap of used IRQ lines, as the user might have specified
 -     * them on the command line.
 -     */
 -    plaform_bus_refresh_irqs(pb);
 -
 -    foreach_dynamic_sysbus_device(link_sysbus_device, pb);
 -}
 -
  static void platform_bus_realize(DeviceState *dev, Error **errp)
  {
      PlatformBusDevice *pbus;
@@ -XXX,XX +XXX,XX @@ static void platform_bus_realize(DeviceState *dev, Error **errp)
          sysbus_init_irq(d, &pbus->irqs[i]);
      }
 -    /*
 -     * Register notifier that allows us to gather dangling devices once the
 -     * machine is completely assembled
 -     */
 -    pbus->notifier.notify = platform_bus_init_notify;
 -    qemu_add_machine_init_done_notifier(&pbus->notifier);
 +    /* some devices might be initialized before so update used IRQs map */
 +    plaform_bus_refresh_irqs(pbus);
  }
  static Property platform_bus_properties[] = {
 diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/e500.c
 +++ b/hw/ppc/e500.c
@@ -XXX,XX +XXX,XX @@ static void sysbus_device_create_devtree(SysBusDevice *sbdev, void *opaque)
      }
  }
 -static void platform_bus_create_devtree(const PPCE500MachineClass *pmc,
 +static void platform_bus_create_devtree(PPCE500MachineState *pms,
                                          void *fdt, const char *mpic)
  {
 +    const PPCE500MachineClass *pmc = PPCE500_MACHINE_GET_CLASS(pms);
      gchar *node = g_strdup_printf("/platform@%"PRIx64, pmc->platform_bus_base);
      const char platcomp[] = "qemu,platform\0simple-bus";
      uint64_t addr = pmc->platform_bus_base;
      uint64_t size = pmc->platform_bus_size;
      int irq_start = pmc->platform_bus_first_irq;
 -    PlatformBusDevice *pbus;
 -    DeviceState *dev;
      /* Create a /platform node that we can put all devices into */
@@ -XXX,XX +XXX,XX @@ static void platform_bus_create_devtree(const PPCE500MachineClass *pmc,
      qemu_fdt_setprop_phandle(fdt, node, "interrupt-parent", mpic);
 -    dev = qdev_find_recursive(sysbus_get_default(), TYPE_PLATFORM_BUS_DEVICE);
 -    pbus = PLATFORM_BUS_DEVICE(dev);
 +    /* Create dt nodes for dynamic devices */
 +    PlatformDevtreeData data = {
 +        .fdt = fdt,
 +        .mpic = mpic,
 +        .irq_start = irq_start,
 +        .node = node,
 +        .pbus = pms->pbus_dev,
 +    };
 -    /* We can only create dt nodes for dynamic devices when they're ready */
 -    if (pbus->done_gathering) {
 -        PlatformDevtreeData data = {
 -            .fdt = fdt,
 -            .mpic = mpic,
 -            .irq_start = irq_start,
 -            .node = node,
 -            .pbus = pbus,
 -        };
 -
 -        /* Loop through all dynamic sysbus devices and create nodes for them */
 -        foreach_dynamic_sysbus_device(sysbus_device_create_devtree, &data);
 -    }
 +    /* Loop through all dynamic sysbus devices and create nodes for them */
 +    foreach_dynamic_sysbus_device(sysbus_device_create_devtree, &data);
      g_free(node);
  }
@@ -XXX,XX +XXX,XX @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
      }
      g_free(soc);
 -    if (pmc->has_platform_bus) {
 -        platform_bus_create_devtree(pmc, fdt, mpic);
 +    if (pms->pbus_dev) {
 +        platform_bus_create_devtree(pms, fdt, mpic);
      }
      g_free(mpic);
@@ -XXX,XX +XXX,XX @@ void ppce500_init(MachineState *machine)
          qdev_prop_set_uint32(dev, "num_irqs", pmc->platform_bus_num_irqs);
          qdev_prop_set_uint32(dev, "mmio_size", pmc->platform_bus_size);
          qdev_init_nofail(dev);
 -        s = SYS_BUS_DEVICE(dev);
 +        pms->pbus_dev = PLATFORM_BUS_DEVICE(dev);
 +        s = SYS_BUS_DEVICE(pms->pbus_dev);
          for (i = 0; i < pmc->platform_bus_num_irqs; i++) {
              int irqn = pmc->platform_bus_first_irq + i;
              sysbus_connect_irq(s, i, qdev_get_gpio_in(mpicdev, irqn));
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ppce500_info = {
      .name          = TYPE_PPCE500_MACHINE,
      .parent        = TYPE_MACHINE,
      .abstract      = true,
 +    .instance_size = sizeof(PPCE500MachineState),
      .class_size    = sizeof(PPCE500MachineClass),
  };
 diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/e500plat.c
 +++ b/hw/ppc/e500plat.c
@@ -XXX,XX +XXX,XX @@ static void e500plat_init(MachineState *machine)
      ppce500_init(machine);
  }
 +static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
 +                                            DeviceState *dev, Error **errp)
 +{
 +    PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
 +
 +    if (pms->pbus_dev) {
 +        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
 +            platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
 +        }
 +    }
 +}
 +
 +static
 +HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
 +                                                    DeviceState *dev)
 +{
 +    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
 +        return HOTPLUG_HANDLER(machine);
 +    }
 +
 +    return NULL;
 +}
 +
  #define TYPE_E500PLAT_MACHINE  MACHINE_TYPE_NAME("ppce500")
  static void e500plat_machine_class_init(ObjectClass *oc, void *data)
  {
      PPCE500MachineClass *pmc = PPCE500_MACHINE_CLASS(oc);
 +    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
      MachineClass *mc = MACHINE_CLASS(oc);
 +    mc->get_hotplug_handler = e500plat_machine_get_hotpug_handler;
 +    hc->plug = e500plat_machine_device_plug_cb;
 +
      pmc->pci_first_slot = 0x1;
      pmc->pci_nr_slots = PCI_SLOT_MAX - 1;
      pmc->fixup_devtree = e500plat_fixup_devtree;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo e500plat_info = {
      .name          = TYPE_E500PLAT_MACHINE,
      .parent        = TYPE_PPCE500_MACHINE,
      .class_init    = e500plat_machine_class_init,
 +    .interfaces    = (InterfaceInfo[]) {
 +         { TYPE_HOTPLUG_HANDLER },
 +         { }
 +    }
  };
  static void e500plat_register_types(void)
 --
 .17.0

-New patch
+[Qemu-devel] [PULL 05/21] arm/boot: split load_dtb() from arm_load_kernel()
+From: Igor Mammedov <imammedo@redhat.com>
 load_dtb() depends on arm_load_kernel() to figure out place
 in RAM where it should be loaded, but it's not required for
 arm_load_kernel() to work. Sometimes it's neccesary for
 devices added with -device/device_add to be enumerated in
 DTB as well, which's lead to [1] and surrounding commits to
 add 2 more machine_done notifiers with non obvious ordering
 to make dynamic sysbus devices initialization happen in
 the right order.
 However instead of moving whole arm_load_kernel() in to
 machine_done, it's sufficient to move only load_dtb() into
 virt_machine_done() notifier and remove ArmLoadKernelNotifier/
 /PlatformBusFDTNotifierParams notifiers, which saves us ~90LOC
 and simplifies code flow quite a bit.
 Later would allow to consolidate DTB generation within one
 function for 'mach-virt' board and make it reentrant so it
 could generate updated DTB in device hotplug secenarios.
 While at it rename load_dtb() to arm_load_dtb() since it's
 public now.
 Add additional field skip_dtb_autoload to struct arm_boot_info
 to allow manual DTB load later in mach-virt and to avoid touching
 all other boards to explicitly call arm_load_dtb().
 ) (ac9d32e hw/arm/boot: arm_load_kernel implemented as a machine init done notifier)
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 1525691524-32265-4-git-send-email-imammedo@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/arm.h        | 45 +++++++++++++++++------
  include/hw/arm/sysbus-fdt.h | 37 ++++---------------
  hw/arm/boot.c               | 72 ++++++++++---------------------------
  hw/arm/sysbus-fdt.c         | 61 +++----------------------------
  hw/arm/virt.c               | 64 ++++++++++++++++-----------------
 files changed, 94 insertions(+), 185 deletions(-)
 diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/arm.h
 +++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ DeviceState *armv7m_init(MemoryRegion *system_memory, int mem_size, int num_irq,
   */
  void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size);
 -/*
 - * struct used as a parameter of the arm_load_kernel machine init
 - * done notifier
 - */
 -typedef struct {
 -    Notifier notifier; /* actual notifier */
 -    ARMCPU *cpu; /* handle to the first cpu object */
 -} ArmLoadKernelNotifier;
 -
  /* arm_boot.c */
  struct arm_boot_info {
      uint64_t ram_size;
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
      const char *initrd_filename;
      const char *dtb_filename;
      hwaddr loader_start;
 +    hwaddr dtb_start;
 +    hwaddr dtb_limit;
 +    /* If set to True, arm_load_kernel() will not load DTB.
 +     * It allows board to load DTB manually later.
 +     * (default: False)
 +     */
 +    bool skip_dtb_autoload;
      /* multicore boards that use the default secondary core boot functions
       * need to put the address of the secondary boot code, the boot reg,
       * and the GIC address in the next 3 values, respectively. boards that
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
       * the user it should implement this hook.
       */
      void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);
 -    /* machine init done notifier executing arm_load_dtb */
 -    ArmLoadKernelNotifier load_kernel_notifier;
      /* Used internally by arm_boot.c */
      int is_linux;
      hwaddr initrd_start;
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
   */
  void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info);
 +AddressSpace *arm_boot_address_space(ARMCPU *cpu,
 +                                     const struct arm_boot_info *info);
 +
 +/**
 + * arm_load_dtb() - load a device tree binary image into memory
 + * @addr:       the address to load the image at
 + * @binfo:      struct describing the boot environment
 + * @addr_limit: upper limit of the available memory area at @addr
 + * @as:         address space to load image to
 + *
 + * Load a device tree supplied by the machine or by the user  with the
 + * '-dtb' command line option, and put it at offset @addr in target
 + * memory.
 + *
 + * If @addr_limit contains a meaningful value (i.e., it is strictly greater
 + * than @addr), the device tree is only loaded if its size does not exceed
 + * the limit.
 + *
 + * Returns: the size of the device tree image on success,
 + *          0 if the image size exceeds the limit,
 + *          -1 on errors.
 + *
 + * Note: Must not be called unless have_dtb(binfo) is true.
 + */
 +int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 +                 hwaddr addr_limit, AddressSpace *as);
 +
  /* Write a secure board setup routine with a dummy handler for SMCs */
  void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                              const struct arm_boot_info *info,
 diff --git a/include/hw/arm/sysbus-fdt.h b/include/hw/arm/sysbus-fdt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/sysbus-fdt.h
 +++ b/include/hw/arm/sysbus-fdt.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HW_ARM_SYSBUS_FDT_H
  #define HW_ARM_SYSBUS_FDT_H
 -#include "hw/arm/arm.h"
 -#include "qemu-common.h"
 -#include "hw/sysbus.h"
 -
 -/*
 - * struct that contains dimensioning parameters of the platform bus
 - */
 -typedef struct {
 -    hwaddr platform_bus_base; /* start address of the bus */
 -    hwaddr platform_bus_size; /* size of the bus */
 -    int platform_bus_first_irq; /* first hwirq assigned to the bus */
 -    int platform_bus_num_irqs; /* number of hwirq assigned to the bus */
 -} ARMPlatformBusSystemParams;
 -
 -/*
 - * struct that contains all relevant info to build the fdt nodes of
 - * platform bus and attached dynamic sysbus devices
 - * in the future might be augmented with additional info
 - * such as PHY, CLK handles ...
 - */
 -typedef struct {
 -    const ARMPlatformBusSystemParams *system_params;
 -    struct arm_boot_info *binfo;
 -    const char *intc; /* parent interrupt controller name */
 -} ARMPlatformBusFDTParams;
 +#include "exec/hwaddr.h"
  /**
 - * arm_register_platform_bus_fdt_creator - register a machine init done
 - * notifier that creates the device tree nodes of the platform bus and
 - * associated dynamic sysbus devices
 + * platform_bus_add_all_fdt_nodes - create all the platform bus nodes
 + *
 + * builds the parent platform bus node and all the nodes of dynamic
 + * sysbus devices attached to it.
   */
 -void arm_register_platform_bus_fdt_creator(ARMPlatformBusFDTParams *fdt_params);
 -
 +void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
 +                                    hwaddr bus_size, int irq_start);
  #endif
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
  #define ARM64_TEXT_OFFSET_OFFSET    8
  #define ARM64_MAGIC_OFFSET          56
 -static AddressSpace *arm_boot_address_space(ARMCPU *cpu,
 -                                            const struct arm_boot_info *info)
 +AddressSpace *arm_boot_address_space(ARMCPU *cpu,
 +                                     const struct arm_boot_info *info)
  {
      /* Return the address space to use for bootloader reads and writes.
       * We prefer the secure address space if the CPU has it and we're
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
      qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
  }
 -/**
 - * load_dtb() - load a device tree binary image into memory
 - * @addr:       the address to load the image at
 - * @binfo:      struct describing the boot environment
 - * @addr_limit: upper limit of the available memory area at @addr
 - * @as:         address space to load image to
 - *
 - * Load a device tree supplied by the machine or by the user  with the
 - * '-dtb' command line option, and put it at offset @addr in target
 - * memory.
 - *
 - * If @addr_limit contains a meaningful value (i.e., it is strictly greater
 - * than @addr), the device tree is only loaded if its size does not exceed
 - * the limit.
 - *
 - * Returns: the size of the device tree image on success,
 - *          0 if the image size exceeds the limit,
 - *          -1 on errors.
 - *
 - * Note: Must not be called unless have_dtb(binfo) is true.
 - */
 -static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 -                    hwaddr addr_limit, AddressSpace *as)
 +int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
 +                 hwaddr addr_limit, AddressSpace *as)
  {
      void *fdt = NULL;
      int size, rc;
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
      return size;
  }
 -static void arm_load_kernel_notify(Notifier *notifier, void *data)
 +void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
  {
      CPUState *cs;
      int kernel_size;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
      int elf_machine;
      hwaddr entry;
      static const ARMInsnFixup *primary_loader;
 -    ArmLoadKernelNotifier *n = DO_UPCAST(ArmLoadKernelNotifier,
 -                                         notifier, notifier);
 -    ARMCPU *cpu = n->cpu;
 -    struct arm_boot_info *info =
 -        container_of(n, struct arm_boot_info, load_kernel_notifier);
      AddressSpace *as = arm_boot_address_space(cpu, info);
      /* The board code is not supposed to set secure_board_setup unless
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
      assert(!(info->secure_board_setup && kvm_enabled()));
      info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");
 +    info->dtb_limit = 0;
      /* Load the kernel.  */
      if (!info->kernel_filename || info->firmware_loaded) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
               * the kernel is supposed to be loaded by the bootloader), copy the
               * DTB to the base of RAM for the bootloader to pick up.
               */
 -            if (load_dtb(info->loader_start, info, 0, as) < 0) {
 -                exit(1);
 -            }
 +            info->dtb_start = info->loader_start;
          }
          if (info->kernel_filename) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
           */
          if (elf_low_addr > info->loader_start
              || elf_high_addr < info->loader_start) {
 -            /* Pass elf_low_addr as address limit to load_dtb if it may be
 +            /* Set elf_low_addr as address limit for arm_load_dtb if it may be
               * pointing into RAM, otherwise pass '0' (no limit)
               */
              if (elf_low_addr < info->loader_start) {
                  elf_low_addr = 0;
              }
 -            if (load_dtb(info->loader_start, info, elf_low_addr, as) < 0) {
 -                exit(1);
 -            }
 +            info->dtb_start = info->loader_start;
 +            info->dtb_limit = elf_low_addr;
          }
      }
      entry = elf_entry;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
           */
          if (have_dtb(info)) {
              hwaddr align;
 -            hwaddr dtb_start;
              if (elf_machine == EM_AARCH64) {
                  /*
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
              }
              /* Place the DTB after the initrd in memory with alignment. */
 -            dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size, align);
 -            if (load_dtb(dtb_start, info, 0, as) < 0) {
 -                exit(1);
 -            }
 -            fixupcontext[FIXUP_ARGPTR] = dtb_start;
 +            info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
 +                                           align);
 +            fixupcontext[FIXUP_ARGPTR] = info->dtb_start;
          } else {
              fixupcontext[FIXUP_ARGPTR] = info->loader_start + KERNEL_ARGS_ADDR;
              if (info->ram_size >= (1ULL << 32)) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
      for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
          ARM_CPU(cs)->env.boot_info = info;
      }
 -}
 -
 -void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 -{
 -    CPUState *cs;
 -
 -    info->load_kernel_notifier.cpu = cpu;
 -    info->load_kernel_notifier.notifier.notify = arm_load_kernel_notify;
 -    qemu_add_machine_init_done_notifier(&info->load_kernel_notifier.notifier);
      /* CPU objects (unlike devices) are not automatically reset on system
       * reset, so we must always register a handler to do so. If we're
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
      for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
          qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
      }
 +
 +    if (!info->skip_dtb_autoload && have_dtb(info)) {
 +        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
 +            exit(1);
 +        }
 +    }
  }
  static const TypeInfo arm_linux_boot_if_info = {
 diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/sysbus-fdt.c
 +++ b/hw/arm/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ typedef struct PlatformBusFDTData {
      PlatformBusDevice *pbus;
  } PlatformBusFDTData;
 -/*
 - * struct used when calling the machine init done notifier
 - * that constructs the fdt nodes of platform bus devices
 - */
 -typedef struct PlatformBusFDTNotifierParams {
 -    Notifier notifier;
 -    ARMPlatformBusFDTParams *fdt_params;
 -} PlatformBusFDTNotifierParams;
 -
  /* struct that associates a device type name and a node creation function */
  typedef struct NodeCreationPair {
      const char *typename;
@@ -XXX,XX +XXX,XX @@ static void add_fdt_node(SysBusDevice *sbdev, void *opaque)
      exit(1);
  }
 -/**
 - * add_all_platform_bus_fdt_nodes - create all the platform bus nodes
 - *
 - * builds the parent platform bus node and all the nodes of dynamic
 - * sysbus devices attached to it.
 - */
 -static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
 +void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
 +                                    hwaddr bus_size, int irq_start)
  {
      const char platcomp[] = "qemu,platform\0simple-bus";
      PlatformBusDevice *pbus;
      DeviceState *dev;
      gchar *node;
 -    uint64_t addr, size;
 -    int irq_start, dtb_size;
 -    struct arm_boot_info *info = fdt_params->binfo;
 -    const ARMPlatformBusSystemParams *params = fdt_params->system_params;
 -    const char *intc = fdt_params->intc;
 -    void *fdt = info->get_dtb(info, &dtb_size);
 -
 -    /*
 -     * If the user provided a dtb, we assume the dynamic sysbus nodes
 -     * already are integrated there. This corresponds to a use case where
 -     * the dynamic sysbus nodes are complex and their generation is not yet
 -     * supported. In that case the user can take charge of the guest dt
 -     * while qemu takes charge of the qom stuff.
 -     */
 -    if (info->dtb_filename) {
 -        return;
 -    }
      assert(fdt);
 -    node = g_strdup_printf("/platform@%"PRIx64, params->platform_bus_base);
 -    addr = params->platform_bus_base;
 -    size = params->platform_bus_size;
 -    irq_start = params->platform_bus_first_irq;
 +    node = g_strdup_printf("/platform@%"PRIx64, addr);
      /* Create a /platform node that we can put all devices into */
      qemu_fdt_add_subnode(fdt, node);
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
       */
      qemu_fdt_setprop_cells(fdt, node, "#size-cells", 1);
      qemu_fdt_setprop_cells(fdt, node, "#address-cells", 1);
 -    qemu_fdt_setprop_cells(fdt, node, "ranges", 0, addr >> 32, addr, size);
 +    qemu_fdt_setprop_cells(fdt, node, "ranges", 0, addr >> 32, addr, bus_size);
      qemu_fdt_setprop_phandle(fdt, node, "interrupt-parent", intc);
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
      g_free(node);
  }
 -
 -static void platform_bus_fdt_notify(Notifier *notifier, void *data)
 -{
 -    PlatformBusFDTNotifierParams *p = DO_UPCAST(PlatformBusFDTNotifierParams,
 -                                                notifier, notifier);
 -
 -    add_all_platform_bus_fdt_nodes(p->fdt_params);
 -    g_free(p->fdt_params);
 -    g_free(p);
 -}
 -
 -void arm_register_platform_bus_fdt_creator(ARMPlatformBusFDTParams *fdt_params)
 -{
 -    PlatformBusFDTNotifierParams *p = g_new(PlatformBusFDTNotifierParams, 1);
 -
 -    p->fdt_params = fdt_params;
 -    p->notifier.notify = platform_bus_fdt_notify;
 -    qemu_add_machine_init_done_notifier(&p->notifier);
 -}
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
  #define PLATFORM_BUS_NUM_IRQS 64
 -static ARMPlatformBusSystemParams platform_bus_params;
 -
  /* RAM limit in GB. Since VIRT_MEM starts at the 1GB mark, this means
   * RAM can go up to the 256GB mark, leaving 256GB of the physical
   * address space unallocated and free for future use between 256G and 512G.
@@ -XXX,XX +XXX,XX @@ static void create_platform_bus(VirtMachineState *vms, qemu_irq *pic)
      DeviceState *dev;
      SysBusDevice *s;
      int i;
 -    ARMPlatformBusFDTParams *fdt_params = g_new(ARMPlatformBusFDTParams, 1);
      MemoryRegion *sysmem = get_system_memory();
 -    platform_bus_params.platform_bus_base = vms->memmap[VIRT_PLATFORM_BUS].base;
 -    platform_bus_params.platform_bus_size = vms->memmap[VIRT_PLATFORM_BUS].size;
 -    platform_bus_params.platform_bus_first_irq = vms->irqmap[VIRT_PLATFORM_BUS];
 -    platform_bus_params.platform_bus_num_irqs = PLATFORM_BUS_NUM_IRQS;
 -
 -    fdt_params->system_params = &platform_bus_params;
 -    fdt_params->binfo = &vms->bootinfo;
 -    fdt_params->intc = "/intc";
 -    /*
 -     * register a machine init done notifier that creates the device tree
 -     * nodes of the platform bus and its children dynamic sysbus devices
 -     */
 -    arm_register_platform_bus_fdt_creator(fdt_params);
 -
      dev = qdev_create(NULL, TYPE_PLATFORM_BUS_DEVICE);
      dev->id = TYPE_PLATFORM_BUS_DEVICE;
 -    qdev_prop_set_uint32(dev, "num_irqs",
 -        platform_bus_params.platform_bus_num_irqs);
 -    qdev_prop_set_uint32(dev, "mmio_size",
 -        platform_bus_params.platform_bus_size);
 +    qdev_prop_set_uint32(dev, "num_irqs", PLATFORM_BUS_NUM_IRQS);
 +    qdev_prop_set_uint32(dev, "mmio_size", vms->memmap[VIRT_PLATFORM_BUS].size);
      qdev_init_nofail(dev);
      vms->platform_bus_dev = dev;
 -    s = SYS_BUS_DEVICE(dev);
 -    for (i = 0; i < platform_bus_params.platform_bus_num_irqs; i++) {
 -        int irqn = platform_bus_params.platform_bus_first_irq + i;
 +    s = SYS_BUS_DEVICE(dev);
 +    for (i = 0; i < PLATFORM_BUS_NUM_IRQS; i++) {
 +        int irqn = vms->irqmap[VIRT_PLATFORM_BUS] + i;
          sysbus_connect_irq(s, i, pic[irqn]);
      }
      memory_region_add_subregion(sysmem,
 -                                platform_bus_params.platform_bus_base,
 +                                vms->memmap[VIRT_PLATFORM_BUS].base,
                                  sysbus_mmio_get_region(s, 0));
  }
@@ -XXX,XX +XXX,XX @@ void virt_machine_done(Notifier *notifier, void *data)
  {
      VirtMachineState *vms = container_of(notifier, VirtMachineState,
                                           machine_done);
 +    ARMCPU *cpu = ARM_CPU(first_cpu);
 +    struct arm_boot_info *info = &vms->bootinfo;
 +    AddressSpace *as = arm_boot_address_space(cpu, info);
 +
 +    /*
 +     * If the user provided a dtb, we assume the dynamic sysbus nodes
 +     * already are integrated there. This corresponds to a use case where
 +     * the dynamic sysbus nodes are complex and their generation is not yet
 +     * supported. In that case the user can take charge of the guest dt
 +     * while qemu takes charge of the qom stuff.
 +     */
 +    if (info->dtb_filename == NULL) {
 +        platform_bus_add_all_fdt_nodes(vms->fdt, "/intc",
 +                                       vms->memmap[VIRT_PLATFORM_BUS].base,
 +                                       vms->memmap[VIRT_PLATFORM_BUS].size,
 +                                       vms->irqmap[VIRT_PLATFORM_BUS]);
 +    }
 +    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
 +        exit(1);
 +    }
      virt_acpi_setup(vms);
      virt_build_smbios(vms);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      vms->fw_cfg = create_fw_cfg(vms, &address_space_memory);
      rom_set_fw(vms->fw_cfg);
 -    vms->machine_done.notify = virt_machine_done;
 -    qemu_add_machine_init_done_notifier(&vms->machine_done);
 +    create_platform_bus(vms, pic);
      vms->bootinfo.ram_size = machine->ram_size;
      vms->bootinfo.kernel_filename = machine->kernel_filename;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      vms->bootinfo.board_id = -1;
      vms->bootinfo.loader_start = vms->memmap[VIRT_MEM].base;
      vms->bootinfo.get_dtb = machvirt_dtb;
 +    vms->bootinfo.skip_dtb_autoload = true;
      vms->bootinfo.firmware_loaded = firmware_loaded;
      arm_load_kernel(ARM_CPU(first_cpu), &vms->bootinfo);
 -    /*
 -     * arm_load_kernel machine init done notifier registration must
 -     * happen before the platform_bus_create call. In this latter,
 -     * another notifier is registered which adds platform bus nodes.
 -     * Notifiers are executed in registration reverse order.
 -     */
 -    create_platform_bus(vms, pic);
 +    vms->machine_done.notify = virt_machine_done;
 +    qemu_add_machine_init_done_notifier(&vms->machine_done);
  }
  static bool virt_get_secure(Object *obj, Error **errp)
 --
 .17.0

-New patch
+[Qemu-devel] [PULL 06/21] make sure that we aren't overwriting mc->get_hotplug_handler by accident
+From: Igor Mammedov <imammedo@redhat.com>
+Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
+Signed-off-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 1525691524-32265-5-git-send-email-imammedo@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/virt.c              | 1 +
+ hw/i386/pc.c               | 1 +
+ hw/ppc/e500plat.c          | 1 +
+ hw/ppc/spapr.c             | 1 +
+ hw/s390x/s390-virtio-ccw.c | 1 +
+files changed, 5 insertions(+)
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/virt.c
++++ b/hw/arm/virt.c
+@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
+     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
+     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
++    assert(!mc->get_hotplug_handler);
+     mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
+     hc->plug = virt_machine_device_plug_cb;
+ }
+diff --git a/hw/i386/pc.c b/hw/i386/pc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/i386/pc.c
++++ b/hw/i386/pc.c
+@@ -XXX,XX +XXX,XX @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
+     pcmc->acpi_data_size = 0x20000 + 0x8000;
+     pcmc->save_tsc_khz = true;
+     pcmc->linuxboot_dma_enabled = true;
++    assert(!mc->get_hotplug_handler);
+     mc->get_hotplug_handler = pc_get_hotpug_handler;
+     mc->cpu_index_to_instance_props = pc_cpu_index_to_props;
+     mc->get_default_cpu_node_id = pc_get_default_cpu_node_id;
+diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ppc/e500plat.c
++++ b/hw/ppc/e500plat.c
+@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_class_init(ObjectClass *oc, void *data)
+     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
+     MachineClass *mc = MACHINE_CLASS(oc);
++    assert(!mc->get_hotplug_handler);
+     mc->get_hotplug_handler = e500plat_machine_get_hotpug_handler;
+     hc->plug = e500plat_machine_device_plug_cb;
+diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/ppc/spapr.c
++++ b/hw/ppc/spapr.c
+@@ -XXX,XX +XXX,XX @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
+     mc->kvm_type = spapr_kvm_type;
+     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_SPAPR_PCI_HOST_BRIDGE);
+     mc->pci_allow_0_address = true;
++    assert(!mc->get_hotplug_handler);
+     mc->get_hotplug_handler = spapr_get_hotplug_handler;
+     hc->pre_plug = spapr_machine_device_pre_plug;
+     hc->plug = spapr_machine_device_plug;
+diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/s390x/s390-virtio-ccw.c
++++ b/hw/s390x/s390-virtio-ccw.c
+@@ -XXX,XX +XXX,XX @@ static void ccw_machine_class_init(ObjectClass *oc, void *data)
+     mc->no_sdcard = 1;
+     mc->max_cpus = S390_MAX_CPUS;
+     mc->has_hotpluggable_cpus = true;
++    assert(!mc->get_hotplug_handler);
+     mc->get_hotplug_handler = s390_get_hotplug_handler;
+     mc->cpu_index_to_instance_props = s390_cpu_index_to_props;
+     mc->possible_cpu_arch_ids = s390_possible_cpu_arch_ids;
+--
+.17.0

-[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
+[Qemu-devel] [PULL 07/21] atomic.h: Work around gcc spurious "unused value" warning
-Usually the logging of the CPU state produced by -d cpu is sufficient
+Some versions of gcc produce a spurious warning if the result of
-to diagnose problems, but sometimes you want to see the state of
+__atomic_compare_echange_n() is not used and the type involved
-the floating point registers as well. We don't want to enable that
+is a signed 8 bit value:
-by default as it adds a lot of extra data to the log; instead,
+  error: value computed is not used [-Werror=unused-value]
-allow it to be optionally enabled via -d fpu.
+This has been seen on at least
  gcc (Ubuntu 5.4.0-6ubuntu1~16.04.9) 5.4.0 20160609
 Work around this by using an explicit cast to void to indicate
 that we don't care about the return value.
 We don't currently use our atomic_cmpxchg() macro on any signed
 bit types, but the upcoming support for the Arm v8.1-Atomics
 will require it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 ---
- include/qemu/log.h   | 1 +
+ include/qemu/atomic.h | 2 +-
- accel/tcg/cpu-exec.c | 9 ++++++---
+file changed, 1 insertion(+), 1 deletion(-)
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/log.h b/include/qemu/log.h
+diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/log.h
+--- a/include/qemu/atomic.h
-+++ b/include/qemu/log.h
++++ b/include/qemu/atomic.h
-@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
+@@ -XXX,XX +XXX,XX @@
- #define CPU_LOG_PAGE       (1 << 14)
+ /* Returns the eventual value, failed or not */
- /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
+ #define atomic_cmpxchg__nocheck(ptr, old, new)    ({                    \
- #define CPU_LOG_TB_OP_IND  (1 << 16)
+     typeof_strip_qual(*ptr) _old = (old);                               \
-+#define CPU_LOG_TB_FPU     (1 << 17)
+-    __atomic_compare_exchange_n(ptr, &_old, new, false,                 \
++    (void)__atomic_compare_exchange_n(ptr, &_old, new, false,           \
- /* Lock output for a series of related logs.  Since this is not needed
+                               __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST);      \
-  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
+     _old;                                                               \
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+ })
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
      if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
          && qemu_log_in_addr_range(itb->pc)) {
          qemu_log_lock();
 +        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
 .17.0

-[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+[Qemu-devel] [PULL 08/21] tcg: Introduce helpers for integer min/max
 From: Richard Henderson <richard.henderson@linaro.org>
-Cc: qemu-stable@nongnu.org
+These operations are re-invented by several targets so far.
 Several supported hosts have insns for these, so place the
 expanders out-of-line for a future introduction of tcg opcodes.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180508151437.4232-2-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 30 ++++++++++++++----------------
+ tcg/tcg-op.h | 16 ++++++++++++++++
-file changed, 14 insertions(+), 16 deletions(-)
+ tcg/tcg-op.c | 40 ++++++++++++++++++++++++++++++++++++++++
 files changed, 56 insertions(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/tcg/tcg-op.h
-+++ b/target/arm/translate-a64.c
++++ b/tcg/tcg-op.h
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext8u_i32(TCGv_i32 ret, TCGv_i32 arg);
-     return v;
+ void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg);
  void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg);
  void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg);
 +void tcg_gen_smin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
 +void tcg_gen_smax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
 +void tcg_gen_umin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
 +void tcg_gen_umax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
  static inline void tcg_gen_discard_i32(TCGv_i32 arg)
  {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg);
  void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg);
  void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg);
  void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg);
 +void tcg_gen_smin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
 +void tcg_gen_smax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
 +void tcg_gen_umin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
 +void tcg_gen_umax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
  #if TCG_TARGET_REG_BITS == 64
  static inline void tcg_gen_discard_i64(TCGv_i64 arg)
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
  #define tcg_gen_mulu2_tl tcg_gen_mulu2_i64
  #define tcg_gen_muls2_tl tcg_gen_muls2_i64
  #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i64
 +#define tcg_gen_smin_tl tcg_gen_smin_i64
 +#define tcg_gen_umin_tl tcg_gen_umin_i64
 +#define tcg_gen_smax_tl tcg_gen_smax_i64
 +#define tcg_gen_umax_tl tcg_gen_umax_i64
  #define tcg_gen_atomic_cmpxchg_tl tcg_gen_atomic_cmpxchg_i64
  #define tcg_gen_atomic_xchg_tl tcg_gen_atomic_xchg_i64
  #define tcg_gen_atomic_fetch_add_tl tcg_gen_atomic_fetch_add_i64
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
  #define tcg_gen_mulu2_tl tcg_gen_mulu2_i32
  #define tcg_gen_muls2_tl tcg_gen_muls2_i32
  #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i32
 +#define tcg_gen_smin_tl tcg_gen_smin_i32
 +#define tcg_gen_umin_tl tcg_gen_umin_i32
 +#define tcg_gen_smax_tl tcg_gen_smax_i32
 +#define tcg_gen_umax_tl tcg_gen_umax_i32
  #define tcg_gen_atomic_cmpxchg_tl tcg_gen_atomic_cmpxchg_i32
  #define tcg_gen_atomic_xchg_tl tcg_gen_atomic_xchg_i32
  #define tcg_gen_atomic_fetch_add_tl tcg_gen_atomic_fetch_add_i32
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
      }
  }
-+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
++void tcg_gen_smin_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
 +{
-+    TCGv_i32 v = tcg_temp_new_i32();
++    tcg_gen_movcond_i32(TCG_COND_LT, ret, a, b, a, b);
 +
 +    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
 +    return v;
 +}
 +
- /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
++void tcg_gen_umin_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
-  * If SVE is not enabled, then there are only 128 bits in the vector.
++{
-  */
++    tcg_gen_movcond_i32(TCG_COND_LTU, ret, a, b, a, b);
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
++}
- static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
++
- {
++void tcg_gen_smax_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
-     TCGv_ptr fpst = NULL;
++{
--    TCGv_i32 tcg_op = tcg_temp_new_i32();
++    tcg_gen_movcond_i32(TCG_COND_LT, ret, a, b, b, a);
-+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
++}
-     TCGv_i32 tcg_res = tcg_temp_new_i32();
++
++void tcg_gen_umax_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
--    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
++{
--
++    tcg_gen_movcond_i32(TCG_COND_LTU, ret, a, b, b, a);
-     switch (opcode) {
++}
-     case 0x0: /* FMOV */
++
-         tcg_gen_mov_i32(tcg_res, tcg_op);
+ /* 64-bit ops */
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
-         tcg_temp_free_i64(tcg_op2);
+ #if TCG_TARGET_REG_BITS == 32
-         tcg_temp_free_i64(tcg_res);
+@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulsu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
-     } else {
+     tcg_temp_free_i64(t2);
--        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
+ }
--        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
-+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
++void tcg_gen_smin_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
-+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
++{
-         TCGv_i64 tcg_res = tcg_temp_new_i64();
++    tcg_gen_movcond_i64(TCG_COND_LT, ret, a, b, a, b);
++}
--        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
++
--        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
++void tcg_gen_umin_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
--
++{
-         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
++    tcg_gen_movcond_i64(TCG_COND_LTU, ret, a, b, a, b);
-         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
++}
++
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
++void tcg_gen_smax_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
++{
-     fpst = get_fpstatus_ptr(true);
++    tcg_gen_movcond_i64(TCG_COND_LT, ret, a, b, b, a);
++}
--    tcg_op1 = tcg_temp_new_i32();
++
--    tcg_op2 = tcg_temp_new_i32();
++void tcg_gen_umax_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
-+    tcg_op1 = read_fp_hreg(s, rn);
++{
-+    tcg_op2 = read_fp_hreg(s, rm);
++    tcg_gen_movcond_i64(TCG_COND_LTU, ret, a, b, b, a);
-     tcg_res = tcg_temp_new_i32();
++}
++
--    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+ /* Size changing operations.  */
--    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
--
+ void tcg_gen_extrl_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
      if (is_scalar) {
 -        TCGv_i32 tcg_op = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
          TCGv_i32 tcg_res = tcg_temp_new_i32();
 -        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
          switch (fpop) {
          case 0x1a: /* FCVTNS */
          case 0x1b: /* FCVTMS */
 --
 .17.0

-[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+[Qemu-devel] [PULL 09/21] target/arm: Use new min/max expanders
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We are meant to explicitly pass fpst, not cpu_env.
+The generic expanders replace nearly identical code in the translator.
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180508151437.4232-3-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 3 ++-
+ target/arm/translate-a64.c | 46 ++++++++++++--------------------------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 14 insertions(+), 32 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_across_lanes(DisasContext *s, uint32_t insn)
-         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
+                 tcg_gen_add_i64(tcg_res, tcg_res, tcg_elt);
-         break;
+                 break;
-     case 0x3: /* FSQRT */
+             case 0x0a: /* SMAXV / UMAXV */
--        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+-                tcg_gen_movcond_i64(is_u ? TCG_COND_GEU : TCG_COND_GE,
-+        fpst = get_fpstatus_ptr(true);
+-                                    tcg_res,
-+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
+-                                    tcg_res, tcg_elt, tcg_res, tcg_elt);
-         break;
++                if (is_u) {
-     case 0x8: /* FRINTN */
++                    tcg_gen_umax_i64(tcg_res, tcg_res, tcg_elt);
-     case 0x9: /* FRINTP */
++                } else {
 +                    tcg_gen_smax_i64(tcg_res, tcg_res, tcg_elt);
 +                }
                  break;
              case 0x1a: /* SMINV / UMINV */
 -                tcg_gen_movcond_i64(is_u ? TCG_COND_LEU : TCG_COND_LE,
 -                                    tcg_res,
 -                                    tcg_res, tcg_elt, tcg_res, tcg_elt);
 -                break;
 +                if (is_u) {
 +                    tcg_gen_umin_i64(tcg_res, tcg_res, tcg_elt);
 +                } else {
 +                    tcg_gen_smin_i64(tcg_res, tcg_res, tcg_elt);
 +                }
                  break;
              default:
                  g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_logic(DisasContext *s, uint32_t insn)
      }
  }
 -/* Helper functions for 32 bit comparisons */
 -static void gen_max_s32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
 -{
 -    tcg_gen_movcond_i32(TCG_COND_GE, res, op1, op2, op1, op2);
 -}
 -
 -static void gen_max_u32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
 -{
 -    tcg_gen_movcond_i32(TCG_COND_GEU, res, op1, op2, op1, op2);
 -}
 -
 -static void gen_min_s32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
 -{
 -    tcg_gen_movcond_i32(TCG_COND_LE, res, op1, op2, op1, op2);
 -}
 -
 -static void gen_min_u32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
 -{
 -    tcg_gen_movcond_i32(TCG_COND_LEU, res, op1, op2, op1, op2);
 -}
 -
  /* Pairwise op subgroup of C3.6.16.
   *
   * This is called directly or via the handle_3same_float for float pairwise
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
                  static NeonGenTwoOpFn * const fns[3][2] = {
                      { gen_helper_neon_pmax_s8, gen_helper_neon_pmax_u8 },
                      { gen_helper_neon_pmax_s16, gen_helper_neon_pmax_u16 },
 -                    { gen_max_s32, gen_max_u32 },
 +                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
                  };
                  genfn = fns[size][u];
                  break;
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
                  static NeonGenTwoOpFn * const fns[3][2] = {
                      { gen_helper_neon_pmin_s8, gen_helper_neon_pmin_u8 },
                      { gen_helper_neon_pmin_s16, gen_helper_neon_pmin_u16 },
 -                    { gen_min_s32, gen_min_u32 },
 +                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
                  };
                  genfn = fns[size][u];
                  break;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                  static NeonGenTwoOpFn * const fns[3][2] = {
                      { gen_helper_neon_max_s8, gen_helper_neon_max_u8 },
                      { gen_helper_neon_max_s16, gen_helper_neon_max_u16 },
 -                    { gen_max_s32, gen_max_u32 },
 +                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
                  };
                  genfn = fns[size][u];
                  break;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                  static NeonGenTwoOpFn * const fns[3][2] = {
                      { gen_helper_neon_min_s8, gen_helper_neon_min_u8 },
                      { gen_helper_neon_min_s16, gen_helper_neon_min_u16 },
 -                    { gen_min_s32, gen_min_u32 },
 +                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
                  };
                  genfn = fns[size][u];
                  break;
 --
 .17.0

-[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
+[Qemu-devel] [PULL 10/21] target/xtensa: Use new min/max expanders
 From: Richard Henderson <richard.henderson@linaro.org>
-We missed all of the scalar fp16 fma operations.
+The generic expanders replace nearly identical code in the translator.
-Cc: qemu-stable@nongnu.org
+Acked-by: Max Filippov <jcmvbkbc@gmail.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180508151437.4232-4-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
+ target/xtensa/translate.c | 50 ++++++++++++++++++++++++++-------------
-file changed, 48 insertions(+)
+file changed, 33 insertions(+), 17 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/xtensa/translate.c
-+++ b/target/arm/translate-a64.c
++++ b/target/xtensa/translate.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
+@@ -XXX,XX +XXX,XX @@ static void translate_clamps(DisasContext *dc, const uint32_t arg[],
-     tcg_temp_free_i64(tcg_res);
+         TCGv_i32 tmp1 = tcg_const_i32(-1u << arg[2]);
          TCGv_i32 tmp2 = tcg_const_i32((1 << arg[2]) - 1);
 -        tcg_gen_movcond_i32(TCG_COND_GT, tmp1,
 -                            cpu_R[arg[1]], tmp1, cpu_R[arg[1]], tmp1);
 -        tcg_gen_movcond_i32(TCG_COND_LT, cpu_R[arg[0]],
 -                            tmp1, tmp2, tmp1, tmp2);
 +        tcg_gen_smax_i32(tmp1, tmp1, cpu_R[arg[1]]);
 +        tcg_gen_smin_i32(cpu_R[arg[0]], tmp1, tmp2);
          tcg_temp_free(tmp1);
          tcg_temp_free(tmp2);
      }
@@ -XXX,XX +XXX,XX @@ static void translate_memw(DisasContext *dc, const uint32_t arg[],
      tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
  }
-+/* Floating-point data-processing (3 source) - half precision */
+-static void translate_minmax(DisasContext *dc, const uint32_t arg[],
-+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+-                             const uint32_t par[])
-+                                int rd, int rn, int rm, int ra)
++static void translate_smin(DisasContext *dc, const uint32_t arg[],
-+{
++                           const uint32_t par[])
-+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+ {
-+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+     if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+-        tcg_gen_movcond_i32(par[0], cpu_R[arg[0]],
-+
+-                            cpu_R[arg[1]], cpu_R[arg[2]],
-+    tcg_op1 = read_fp_hreg(s, rn);
+-                            cpu_R[arg[1]], cpu_R[arg[2]]);
-+    tcg_op2 = read_fp_hreg(s, rm);
++        tcg_gen_smin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
 +    tcg_op3 = read_fp_hreg(s, ra);
 +
 +    /* These are fused multiply-add, and must be done as one
 +     * floating point operation with no rounding between the
 +     * multiplication and addition steps.
 +     * NB that doing the negations here as separate steps is
 +     * correct : an input NaN should come out with its sign bit
 +     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
-+
-+    if (o0 != o1) {
-+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
-+    }
-+
-+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
-+
-+    write_fp_sreg(s, rd, tcg_res);
-+
-+    tcg_temp_free_ptr(fpst);
-+    tcg_temp_free_i32(tcg_op1);
-+    tcg_temp_free_i32(tcg_op2);
-+    tcg_temp_free_i32(tcg_op3);
-+    tcg_temp_free_i32(tcg_res);
 +}
 +
- /* Floating point data-processing (3 source)
++static void translate_umin(DisasContext *dc, const uint32_t arg[],
-  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
++                           const uint32_t par[])
-  * +---+---+---+-----------+------+----+------+----+------+------+------+
++{
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
++    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-         }
++        tcg_gen_umin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
++    }
-         break;
++}
-+    case 3:
++
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++static void translate_smax(DisasContext *dc, const uint32_t arg[],
-+            unallocated_encoding(s);
++                           const uint32_t par[])
-+            return;
++{
-+        }
++    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-+        if (!fp_access_check(s)) {
++        tcg_gen_smax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
-+            return;
++    }
-+        }
++}
-+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
++
-+        break;
++static void translate_umax(DisasContext *dc, const uint32_t arg[],
-     default:
++                           const uint32_t par[])
-         unallocated_encoding(s);
++{
 +    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
 +        tcg_gen_umax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
      }
+ }
+@@ -XXX,XX +XXX,XX @@ static const XtensaOpcodeOps core_ops[] = {
+         .par = (const uint32_t[]){TCG_COND_NE},
+     }, {
+         .name = "max",
+-        .translate = translate_minmax,
+-        .par = (const uint32_t[]){TCG_COND_GE},
++        .translate = translate_smax,
+     }, {
+         .name = "maxu",
+-        .translate = translate_minmax,
+-        .par = (const uint32_t[]){TCG_COND_GEU},
++        .translate = translate_umax,
+     }, {
+         .name = "memw",
+         .translate = translate_memw,
+     }, {
+         .name = "min",
+-        .translate = translate_minmax,
+-        .par = (const uint32_t[]){TCG_COND_LT},
++        .translate = translate_smin,
+     }, {
+         .name = "minu",
+-        .translate = translate_minmax,
+-        .par = (const uint32_t[]){TCG_COND_LTU},
++        .translate = translate_umin,
+     }, {
+         .name = "mov",
+         .translate = translate_mov,
 --
 .17.0

-New patch
+[Qemu-devel] [PULL 11/21] tcg: Introduce atomic helpers for integer min/max
+From: Richard Henderson <richard.henderson@linaro.org>
 Given that this atomic operation will be used by both risc-v
 and aarch64, let's not duplicate code across the two targets.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180508151437.4232-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  accel/tcg/atomic_template.h | 71 +++++++++++++++++++++++++++++++++++++
  accel/tcg/tcg-runtime.h     |  8 +++++
  tcg/tcg-op.h                | 34 ++++++++++++++++++
  tcg/tcg.h                   |  8 +++++
  tcg/tcg-op.c                |  8 +++++
 files changed, 129 insertions(+)
 diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/atomic_template.h
 +++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@
  #elif DATA_SIZE == 8
  # define SUFFIX     q
  # define DATA_TYPE  uint64_t
 +# define SDATA_TYPE int64_t
  # define BSWAP      bswap64
  #elif DATA_SIZE == 4
  # define SUFFIX     l
  # define DATA_TYPE  uint32_t
 +# define SDATA_TYPE int32_t
  # define BSWAP      bswap32
  #elif DATA_SIZE == 2
  # define SUFFIX     w
  # define DATA_TYPE  uint16_t
 +# define SDATA_TYPE int16_t
  # define BSWAP      bswap16
  #elif DATA_SIZE == 1
  # define SUFFIX     b
  # define DATA_TYPE  uint8_t
 +# define SDATA_TYPE int8_t
  # define BSWAP
  #else
  # error unsupported data size
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(or_fetch)
  GEN_ATOMIC_HELPER(xor_fetch)
  #undef GEN_ATOMIC_HELPER
 +
 +/* These helpers are, as a whole, full barriers.  Within the helper,
 + * the leading barrier is explicit and the trailing barrier is within
 + * cmpxchg primitive.
 + */
 +#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
 +ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
 +                        ABI_TYPE xval EXTRA_ARGS)                   \
 +{                                                                   \
 +    ATOMIC_MMU_DECLS;                                               \
 +    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
 +    XDATA_TYPE cmp, old, new, val = xval;                           \
 +    smp_mb();                                                       \
 +    cmp = atomic_read__nocheck(haddr);                              \
 +    do {                                                            \
 +        old = cmp; new = FN(old, val);                              \
 +        cmp = atomic_cmpxchg__nocheck(haddr, old, new);             \
 +    } while (cmp != old);                                           \
 +    ATOMIC_MMU_CLEANUP;                                             \
 +    return RET;                                                     \
 +}
 +
 +GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
 +
 +GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 +
 +#undef GEN_ATOMIC_HELPER_FN
  #endif /* DATA SIZE >= 16 */
  #undef END
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
          ldo = ldn;
      }
  }
 +
 +/* These helpers are, as a whole, full barriers.  Within the helper,
 + * the leading barrier is explicit and the trailing barrier is within
 + * cmpxchg primitive.
 + */
 +#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
 +ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
 +                        ABI_TYPE xval EXTRA_ARGS)                   \
 +{                                                                   \
 +    ATOMIC_MMU_DECLS;                                               \
 +    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
 +    XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
 +    smp_mb();                                                       \
 +    ldn = atomic_read__nocheck(haddr);                              \
 +    do {                                                            \
 +        ldo = ldn; old = BSWAP(ldo); new = FN(old, val);            \
 +        ldn = atomic_cmpxchg__nocheck(haddr, ldo, BSWAP(new));      \
 +    } while (ldo != ldn);                                           \
 +    ATOMIC_MMU_CLEANUP;                                             \
 +    return RET;                                                     \
 +}
 +
 +GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
 +
 +GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 +GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 +
 +#undef GEN_ATOMIC_HELPER_FN
  #endif /* DATA_SIZE >= 16 */
  #undef END
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
  #undef BSWAP
  #undef ABI_TYPE
  #undef DATA_TYPE
 +#undef SDATA_TYPE
  #undef SUFFIX
  #undef DATA_SIZE
 diff --git a/accel/tcg/tcg-runtime.h b/accel/tcg/tcg-runtime.h
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/tcg-runtime.h
 +++ b/accel/tcg/tcg-runtime.h
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPERS(fetch_add)
  GEN_ATOMIC_HELPERS(fetch_and)
  GEN_ATOMIC_HELPERS(fetch_or)
  GEN_ATOMIC_HELPERS(fetch_xor)
 +GEN_ATOMIC_HELPERS(fetch_smin)
 +GEN_ATOMIC_HELPERS(fetch_umin)
 +GEN_ATOMIC_HELPERS(fetch_smax)
 +GEN_ATOMIC_HELPERS(fetch_umax)
  GEN_ATOMIC_HELPERS(add_fetch)
  GEN_ATOMIC_HELPERS(and_fetch)
  GEN_ATOMIC_HELPERS(or_fetch)
  GEN_ATOMIC_HELPERS(xor_fetch)
 +GEN_ATOMIC_HELPERS(smin_fetch)
 +GEN_ATOMIC_HELPERS(umin_fetch)
 +GEN_ATOMIC_HELPERS(smax_fetch)
 +GEN_ATOMIC_HELPERS(umax_fetch)
  GEN_ATOMIC_HELPERS(xchg)
 diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.h
 +++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGv_i64,
  void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +
  void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
  void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
  void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +
  void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
  void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
  void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
  void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 +void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
  void tcg_gen_mov_vec(TCGv_vec, TCGv_vec);
  void tcg_gen_dup_i32_vec(unsigned vece, TCGv_vec, TCGv_i32);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
  #define tcg_gen_atomic_fetch_and_tl tcg_gen_atomic_fetch_and_i64
  #define tcg_gen_atomic_fetch_or_tl tcg_gen_atomic_fetch_or_i64
  #define tcg_gen_atomic_fetch_xor_tl tcg_gen_atomic_fetch_xor_i64
 +#define tcg_gen_atomic_fetch_smin_tl tcg_gen_atomic_fetch_smin_i64
 +#define tcg_gen_atomic_fetch_umin_tl tcg_gen_atomic_fetch_umin_i64
 +#define tcg_gen_atomic_fetch_smax_tl tcg_gen_atomic_fetch_smax_i64
 +#define tcg_gen_atomic_fetch_umax_tl tcg_gen_atomic_fetch_umax_i64
  #define tcg_gen_atomic_add_fetch_tl tcg_gen_atomic_add_fetch_i64
  #define tcg_gen_atomic_and_fetch_tl tcg_gen_atomic_and_fetch_i64
  #define tcg_gen_atomic_or_fetch_tl tcg_gen_atomic_or_fetch_i64
  #define tcg_gen_atomic_xor_fetch_tl tcg_gen_atomic_xor_fetch_i64
 +#define tcg_gen_atomic_smin_fetch_tl tcg_gen_atomic_smin_fetch_i64
 +#define tcg_gen_atomic_umin_fetch_tl tcg_gen_atomic_umin_fetch_i64
 +#define tcg_gen_atomic_smax_fetch_tl tcg_gen_atomic_smax_fetch_i64
 +#define tcg_gen_atomic_umax_fetch_tl tcg_gen_atomic_umax_fetch_i64
  #define tcg_gen_dup_tl_vec  tcg_gen_dup_i64_vec
  #else
  #define tcg_gen_movi_tl tcg_gen_movi_i32
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
  #define tcg_gen_atomic_fetch_and_tl tcg_gen_atomic_fetch_and_i32
  #define tcg_gen_atomic_fetch_or_tl tcg_gen_atomic_fetch_or_i32
  #define tcg_gen_atomic_fetch_xor_tl tcg_gen_atomic_fetch_xor_i32
 +#define tcg_gen_atomic_fetch_smin_tl tcg_gen_atomic_fetch_smin_i32
 +#define tcg_gen_atomic_fetch_umin_tl tcg_gen_atomic_fetch_umin_i32
 +#define tcg_gen_atomic_fetch_smax_tl tcg_gen_atomic_fetch_smax_i32
 +#define tcg_gen_atomic_fetch_umax_tl tcg_gen_atomic_fetch_umax_i32
  #define tcg_gen_atomic_add_fetch_tl tcg_gen_atomic_add_fetch_i32
  #define tcg_gen_atomic_and_fetch_tl tcg_gen_atomic_and_fetch_i32
  #define tcg_gen_atomic_or_fetch_tl tcg_gen_atomic_or_fetch_i32
  #define tcg_gen_atomic_xor_fetch_tl tcg_gen_atomic_xor_fetch_i32
 +#define tcg_gen_atomic_smin_fetch_tl tcg_gen_atomic_smin_fetch_i32
 +#define tcg_gen_atomic_umin_fetch_tl tcg_gen_atomic_umin_fetch_i32
 +#define tcg_gen_atomic_smax_fetch_tl tcg_gen_atomic_smax_fetch_i32
 +#define tcg_gen_atomic_umax_fetch_tl tcg_gen_atomic_umax_fetch_i32
  #define tcg_gen_dup_tl_vec  tcg_gen_dup_i32_vec
  #endif
 diff --git a/tcg/tcg.h b/tcg/tcg.h
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg.h
 +++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER_ALL(fetch_sub)
  GEN_ATOMIC_HELPER_ALL(fetch_and)
  GEN_ATOMIC_HELPER_ALL(fetch_or)
  GEN_ATOMIC_HELPER_ALL(fetch_xor)
 +GEN_ATOMIC_HELPER_ALL(fetch_smin)
 +GEN_ATOMIC_HELPER_ALL(fetch_umin)
 +GEN_ATOMIC_HELPER_ALL(fetch_smax)
 +GEN_ATOMIC_HELPER_ALL(fetch_umax)
  GEN_ATOMIC_HELPER_ALL(add_fetch)
  GEN_ATOMIC_HELPER_ALL(sub_fetch)
  GEN_ATOMIC_HELPER_ALL(and_fetch)
  GEN_ATOMIC_HELPER_ALL(or_fetch)
  GEN_ATOMIC_HELPER_ALL(xor_fetch)
 +GEN_ATOMIC_HELPER_ALL(smin_fetch)
 +GEN_ATOMIC_HELPER_ALL(umin_fetch)
 +GEN_ATOMIC_HELPER_ALL(smax_fetch)
 +GEN_ATOMIC_HELPER_ALL(umax_fetch)
  GEN_ATOMIC_HELPER_ALL(xchg)
 diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tcg/tcg-op.c
 +++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(fetch_add, add, 0)
  GEN_ATOMIC_HELPER(fetch_and, and, 0)
  GEN_ATOMIC_HELPER(fetch_or, or, 0)
  GEN_ATOMIC_HELPER(fetch_xor, xor, 0)
 +GEN_ATOMIC_HELPER(fetch_smin, smin, 0)
 +GEN_ATOMIC_HELPER(fetch_umin, umin, 0)
 +GEN_ATOMIC_HELPER(fetch_smax, smax, 0)
 +GEN_ATOMIC_HELPER(fetch_umax, umax, 0)
  GEN_ATOMIC_HELPER(add_fetch, add, 1)
  GEN_ATOMIC_HELPER(and_fetch, and, 1)
  GEN_ATOMIC_HELPER(or_fetch, or, 1)
  GEN_ATOMIC_HELPER(xor_fetch, xor, 1)
 +GEN_ATOMIC_HELPER(smin_fetch, smin, 1)
 +GEN_ATOMIC_HELPER(umin_fetch, umin, 1)
 +GEN_ATOMIC_HELPER(smax_fetch, smax, 1)
 +GEN_ATOMIC_HELPER(umax_fetch, umax, 1)
  static void tcg_gen_mov2_i32(TCGv_i32 r, TCGv_i32 a, TCGv_i32 b)
  {
 --
 .17.0

-[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+[Qemu-devel] [PULL 12/21] tcg: Use GEN_ATOMIC_HELPER_FN for opposite endian atomic add
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Reported by Coverity (CID1390635). We ensure this for uint_to_float
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-later on so we might as well mirror that.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180508151437.4232-6-richard.henderson@linaro.org
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- fpu/softfloat.c | 2 +-
+ accel/tcg/atomic_template.h | 49 ++++++-------------------------------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 7 insertions(+), 42 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/accel/tcg/atomic_template.h
-+++ b/fpu/softfloat.c
++++ b/accel/tcg/atomic_template.h
-@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(xor_fetch)
- static FloatParts int_to_float(int64_t a, float_status *status)
+ #undef GEN_ATOMIC_HELPER
- {
--    FloatParts r;
+-/* Note that for addition, we need to use a separate cmpxchg loop instead
-+    FloatParts r = {};
+-   of bswaps for the reverse-host-endian helpers.  */
-     if (a == 0) {
+-ABI_TYPE ATOMIC_NAME(fetch_add)(CPUArchState *env, target_ulong addr,
-         r.cls = float_class_zero;
+-                         ABI_TYPE val EXTRA_ARGS)
-         r.sign = false;
+-{
 -    ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 -    DATA_TYPE ldo, ldn, ret, sto;
 -
 -    ldo = atomic_read__nocheck(haddr);
 -    while (1) {
 -        ret = BSWAP(ldo);
 -        sto = BSWAP(ret + val);
 -        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
 -        if (ldn == ldo) {
 -            ATOMIC_MMU_CLEANUP;
 -            return ret;
 -        }
 -        ldo = ldn;
 -    }
 -}
 -
 -ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
 -                         ABI_TYPE val EXTRA_ARGS)
 -{
 -    ATOMIC_MMU_DECLS;
 -    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
 -    DATA_TYPE ldo, ldn, ret, sto;
 -
 -    ldo = atomic_read__nocheck(haddr);
 -    while (1) {
 -        ret = BSWAP(ldo) + val;
 -        sto = BSWAP(ret);
 -        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
 -        if (ldn == ldo) {
 -            ATOMIC_MMU_CLEANUP;
 -            return ret;
 -        }
 -        ldo = ldn;
 -    }
 -}
 -
  /* These helpers are, as a whole, full barriers.  Within the helper,
   * the leading barrier is explicit and the trailing barrier is within
   * cmpxchg primitive.
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
  GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
  GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 +/* Note that for addition, we need to use a separate cmpxchg loop instead
 +   of bswaps for the reverse-host-endian helpers.  */
 +#define ADD(X, Y)   (X + Y)
 +GEN_ATOMIC_HELPER_FN(fetch_add, ADD, DATA_TYPE, old)
 +GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
 +#undef ADD
 +
  #undef GEN_ATOMIC_HELPER_FN
  #endif /* DATA_SIZE >= 16 */
 --
 .17.0

-[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+[Qemu-devel] [PULL 13/21] target/riscv: Use new atomic min/max expanders
 From: Richard Henderson <richard.henderson@linaro.org>
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Michael Clark <mjc@sifive.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180508151437.4232-7-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 17 +++++++++++++++--
+ target/riscv/translate.c | 72 +++++++++++-----------------------------
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 20 insertions(+), 52 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/riscv/translate.c b/target/riscv/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/riscv/translate.c
-+++ b/target/arm/translate-a64.c
++++ b/target/riscv/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_atomic(DisasContext *ctx, uint32_t opc,
-     bool sf = extract32(insn, 31, 1);
+     TCGv src1, src2, dat;
-     bool itof;
+     TCGLabel *l1, *l2;
+     TCGMemOp mop;
--    if (sbit || (type > 1)
+-    TCGCond cond;
--        || (!sf && scale < 32)) {
+     bool aq, rl;
-+    if (sbit || (!sf && scale < 32)) {
-+        unallocated_encoding(s);
+     /* Extract the size of the atomic operation.  */
-+        return;
+@@ -XXX,XX +XXX,XX @@ static void gen_atomic(DisasContext *ctx, uint32_t opc,
-+    }
+         tcg_gen_atomic_fetch_or_tl(src2, src1, src2, ctx->mem_idx, mop);
-+
+         gen_set_gpr(rd, src2);
-+    switch (type) {
+         break;
-+    case 0: /* float32 */
+-
-+    case 1: /* float64 */
+     case OPC_RISC_AMOMIN:
 -        cond = TCG_COND_LT;
 -        goto do_minmax;
 -    case OPC_RISC_AMOMAX:
 -        cond = TCG_COND_GT;
 -        goto do_minmax;
 -    case OPC_RISC_AMOMINU:
 -        cond = TCG_COND_LTU;
 -        goto do_minmax;
 -    case OPC_RISC_AMOMAXU:
 -        cond = TCG_COND_GTU;
 -        goto do_minmax;
 -    do_minmax:
 -        /* Handle the RL barrier.  The AQ barrier is handled along the
 -           parallel path by the SC atomic cmpxchg.  On the serial path,
 -           of course, barriers do not matter.  */
 -        if (rl) {
 -            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 -        }
 -        if (tb_cflags(ctx->tb) & CF_PARALLEL) {
 -            l1 = gen_new_label();
 -            gen_set_label(l1);
 -        } else {
 -            l1 = NULL;
 -        }
 -
          gen_get_gpr(src1, rs1);
          gen_get_gpr(src2, rs2);
 -        if ((mop & MO_SSIZE) == MO_SL) {
 -            /* Sign-extend the register comparison input.  */
 -            tcg_gen_ext32s_tl(src2, src2);
 -        }
 -        dat = tcg_temp_local_new();
 -        tcg_gen_qemu_ld_tl(dat, src1, ctx->mem_idx, mop);
 -        tcg_gen_movcond_tl(cond, src2, dat, src2, dat, src2);
 -
 -        if (tb_cflags(ctx->tb) & CF_PARALLEL) {
 -            /* Parallel context.  Make this operation atomic by verifying
 -               that the memory didn't change while we computed the result.  */
 -            tcg_gen_atomic_cmpxchg_tl(src2, src1, dat, src2, ctx->mem_idx, mop);
 -
 -            /* If the cmpxchg failed, retry. */
 -            /* ??? There is an assumption here that this will eventually
 -               succeed, such that we don't live-lock.  This is not unlike
 -               a similar loop that the compiler would generate for e.g.
 -               __atomic_fetch_and_xor, so don't worry about it.  */
 -            tcg_gen_brcond_tl(TCG_COND_NE, dat, src2, l1);
 -        } else {
 -            /* Serial context.  Directly store the result.  */
 -            tcg_gen_qemu_st_tl(src2, src1, ctx->mem_idx, mop);
 -        }
 -        gen_set_gpr(rd, dat);
 -        tcg_temp_free(dat);
 +        tcg_gen_atomic_fetch_smin_tl(src2, src1, src2, ctx->mem_idx, mop);
 +        gen_set_gpr(rd, src2);
 +        break;
-+    case 3: /* float16 */
++    case OPC_RISC_AMOMAX:
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++        gen_get_gpr(src1, rs1);
-+            break;
++        gen_get_gpr(src2, rs2);
-+        }
++        tcg_gen_atomic_fetch_smax_tl(src2, src1, src2, ctx->mem_idx, mop);
-+        /* fallthru */
++        gen_set_gpr(rd, src2);
-+    default:
++        break;
-         unallocated_encoding(s);
++    case OPC_RISC_AMOMINU:
-         return;
++        gen_get_gpr(src1, rs1);
-     }
++        gen_get_gpr(src2, rs2);
 +        tcg_gen_atomic_fetch_umin_tl(src2, src1, src2, ctx->mem_idx, mop);
 +        gen_set_gpr(rd, src2);
 +        break;
 +    case OPC_RISC_AMOMAXU:
 +        gen_get_gpr(src1, rs1);
 +        gen_get_gpr(src2, rs2);
 +        tcg_gen_atomic_fetch_umax_tl(src2, src1, src2, ctx->mem_idx, mop);
 +        gen_set_gpr(rd, src2);
          break;
      default:
 --
 .17.0

-[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+[Qemu-devel] [PULL 14/21] target/arm: Introduce ARM_FEATURE_V8_ATOMICS and initial decode
 From: Richard Henderson <richard.henderson@linaro.org>
-No sense in emitting code after the exception.
+The insns in the ARMv8.1-Atomics are added to the existing
 load/store exclusive and load/store reg opcode spaces.
 Rearrange the top-level decoders for these to accomodate.
 The Atomics insns themselves still generate Unallocated.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180508151437.4232-8-richard.henderson@linaro.org
-Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
+[PMM: Drop the ARM_FEATURE_V8_1 feature flag]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ target/arm/cpu.h           |   1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ linux-user/elfload.c       |   1 +
+ target/arm/translate-a64.c | 182 +++++++++++++++++++++++++++----------
 files changed, 138 insertions(+), 46 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
      ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
      ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */
      ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
 +    ARM_FEATURE_V8_ATOMICS, /* ARMv8.1-Atomics feature */
      ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
      ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
      ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions.  */
 diff --git a/linux-user/elfload.c b/linux-user/elfload.c
 index XXXXXXX..XXXXXXX 100644
 --- a/linux-user/elfload.c
 +++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
      GET_FEATURE(ARM_FEATURE_V8_SHA512, ARM_HWCAP_A64_SHA512);
      GET_FEATURE(ARM_FEATURE_V8_FP16,
                  ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
 +    GET_FEATURE(ARM_FEATURE_V8_ATOMICS, ARM_HWCAP_A64_ATOMICS);
      GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
      GET_FEATURE(ARM_FEATURE_V8_FCMA, ARM_HWCAP_A64_FCMA);
  #undef GET_FEATURE
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
-         default:
+     int rt = extract32(insn, 0, 5);
-             /* all other sf/type/rmode combinations are invalid */
+     int rn = extract32(insn, 5, 5);
-             unallocated_encoding(s);
+     int rt2 = extract32(insn, 10, 5);
--            break;
+-    int is_lasr = extract32(insn, 15, 1);
-+            return;
+     int rs = extract32(insn, 16, 5);
 -    int is_pair = extract32(insn, 21, 1);
 -    int is_store = !extract32(insn, 22, 1);
 -    int is_excl = !extract32(insn, 23, 1);
 +    int is_lasr = extract32(insn, 15, 1);
 +    int o2_L_o1_o0 = extract32(insn, 21, 3) * 2 | is_lasr;
      int size = extract32(insn, 30, 2);
      TCGv_i64 tcg_addr;
 -    if ((!is_excl && !is_pair && !is_lasr) ||
 -        (!is_excl && is_pair) ||
 -        (is_pair && size < 2)) {
 -        unallocated_encoding(s);
 +    switch (o2_L_o1_o0) {
 +    case 0x0: /* STXR */
 +    case 0x1: /* STLXR */
 +        if (rn == 31) {
 +            gen_check_sp_alignment(s);
 +        }
 +        if (is_lasr) {
 +            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 +        }
 +        tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +        gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, false);
          return;
 -    }
 -    if (rn == 31) {
 -        gen_check_sp_alignment(s);
 -    }
 -    tcg_addr = read_cpu_reg_sp(s, rn, 1);
 -
 -    /* Note that since TCG is single threaded load-acquire/store-release
 -     * semantics require no extra if (is_lasr) { ... } handling.
 -     */
 -
 -    if (is_excl) {
 -        if (!is_store) {
 -            s->is_ldex = true;
 -            gen_load_exclusive(s, rt, rt2, tcg_addr, size, is_pair);
 -            if (is_lasr) {
 -                tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 -            }
 -        } else {
 -            if (is_lasr) {
 -                tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 -            }
 -            gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, is_pair);
 +    case 0x4: /* LDXR */
 +    case 0x5: /* LDAXR */
 +        if (rn == 31) {
 +            gen_check_sp_alignment(s);
          }
+-    } else {
-         if (!fp_access_check(s)) {
+-        TCGv_i64 tcg_rt = cpu_reg(s, rt);
 -        bool iss_sf = disas_ldst_compute_iss_sf(size, false, 0);
 +        tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +        s->is_ldex = true;
 +        gen_load_exclusive(s, rt, rt2, tcg_addr, size, false);
 +        if (is_lasr) {
 +            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 +        }
 +        return;
 +    case 0x9: /* STLR */
          /* Generate ISS for non-exclusive accesses including LASR.  */
 -        if (is_store) {
 +        if (rn == 31) {
 +            gen_check_sp_alignment(s);
 +        }
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 +        tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +        do_gpr_st(s, cpu_reg(s, rt), tcg_addr, size, true, rt,
 +                  disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
 +        return;
 +
 +    case 0xd: /* LDAR */
 +        /* Generate ISS for non-exclusive accesses including LASR.  */
 +        if (rn == 31) {
 +            gen_check_sp_alignment(s);
 +        }
 +        tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +        do_gpr_ld(s, cpu_reg(s, rt), tcg_addr, size, false, false, true, rt,
 +                  disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 +        return;
 +
 +    case 0x2: case 0x3: /* CASP / STXP */
 +        if (size & 2) { /* STXP / STLXP */
 +            if (rn == 31) {
 +                gen_check_sp_alignment(s);
 +            }
              if (is_lasr) {
                  tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
              }
 -            do_gpr_st(s, tcg_rt, tcg_addr, size,
 -                      true, rt, iss_sf, is_lasr);
 -        } else {
 -            do_gpr_ld(s, tcg_rt, tcg_addr, size, false, false,
 -                      true, rt, iss_sf, is_lasr);
 +            tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +            gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, true);
 +            return;
 +        }
 +        /* CASP / CASPL */
 +        break;
 +
 +    case 0x6: case 0x7: /* CASP / LDXP */
 +        if (size & 2) { /* LDXP / LDAXP */
 +            if (rn == 31) {
 +                gen_check_sp_alignment(s);
 +            }
 +            tcg_addr = read_cpu_reg_sp(s, rn, 1);
 +            s->is_ldex = true;
 +            gen_load_exclusive(s, rt, rt2, tcg_addr, size, true);
              if (is_lasr) {
                  tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
              }
 +            return;
          }
 +        /* CASPA / CASPAL */
 +        break;
 +
 +    case 0xa: /* CAS */
 +    case 0xb: /* CASL */
 +    case 0xe: /* CASA */
 +    case 0xf: /* CASAL */
 +        break;
      }
 +    unallocated_encoding(s);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_unsigned_imm(DisasContext *s, uint32_t insn,
      }
  }
 +/* Atomic memory operations
 + *
 + *  31  30      27  26    24    22  21   16   15    12    10    5     0
 + * +------+-------+---+-----+-----+---+----+----+-----+-----+----+-----+
 + * | size | 1 1 1 | V | 0 0 | A R | 1 | Rs | o3 | opc | 0 0 | Rn |  Rt |
 + * +------+-------+---+-----+-----+--------+----+-----+-----+----+-----+
 + *
 + * Rt: the result register
 + * Rn: base address or SP
 + * Rs: the source register for the operation
 + * V: vector flag (always 0 as of v8.3)
 + * A: acquire flag
 + * R: release flag
 + */
 +static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
 +                              int size, int rt, bool is_vector)
 +{
 +    int rs = extract32(insn, 16, 5);
 +    int rn = extract32(insn, 5, 5);
 +    int o3_opc = extract32(insn, 12, 4);
 +    int feature = ARM_FEATURE_V8_ATOMICS;
 +
 +    if (is_vector) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +    switch (o3_opc) {
 +    case 000: /* LDADD */
 +    case 001: /* LDCLR */
 +    case 002: /* LDEOR */
 +    case 003: /* LDSET */
 +    case 004: /* LDSMAX */
 +    case 005: /* LDSMIN */
 +    case 006: /* LDUMAX */
 +    case 007: /* LDUMIN */
 +    case 010: /* SWP */
 +    default:
 +        unallocated_encoding(s);
 +        return;
 +    }
 +    if (!arm_dc_feature(s, feature)) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    (void)rs;
 +    (void)rn;
 +}
 +
  /* Load/store register (all forms) */
  static void disas_ldst_reg(DisasContext *s, uint32_t insn)
  {
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg(DisasContext *s, uint32_t insn)
      switch (extract32(insn, 24, 2)) {
      case 0:
 -        if (extract32(insn, 21, 1) == 1 && extract32(insn, 10, 2) == 2) {
 -            disas_ldst_reg_roffset(s, insn, opc, size, rt, is_vector);
 -        } else {
 +        if (extract32(insn, 21, 1) == 0) {
              /* Load/store register (unscaled immediate)
               * Load/store immediate pre/post-indexed
               * Load/store register unprivileged
               */
              disas_ldst_reg_imm9(s, insn, opc, size, rt, is_vector);
 +            return;
 +        }
 +        switch (extract32(insn, 10, 2)) {
 +        case 0:
 +            disas_ldst_atomic(s, insn, size, rt, is_vector);
 +            return;
 +        case 2:
 +            disas_ldst_reg_roffset(s, insn, opc, size, rt, is_vector);
 +            return;
          }
          break;
      case 1:
          disas_ldst_reg_unsigned_imm(s, insn, opc, size, rt, is_vector);
 -        break;
 -    default:
 -        unallocated_encoding(s);
 -        break;
 +        return;
      }
 +    unallocated_encoding(s);
  }
  /* AdvSIMD load/store multiple structures
 --
 .17.0

-[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+[Qemu-devel] [PULL 15/21] target/arm: Fill in disas_ldst_atomic
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-All the hard work is already done by vfp_expand_imm, we just need to
+This implements all of the v8.1-Atomics instructions except
-make sure we pick up the correct size.
+for compare-and-swap, which is decoded elsewhere.
-Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
+Message-id: 20180508151437.4232-9-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 20 +++++++++++++++++---
+ target/arm/translate-a64.c | 38 ++++++++++++++++++++++++++++++++++++--
-file changed, 17 insertions(+), 3 deletions(-)
+file changed, 36 insertions(+), 2 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
- {
+ typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
-     int rd = extract32(insn, 0, 5);
+ typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
-     int imm8 = extract32(insn, 13, 8);
+ typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
--    int is_double = extract32(insn, 22, 2);
++typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, TCGMemOp);
-+    int type = extract32(insn, 22, 2);
-     uint64_t imm;
+ /* Note that the gvec expanders operate on offsets + sizes.  */
-     TCGv_i64 tcg_res;
+ typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
-+    TCGMemOp sz;
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
+     int rn = extract32(insn, 5, 5);
--    if (is_double > 1) {
+     int o3_opc = extract32(insn, 12, 4);
-+    switch (type) {
+     int feature = ARM_FEATURE_V8_ATOMICS;
-+    case 0:
++    TCGv_i64 tcg_rn, tcg_rs;
-+        sz = MO_32;
++    AtomicThreeOpFn *fn;
      if (is_vector) {
          unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
      }
      switch (o3_opc) {
      case 000: /* LDADD */
 +        fn = tcg_gen_atomic_fetch_add_i64;
 +        break;
-+    case 1:
+     case 001: /* LDCLR */
-+        sz = MO_64;
++        fn = tcg_gen_atomic_fetch_and_i64;
 +        break;
-+    case 3:
+     case 002: /* LDEOR */
-+        sz = MO_16;
++        fn = tcg_gen_atomic_fetch_xor_i64;
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++        break;
-+            break;
+     case 003: /* LDSET */
-+        }
++        fn = tcg_gen_atomic_fetch_or_i64;
-+        /* fallthru */
++        break;
-+    default:
+     case 004: /* LDSMAX */
 +        fn = tcg_gen_atomic_fetch_smax_i64;
 +        break;
      case 005: /* LDSMIN */
 +        fn = tcg_gen_atomic_fetch_smin_i64;
 +        break;
      case 006: /* LDUMAX */
 +        fn = tcg_gen_atomic_fetch_umax_i64;
 +        break;
      case 007: /* LDUMIN */
 +        fn = tcg_gen_atomic_fetch_umin_i64;
 +        break;
      case 010: /* SWP */
 +        fn = tcg_gen_atomic_xchg_i64;
 +        break;
      default:
          unallocated_encoding(s);
          return;
-     }
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
          return;
      }
--    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+-    (void)rs;
-+    imm = vfp_expand_imm(sz, imm8);
+-    (void)rn;
++    if (rn == 31) {
-     tcg_res = tcg_const_i64(imm);
++        gen_check_sp_alignment(s);
-     write_fp_dreg(s, rd, tcg_res);
++    }
 +    tcg_rn = cpu_reg_sp(s, rn);
 +    tcg_rs = read_cpu_reg(s, rs, true);
 +
 +    if (o3_opc == 1) { /* LDCLR */
 +        tcg_gen_not_i64(tcg_rs, tcg_rs);
 +    }
 +
 +    /* The tcg atomic primitives are all full barriers.  Therefore we
 +     * can ignore the Acquire and Release bits of this instruction.
 +     */
 +    fn(cpu_reg(s, rt), tcg_rn, tcg_rs, get_mem_index(s),
 +       s->be_data | size | MO_ALIGN);
  }
  /* Load/store register (all forms) */
 --
 .17.0

-[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+[Qemu-devel] [PULL 16/21] target/arm: Implement CAS and CASP
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
 These where missed out from the rest of the half-precision work.
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
+Message-id: 20180508151437.4232-10-richard.henderson@linaro.org
 [rth: Diagnose lack of FP16 before fp_access_check]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper-a64.h    |  2 +
+ target/arm/helper-a64.h    |   2 +
- target/arm/helper-a64.c    | 10 +++++
+ target/arm/helper-a64.c    |  43 ++++++++++++++
- target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
+ target/arm/translate-a64.c | 119 ++++++++++++++++++++++++++++++++++++-
-files changed, 83 insertions(+), 17 deletions(-)
+files changed, 161 insertions(+), 3 deletions(-)
 diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.h
 +++ b/target/arm/helper-a64.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(paired_cmpxchg64_le_parallel, TCG_CALL_NO_WG,
- DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ DEF_HELPER_FLAGS_4(paired_cmpxchg64_be, TCG_CALL_NO_WG, i64, env, i64, i64, i64)
- DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ DEF_HELPER_FLAGS_4(paired_cmpxchg64_be_parallel, TCG_CALL_NO_WG,
- DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+                    i64, env, i64, i64, i64)
-+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
++DEF_HELPER_5(casp_le_parallel, void, env, i32, i64, i64, i64)
-+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
++DEF_HELPER_5(casp_be_parallel, void, env, i32, i64, i64, i64)
- DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+ DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
- DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
+ DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
- DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
+ DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(paired_cmpxchg64_be_parallel)(CPUARMState *env, uint64_t addr,
-     return flags;
+     return do_paired_cmpxchg64_be(env, addr, new_lo, new_hi, true, GETPC());
  }
-+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
++/* Writes back the old data into Rs.  */
-+{
++void HELPER(casp_le_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
-+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
++                              uint64_t new_lo, uint64_t new_hi)
-+}
++{
-+
++    uintptr_t ra = GETPC();
-+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
++#ifndef CONFIG_ATOMIC128
-+{
++    cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
-+    return float_rel_to_flags(float16_compare(x, y, fp_status));
++#else
-+}
++    Int128 oldv, cmpv, newv;
 +
- uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
++    cmpv = int128_make128(env->xregs[rs], env->xregs[rs + 1]);
- {
++    newv = int128_make128(new_lo, new_hi);
-     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
++
 +    int mem_idx = cpu_mmu_index(env, false);
 +    TCGMemOpIdx oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
 +    oldv = helper_atomic_cmpxchgo_le_mmu(env, addr, cmpv, newv, oi, ra);
 +
 +    env->xregs[rs] = int128_getlo(oldv);
 +    env->xregs[rs + 1] = int128_gethi(oldv);
 +#endif
 +}
 +
 +void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
 +                              uint64_t new_hi, uint64_t new_lo)
 +{
 +    uintptr_t ra = GETPC();
 +#ifndef CONFIG_ATOMIC128
 +    cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
 +#else
 +    Int128 oldv, cmpv, newv;
 +
 +    cmpv = int128_make128(env->xregs[rs + 1], env->xregs[rs]);
 +    newv = int128_make128(new_lo, new_hi);
 +
 +    int mem_idx = cpu_mmu_index(env, false);
 +    TCGMemOpIdx oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
 +    oldv = helper_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);
 +
 +    env->xregs[rs + 1] = int128_getlo(oldv);
 +    env->xregs[rs] = int128_gethi(oldv);
 +#endif
 +}
 +
  /*
   * AdvSIMD half-precision
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
      tcg_gen_movi_i64(cpu_exclusive_addr, -1);
  }
 +static void gen_compare_and_swap(DisasContext *s, int rs, int rt,
 +                                 int rn, int size)
 +{
 +    TCGv_i64 tcg_rs = cpu_reg(s, rs);
 +    TCGv_i64 tcg_rt = cpu_reg(s, rt);
 +    int memidx = get_mem_index(s);
 +    TCGv_i64 addr = cpu_reg_sp(s, rn);
 +
 +    if (rn == 31) {
 +        gen_check_sp_alignment(s);
 +    }
 +    tcg_gen_atomic_cmpxchg_i64(tcg_rs, addr, tcg_rs, tcg_rt, memidx,
 +                               size | MO_ALIGN | s->be_data);
 +}
 +
 +static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
 +                                      int rn, int size)
 +{
 +    TCGv_i64 s1 = cpu_reg(s, rs);
 +    TCGv_i64 s2 = cpu_reg(s, rs + 1);
 +    TCGv_i64 t1 = cpu_reg(s, rt);
 +    TCGv_i64 t2 = cpu_reg(s, rt + 1);
 +    TCGv_i64 addr = cpu_reg_sp(s, rn);
 +    int memidx = get_mem_index(s);
 +
 +    if (rn == 31) {
 +        gen_check_sp_alignment(s);
 +    }
 +
 +    if (size == 2) {
 +        TCGv_i64 cmp = tcg_temp_new_i64();
 +        TCGv_i64 val = tcg_temp_new_i64();
 +
 +        if (s->be_data == MO_LE) {
 +            tcg_gen_concat32_i64(val, t1, t2);
 +            tcg_gen_concat32_i64(cmp, s1, s2);
 +        } else {
 +            tcg_gen_concat32_i64(val, t2, t1);
 +            tcg_gen_concat32_i64(cmp, s2, s1);
 +        }
 +
 +        tcg_gen_atomic_cmpxchg_i64(cmp, addr, cmp, val, memidx,
 +                                   MO_64 | MO_ALIGN | s->be_data);
 +        tcg_temp_free_i64(val);
 +
 +        if (s->be_data == MO_LE) {
 +            tcg_gen_extr32_i64(s1, s2, cmp);
 +        } else {
 +            tcg_gen_extr32_i64(s2, s1, cmp);
 +        }
 +        tcg_temp_free_i64(cmp);
 +    } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
 +        TCGv_i32 tcg_rs = tcg_const_i32(rs);
 +
 +        if (s->be_data == MO_LE) {
 +            gen_helper_casp_le_parallel(cpu_env, tcg_rs, addr, t1, t2);
 +        } else {
 +            gen_helper_casp_be_parallel(cpu_env, tcg_rs, addr, t1, t2);
 +        }
 +        tcg_temp_free_i32(tcg_rs);
 +    } else {
 +        TCGv_i64 d1 = tcg_temp_new_i64();
 +        TCGv_i64 d2 = tcg_temp_new_i64();
 +        TCGv_i64 a2 = tcg_temp_new_i64();
 +        TCGv_i64 c1 = tcg_temp_new_i64();
 +        TCGv_i64 c2 = tcg_temp_new_i64();
 +        TCGv_i64 zero = tcg_const_i64(0);
 +
 +        /* Load the two words, in memory order.  */
 +        tcg_gen_qemu_ld_i64(d1, addr, memidx,
 +                            MO_64 | MO_ALIGN_16 | s->be_data);
 +        tcg_gen_addi_i64(a2, addr, 8);
 +        tcg_gen_qemu_ld_i64(d2, addr, memidx, MO_64 | s->be_data);
 +
 +        /* Compare the two words, also in memory order.  */
 +        tcg_gen_setcond_i64(TCG_COND_EQ, c1, d1, s1);
 +        tcg_gen_setcond_i64(TCG_COND_EQ, c2, d2, s2);
 +        tcg_gen_and_i64(c2, c2, c1);
 +
 +        /* If compare equal, write back new data, else write back old data.  */
 +        tcg_gen_movcond_i64(TCG_COND_NE, c1, c2, zero, t1, d1);
 +        tcg_gen_movcond_i64(TCG_COND_NE, c2, c2, zero, t2, d2);
 +        tcg_gen_qemu_st_i64(c1, addr, memidx, MO_64 | s->be_data);
 +        tcg_gen_qemu_st_i64(c2, a2, memidx, MO_64 | s->be_data);
 +        tcg_temp_free_i64(a2);
 +        tcg_temp_free_i64(c1);
 +        tcg_temp_free_i64(c2);
 +        tcg_temp_free_i64(zero);
 +
 +        /* Write back the data from memory to Rs.  */
 +        tcg_gen_mov_i64(s1, d1);
 +        tcg_gen_mov_i64(s2, d2);
 +        tcg_temp_free_i64(d1);
 +        tcg_temp_free_i64(d2);
 +    }
 +}
 +
  /* Update the Sixty-Four bit (SF) registersize. This logic is derived
   * from the ARMv8 specs for LDR (Shared decode for all encodings).
   */
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
              gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, true);
              return;
          }
 -        /* CASP / CASPL */
 +        if (rt2 == 31
 +            && ((rt | rs) & 1) == 0
 +            && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
 +            /* CASP / CASPL */
 +            gen_compare_and_swap_pair(s, rs, rt, rn, size | 2);
 +            return;
 +        }
          break;
 -    case 0x6: case 0x7: /* CASP / LDXP */
 +    case 0x6: case 0x7: /* CASPA / LDXP */
          if (size & 2) { /* LDXP / LDAXP */
              if (rn == 31) {
                  gen_check_sp_alignment(s);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
              }
              return;
          }
 -        /* CASPA / CASPAL */
 +        if (rt2 == 31
 +            && ((rt | rs) & 1) == 0
 +            && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
 +            /* CASPA / CASPAL */
 +            gen_compare_and_swap_pair(s, rs, rt, rn, size | 2);
 +            return;
 +        }
          break;
      case 0xa: /* CAS */
      case 0xb: /* CASL */
      case 0xe: /* CASA */
      case 0xf: /* CASAL */
 +        if (rt2 == 31 && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
 +            gen_compare_and_swap(s, rs, rt, rn, size);
 +            return;
 +        }
          break;
      }
- }
+     unallocated_encoding(s);
 -static void handle_fp_compare(DisasContext *s, bool is_double,
 +static void handle_fp_compare(DisasContext *s, int size,
                                unsigned int rn, unsigned int rm,
                                bool cmp_with_zero, bool signal_all_nans)
  {
      TCGv_i64 tcg_flags = tcg_temp_new_i64();
 -    TCGv_ptr fpst = get_fpstatus_ptr(false);
 +    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
  /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
 .17.0

-[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+[Qemu-devel] [PULL 17/21] target/arm: Enable ARM_FEATURE_V8_ATOMICS for user-only
-In commit d81ce0ef2c4f105 we added an extra float_status field
+From: Richard Henderson <richard.henderson@linaro.org>
 fp_status_fp16 for Arm, but forgot to initialize it correctly
 by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-Add the missing initialization.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180508151437.4232-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu64.c | 1 +
 file changed, 1 insertion(+)
-Fixes: d81ce0ef2c4f105
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
  target/arm/cpu.c | 2 ++
 file changed, 2 insertions(+)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/target/arm/cpu64.c
-+++ b/target/arm/cpu.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-                               &env->vfp.fp_status);
+         set_feature(&cpu->env, ARM_FEATURE_V8_SM4);
-     set_float_detect_tininess(float_tininess_before_rounding,
+         set_feature(&cpu->env, ARM_FEATURE_V8_PMULL);
-                               &env->vfp.standard_fp_status);
+         set_feature(&cpu->env, ARM_FEATURE_CRC);
-+    set_float_detect_tininess(float_tininess_before_rounding,
++        set_feature(&cpu->env, ARM_FEATURE_V8_ATOMICS);
-+                              &env->vfp.fp_status_f16);
+         set_feature(&cpu->env, ARM_FEATURE_V8_RDM);
- #ifndef CONFIG_USER_ONLY
+         set_feature(&cpu->env, ARM_FEATURE_V8_FP16);
-     if (kvm_enabled()) {
+         set_feature(&cpu->env, ARM_FEATURE_V8_FCMA);
          kvm_arm_reset_vcpu(cpu);
 --
 .17.0

-[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
+[Qemu-devel] [PULL 18/21] target/arm: Implement vector shifted SCVF/UCVF for fp16
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-These were missed out from the rest of the half-precision work.
+While we have some of the scalar paths for *CVF for fp16,
 we failed to decode the fp16 version of these instructions.
 Cc: qemu-stable@nongnu.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20180502221552.3873-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
-[rth: Fix erroneous check vs type]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
+ target/arm/translate-a64.c | 33 ++++++++++++++++++++-------------
-file changed, 25 insertions(+), 6 deletions(-)
+file changed, 20 insertions(+), 13 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_intfp_conv(DisasContext *s, bool is_scalar,
-     unsigned int mos, type, rm, cond, rn, rd;
+                                          int immh, int immb, int opcode,
-     TCGv_i64 t_true, t_false, t_zero;
+                                          int rn, int rd)
-     DisasCompare64 c;
+ {
-+    TCGMemOp sz;
+-    bool is_double = extract32(immh, 3, 1);
+-    int size = is_double ? MO_64 : MO_32;
-     mos = extract32(insn, 29, 3);
+-    int elements;
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
++    int size, elements, fracbits;
-+    type = extract32(insn, 22, 2);
+     int immhb = immh << 3 | immb;
-     rm = extract32(insn, 16, 5);
+-    int fracbits = (is_double ? 128 : 64) - immhb;
-     cond = extract32(insn, 12, 4);
-     rn = extract32(insn, 5, 5);
+-    if (!extract32(immh, 2, 2)) {
-     rd = extract32(insn, 0, 5);
++    if (immh & 8) {
++        size = MO_64;
--    if (mos || type > 1) {
++        if (!is_scalar && !is_q) {
-+    if (mos) {
++            unallocated_encoding(s);
-+        unallocated_encoding(s);
++            return;
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        sz = MO_32;
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
-+        /* fallthru */
++    } else if (immh & 4) {
-+    default:
++        size = MO_32;
 +    } else if (immh & 2) {
 +        size = MO_16;
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +    } else {
 +        /* immh == 0 would be a failure of the decode logic */
 +        g_assert(immh == 1);
          unallocated_encoding(s);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_intfp_conv(DisasContext *s, bool is_scalar,
      if (is_scalar) {
          elements = 1;
      } else {
 -        elements = is_double ? 2 : is_q ? 4 : 2;
 -        if (is_double && !is_q) {
 -            unallocated_encoding(s);
 -            return;
 -        }
 +        elements = (8 << is_q) >> size;
      }
 +    fracbits = (16 << size) - immhb;
      if (!fp_access_check(s)) {
          return;
      }
--    /* Zero extend sreg inputs to 64 bits now.  */
+-    /* immh == 0 would be a failure of the decode logic */
-+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
+-    g_assert(immh);
-     t_true = tcg_temp_new_i64();
+-
-     t_false = tcg_temp_new_i64();
+     handle_simd_intfp_conv(s, rd, rn, elements, !is_u, fracbits, size);
--    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
+ }
--    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
 +    read_vec_element(s, t_true, rn, 0, sz);
 +    read_vec_element(s, t_false, rm, 0, sz);
      a64_test_cc(&c, cond);
      t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
 .17.0

-[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+[Qemu-devel] [PULL 19/21] target/arm: Implement vector shifted FCVT for fp16
 From: Richard Henderson <richard.henderson@linaro.org>
-Adding the fp16 moves to/from general registers.
+While we have some of the scalar paths for FCVT for fp16,
 we failed to decode the fp16 version of these instructions.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180502221552.3873-3-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 21 +++++++++++++++++++++
+ target/arm/translate-a64.c | 65 +++++++++++++++++++++++++++-----------
-file changed, 21 insertions(+)
+file changed, 46 insertions(+), 19 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
-             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+                                          bool is_q, bool is_u,
-             clear_vec_high(s, true, rd);
+                                          int immh, int immb, int rn, int rd)
-             break;
+ {
-+        case 3:
+-    bool is_double = extract32(immh, 3, 1);
-+            /* 16 bit */
+     int immhb = immh << 3 | immb;
-+            tmp = tcg_temp_new_i64();
+-    int fracbits = (is_double ? 128 : 64) - immhb;
-+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+-    int pass;
-+            write_fp_dreg(s, rd, tmp);
++    int pass, size, fracbits;
-+            tcg_temp_free_i64(tmp);
+     TCGv_ptr tcg_fpstatus;
      TCGv_i32 tcg_rmode, tcg_shift;
 -    if (!extract32(immh, 2, 2)) {
 -        unallocated_encoding(s);
 -        return;
 -    }
 -
 -    if (!is_scalar && !is_q && is_double) {
 +    if (immh & 0x8) {
 +        size = MO_64;
 +        if (!is_scalar && !is_q) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +    } else if (immh & 0x4) {
 +        size = MO_32;
 +    } else if (immh & 0x2) {
 +        size = MO_16;
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +    } else {
 +        /* Should have split out AdvSIMD modified immediate earlier.  */
 +        assert(immh == 1);
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
      assert(!(is_scalar && is_q));
      tcg_rmode = tcg_const_i32(arm_rmode_to_sf(FPROUNDING_ZERO));
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(size == MO_16);
      gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 +    fracbits = (16 << size) - immhb;
      tcg_shift = tcg_const_i32(fracbits);
 -    if (is_double) {
 +    if (size == MO_64) {
          int maxpass = is_scalar ? 1 : 2;
          for (pass = 0; pass < maxpass; pass++) {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
          }
          clear_vec_high(s, is_q, rd);
      } else {
 -        int maxpass = is_scalar ? 1 : is_q ? 4 : 2;
 +        void (*fn)(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 +        int maxpass = is_scalar ? 1 : ((8 << is_q) >> size);
 +
 +        switch (size) {
 +        case MO_16:
 +            if (is_u) {
 +                fn = gen_helper_vfp_toulh;
 +            } else {
 +                fn = gen_helper_vfp_toslh;
 +            }
 +            break;
 +        case MO_32:
 +            if (is_u) {
 +                fn = gen_helper_vfp_touls;
 +            } else {
 +                fn = gen_helper_vfp_tosls;
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
++        }
++
+         for (pass = 0; pass < maxpass; pass++) {
+             TCGv_i32 tcg_op = tcg_temp_new_i32();
+-            read_vec_element_i32(s, tcg_op, rn, pass, MO_32);
+-            if (is_u) {
+-                gen_helper_vfp_touls(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
+-            } else {
+-                gen_helper_vfp_tosls(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
+-            }
++            read_vec_element_i32(s, tcg_op, rn, pass, size);
++            fn(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
+             if (is_scalar) {
+                 write_fp_sreg(s, rd, tcg_op);
+             } else {
+-                write_vec_element_i32(s, tcg_op, rd, pass, MO_32);
++                write_vec_element_i32(s, tcg_op, rd, pass, size);
+             }
+             tcg_temp_free_i32(tcg_op);
          }
-     } else {
-         TCGv_i64 tcg_rd = cpu_reg(s, rd);
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-             /* 64 bits from top half */
-             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
-             break;
-+        case 3:
-+            /* 16 bit */
-+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
-         case 0xa: /* 64 bit */
-         case 0xd: /* 64 bit to top half of quad */
-             break;
-+        case 0x6: /* 16-bit float, 32-bit int */
-+        case 0xe: /* 16-bit float, 64-bit int */
-+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+                break;
-+            }
-+            /* fallthru */
-         default:
-             /* all other sf/type/rmode combinations are invalid */
-             unallocated_encoding(s);
 --
 .17.0

-[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+[Qemu-devel] [PULL 20/21] target/arm: Fix float16 to/from int16
 From: Richard Henderson <richard.henderson@linaro.org>
+The instruction "ucvtf v0.4h, v04h, #2", with input 0x8000u,
+overflows the intermediate float16 to infinity before we have a
+chance to scale the output.  Use float64 as the intermediate type
+so that no input argument (uint32_t in this case) can overflow
+or round before scaling.  Given the declared argument, the signed
+int32_t function has the same problem.
+When converting from float16 to integer, using u/int32_t instead
+of u/int16_t means that the bounding is incorrect.
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180502221552.3873-4-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  6 +++
+ target/arm/helper.h        |  4 +--
- target/arm/helper.c        | 38 ++++++++++++++-
+ target/arm/helper.c        | 53 ++++++++++++++++++++++++++++++++++++--
- target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
+ target/arm/translate-a64.c |  4 +--
-files changed, 122 insertions(+), 18 deletions(-)
+files changed, 55 insertions(+), 6 deletions(-)
 diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.h
 +++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_toshd_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_tosld_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
  DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
- DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
+-DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
- DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+-DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
-+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
++DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
-+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
++DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
 +DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
- DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
- DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
- DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
-+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
-+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
- DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
- DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
+@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(sq, s, 32, 64, int64)
- #undef VFP_CONV_FIX_A64
+ VFP_CONV_FIX(uh, s, 32, 32, uint16)
+ VFP_CONV_FIX(ul, s, 32, 32, uint32)
- /* Conversion to/from f16 can overflow to infinity before/after scaling.
+ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
-- * Therefore we convert to f64 (which does not round), scale,
+-VFP_CONV_FIX_A64(sl, h, 16, 32, int32)
-- * and then convert f64 to f16 (which may round).
+-VFP_CONV_FIX_A64(ul, h, 16, 32, uint32)
-+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
++
-+ * vice versa for conversion to integer.
+ #undef VFP_CONV_FIX
-+ *
+ #undef VFP_CONV_FIX_FLOAT
-+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ #undef VFP_CONV_FLOAT_FIX_ROUND
-+ * For 64-bit integers, any integer that would cause rounding will also
++#undef VFP_CONV_FIX_A64
-+ * overflow to f16 infinity, so there is no double rounding problem.
++
-  */
++/* Conversion to/from f16 can overflow to infinity before/after scaling.
++ * Therefore we convert to f64 (which does not round), scale,
- static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
++ * and then convert f64 to f16 (which may round).
-@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
++ */
-     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
++
- }
++static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
-+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
++    return float64_to_float16(float64_scalbn(f, -shift, fpst), true, fpst);
 +}
 +
-+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
++float16 HELPER(vfp_sltoh)(uint32_t x, uint32_t shift, void *fpst)
 +{
-+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
++    return do_postscale_fp16(int32_to_float64(x, fpst), shift, fpst);
 +}
 +
- static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
++float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
  {
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
-+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
++    return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 +}
 +
-+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
++static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 +{
-+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
++    if (unlikely(float16_is_any_nan(f))) {
 +        float_raise(float_flag_invalid, fpst);
 +        return 0;
 +    } else {
 +        int old_exc_flags = get_float_exception_flags(fpst);
 +        float64 ret;
 +
 +        ret = float16_to_float64(f, true, fpst);
 +        ret = float64_scalbn(ret, shift, fpst);
 +        old_exc_flags |= get_float_exception_flags(fpst)
 +            & float_flag_input_denormal;
 +        set_float_exception_flags(old_exc_flags, fpst);
 +
 +        return ret;
 +    }
 +}
 +
-+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
++uint32_t HELPER(vfp_toshh)(float16 x, uint32_t shift, void *fpst)
 +{
-+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
++    return float64_to_int16(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
-+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
++uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
 +{
-+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
++    return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 +}
-+
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
-  */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
-                            bool itof, int rmode, int scale, int sf, int type)
+         switch (size) {
- {
+         case MO_16:
-     bool is_signed = !(opcode & 1);
+             if (is_u) {
--    bool is_double = type;
+-                fn = gen_helper_vfp_toulh;
-     TCGv_ptr tcg_fpstatus;
++                fn = gen_helper_vfp_touhh;
--    TCGv_i32 tcg_shift;
+             } else {
-+    TCGv_i32 tcg_shift, tcg_single;
+-                fn = gen_helper_vfp_toslh;
-+    TCGv_i64 tcg_double;
++                fn = gen_helper_vfp_toshh;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
-             write_fp_dreg(s, rd, tcg_double);
+             break;
-             tcg_temp_free_i64(tcg_double);
+         case MO_32:
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
 .17.0

-[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+[Qemu-devel] [PULL 21/21] target/arm: Clear SVE high bits for FMOV
 From: Richard Henderson <richard.henderson@linaro.org>
-We missed all of the scalar fp16 binary operations.
+Use write_fp_dreg and clear_vec_high to zero the bits
 that need zeroing for these cases.
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20180502221552.3873-5-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 17 +++++------------
-file changed, 65 insertions(+)
+file changed, 5 insertions(+), 12 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-     tcg_temp_free_i64(tcg_res);
- }
+     if (itof) {
+         TCGv_i64 tcg_rn = cpu_reg(s, rn);
-+/* Floating-point data-processing (2 source) - half precision */
++        TCGv_i64 tmp;
-+static void handle_fp_2src_half(DisasContext *s, int opcode,
-+                                int rd, int rn, int rm)
+         switch (type) {
-+{
+         case 0:
-+    TCGv_i32 tcg_op1;
+-        {
-+    TCGv_i32 tcg_op2;
+             /* 32 bit */
-+    TCGv_i32 tcg_res;
+-            TCGv_i64 tmp = tcg_temp_new_i64();
-+    TCGv_ptr fpst;
++            tmp = tcg_temp_new_i64();
-+
+             tcg_gen_ext32u_i64(tmp, tcg_rn);
-+    tcg_res = tcg_temp_new_i32();
+-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_offset(s, rd, MO_64));
-+    fpst = get_fpstatus_ptr(true);
+-            tcg_gen_movi_i64(tmp, 0);
-+    tcg_op1 = read_fp_hreg(s, rn);
+-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_hi_offset(s, rd));
-+    tcg_op2 = read_fp_hreg(s, rm);
++            write_fp_dreg(s, rd, tmp);
-+
+             tcg_temp_free_i64(tmp);
-+    switch (opcode) {
+             break;
-+    case 0x0: /* FMUL */
+-        }
-+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+         case 1:
-+        break;
+-        {
-+    case 0x1: /* FDIV */
+             /* 64 bit */
-+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+-            TCGv_i64 tmp = tcg_const_i64(0);
-+        break;
+-            tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_offset(s, rd, MO_64));
-+    case 0x2: /* FADD */
+-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_hi_offset(s, rd));
-+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+-            tcg_temp_free_i64(tmp);
-+        break;
++            write_fp_dreg(s, rd, tcg_rn);
-+    case 0x3: /* FSUB */
+             break;
-+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+-        }
-+        break;
+         case 2:
-+    case 0x4: /* FMAX */
+             /* 64 bit to top half. */
-+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
-+        break;
++            clear_vec_high(s, true, rd);
-+    case 0x5: /* FMIN */
+             break;
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
  /* Floating point data-processing (2 source)
   *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
   * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
          }
-         handle_fp_2src_double(s, opcode, rd, rn, rm);
+     } else {
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
 .17.0

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0

The following changes since commit e5cd695266c5709308aa95b1baae499e4b5d4544:

Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-05-08 17:05:58 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180510

for you to fetch changes up to 9a9f1f59521f46e8ff4527d9a2b52f83577e2aa3:

target/arm: Clear SVE high bits for FMOV (2018-05-10 18:10:58 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/iotkit.c: fix minor memory leak
 * softfloat: fix wrong-exception-flags bug for multiply-add corner case
 * arm: isolate and clean up DTB generation
 * implement Arm v8.1-Atomics extension
 * Fix some bugs and missing instructions in the v8.2-FP16 extension

----------------------------------------------------------------
Igor Mammedov (4):
      pc: simplify MachineClass::get_hotplug_handler handling
      platform-bus-device: use device plug callback instead of machine_done notifier
      arm/boot: split load_dtb() from arm_load_kernel()
      make sure that we aren't overwriting mc->get_hotplug_handler by accident

Peter Maydell (3):
      hw/arm/iotkit.c: fix minor memory leak
      softfloat: Handle default NaN mode after pickNaNMulAdd, not before
      atomic.h: Work around gcc spurious "unused value" warning

Richard Henderson (14):
      tcg: Introduce helpers for integer min/max
      target/arm: Use new min/max expanders
      target/xtensa: Use new min/max expanders
      tcg: Introduce atomic helpers for integer min/max
      tcg: Use GEN_ATOMIC_HELPER_FN for opposite endian atomic add
      target/riscv: Use new atomic min/max expanders
      target/arm: Introduce ARM_FEATURE_V8_ATOMICS and initial decode
      target/arm: Fill in disas_ldst_atomic
      target/arm: Implement CAS and CASP
      target/arm: Enable ARM_FEATURE_V8_ATOMICS for user-only
      target/arm: Implement vector shifted SCVF/UCVF for fp16
      target/arm: Implement vector shifted FCVT for fp16
      target/arm: Fix float16 to/from int16
      target/arm: Clear SVE high bits for FMOV

It is implementation defined whether a multiply-add of
(0,inf,qnan) or (inf,0,qnan) raises InvalidaOperation or
not, so we let the target-specific pickNaNMulAdd function
handle this. This means that we must do the "return the
default NaN in default NaN mode" check after the call,
not before. Correct the ordering, and restore the comment
from the old propagateFloat64MulAddNaN() that warned about
this corner case.

This fixes a regression from 2.11 for Arm guests where we would
incorrectly fail to set the Invalid flag for these cases.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180504100547.14621-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 52 ++++++++++++++++++++++++++++---------------------
 1 file changed, 30 insertions(+), 22 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static FloatParts pick_nan(FloatParts a, FloatParts b, float_status *s)
 static FloatParts pick_nan_muladd(FloatParts a, FloatParts b, FloatParts c,
                                   bool inf_zero, float_status *s)
 {
+    int which;
+
     if (is_snan(a.cls) || is_snan(b.cls) || is_snan(c.cls)) {
         s->float_exception_flags |= float_flag_invalid;
     }
 
-    if (s->default_nan_mode) {
-        a.cls = float_class_dnan;
-    } else {
-        switch (pickNaNMulAdd(is_qnan(a.cls), is_snan(a.cls),
-                              is_qnan(b.cls), is_snan(b.cls),
-                              is_qnan(c.cls), is_snan(c.cls),
-                              inf_zero, s)) {
-        case 0:
-            break;
-        case 1:
-            a = b;
-            break;
-        case 2:
-            a = c;
-            break;
-        case 3:
-            a.cls = float_class_dnan;
-            return a;
-        default:
-            g_assert_not_reached();
-        }
+    which = pickNaNMulAdd(is_qnan(a.cls), is_snan(a.cls),
+                          is_qnan(b.cls), is_snan(b.cls),
+                          is_qnan(c.cls), is_snan(c.cls),
+                          inf_zero, s);
 
-        a.cls = float_class_msnan;
+    if (s->default_nan_mode) {
+        /* Note that this check is after pickNaNMulAdd so that function
+         * has an opportunity to set the Invalid flag.
+         */
+        a.cls = float_class_dnan;
+        return a;
     }
+
+    switch (which) {
+    case 0:
+        break;
+    case 1:
+        a = b;
+        break;
+    case 2:
+        a = c;
+        break;
+    case 3:
+        a.cls = float_class_dnan;
+        return a;
+    default:
+        g_assert_not_reached();
+    }
+    a.cls = float_class_msnan;
+
     return a;
 }
 
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

By default MachineClass::get_hotplug_handler is NULL and concrete board
should set it to it's own handler.
Considering there isn't any default handler, drop saving empty
MachineClass::get_hotplug_handler in child class and make PC code
consistent with spapr/s390x boards.

We can bring this back when actual usecase surfaces and do it
consistently across boards that use get_hotplug_handler().

Suggested-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Message-id: 1525691524-32265-2-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i386/pc.h | 8 --------
 hw/i386/pc.c         | 6 +-----
 2 files changed, 1 insertion(+), 13 deletions(-)

diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -XXX,XX +XXX,XX @@ struct PCMachineState {
 /**
  * PCMachineClass:
  *
- * Methods:
- *
- * @get_hotplug_handler: pointer to parent class callback @get_hotplug_handler
- *
  * Compat fields:
  *
  * @enforce_aligned_dimm: check that DIMM's address/size is aligned by
@@ -XXX,XX +XXX,XX @@ struct PCMachineClass {
 
     /*< public >*/
 
-    /* Methods: */
-    HotplugHandler *(*get_hotplug_handler)(MachineState *machine,
-                                           DeviceState *dev);
-
     /* Device configuration: */
     bool pci_enabled;
     bool kvmclock_enabled;
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
 static HotplugHandler *pc_get_hotpug_handler(MachineState *machine,
                                              DeviceState *dev)
 {
-    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(machine);
-
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
         object_dynamic_cast(OBJECT(dev), TYPE_CPU)) {
         return HOTPLUG_HANDLER(machine);
     }
 
-    return pcmc->get_hotplug_handler ?
-        pcmc->get_hotplug_handler(machine, dev) : NULL;
+    return NULL;
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     NMIClass *nc = NMI_CLASS(oc);
 
-    pcmc->get_hotplug_handler = mc->get_hotplug_handler;
     pcmc->pci_enabled = true;
     pcmc->has_acpi_build = true;
     pcmc->rsdp_in_ram = true;
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

platform-bus were using machine_done notifier to get and map
(assign irq/mmio resources) dynamically added sysbus devices
after all '-device' options had been processed.
That however creates non obvious dependencies on ordering of
machine_done notifiers and requires carefull line juggling
to keep it working. For example see comment above
create_platform_bus() and 'straitforward' arm_load_kernel()
had to converted to machine_done notifier and that lead to
yet another machine_done notifier to keep it working
arm_register_platform_bus_fdt_creator().

Instead of hiding resource assignment in platform-bus-device
to magically initialize sysbus devices, use device plug
callback and assign resources explicitly at board level
at the moment each -device option is being processed.

That adds a bunch of machine declaration boiler plate to
e500plat board, similar to ARM/x86 but gets rid of hidden
machine_done notifier and would allow to remove the dependent
notifiers in ARM code simplifying it and making code flow
easier to follow.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Message-id: 1525691524-32265-3-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ppc/e500.h             |  5 +++++
 include/hw/arm/virt.h     |  1 +
 include/hw/platform-bus.h |  4 ++--
 hw/arm/sysbus-fdt.c       |  3 ---
 hw/arm/virt.c             | 31 +++++++++++++++++++++++++++++++
 hw/core/platform-bus.c    | 29 +++++------------------------
 hw/ppc/e500.c             | 38 +++++++++++++++++---------------------
 hw/ppc/e500plat.c         | 31 +++++++++++++++++++++++++++++++
 8 files changed, 92 insertions(+), 50 deletions(-)

diff --git a/hw/ppc/e500.h b/hw/ppc/e500.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500.h
+++ b/hw/ppc/e500.h
@@ -XXX,XX +XXX,XX @@
 #define PPCE500_H
 
 #include "hw/boards.h"
+#include "hw/platform-bus.h"
 
 typedef struct PPCE500MachineState {
     /*< private >*/
     MachineState parent_obj;
 
+    /* points to instance of TYPE_PLATFORM_BUS_DEVICE if
+     * board supports dynamic sysbus devices
+     */
+    PlatformBusDevice *pbus_dev;
 } PPCE500MachineState;
 
 typedef struct PPCE500MachineClass {
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 typedef struct {
     MachineState parent;
     Notifier machine_done;
+    DeviceState *platform_bus_dev;
     FWCfgState *fw_cfg;
     bool secure;
     bool highmem;
diff --git a/include/hw/platform-bus.h b/include/hw/platform-bus.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/platform-bus.h
+++ b/include/hw/platform-bus.h
@@ -XXX,XX +XXX,XX @@ typedef struct PlatformBusDevice PlatformBusDevice;
 struct PlatformBusDevice {
     /*< private >*/
     SysBusDevice parent_obj;
-    Notifier notifier;
-    bool done_gathering;
 
     /*< public >*/
     uint32_t mmio_size;
@@ -XXX,XX +XXX,XX @@ int platform_bus_get_irqn(PlatformBusDevice *platform_bus, SysBusDevice *sbdev,
 hwaddr platform_bus_get_mmio_addr(PlatformBusDevice *pbus, SysBusDevice *sbdev,
                                   int n);
 
+void platform_bus_link_device(PlatformBusDevice *pbus, SysBusDevice *sbdev);
+
 #endif /* HW_PLATFORM_BUS_H */
diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sysbus-fdt.c
+++ b/hw/arm/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
     dev = qdev_find_recursive(sysbus_get_default(), TYPE_PLATFORM_BUS_DEVICE);
     pbus = PLATFORM_BUS_DEVICE(dev);
 
-    /* We can only create dt nodes for dynamic devices when they're ready */
-    assert(pbus->done_gathering);
-
     PlatformBusFDTData data = {
         .fdt = fdt,
         .irq_start = irq_start,
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_platform_bus(VirtMachineState *vms, qemu_irq *pic)
     qdev_prop_set_uint32(dev, "mmio_size",
         platform_bus_params.platform_bus_size);
     qdev_init_nofail(dev);
+    vms->platform_bus_dev = dev;
     s = SYS_BUS_DEVICE(dev);
 
     for (i = 0; i < platform_bus_params.platform_bus_num_irqs; i++) {
@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
     return ms->possible_cpus;
 }
 
+static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+                                        DeviceState *dev, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
+
+    if (vms->platform_bus_dev) {
+        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+            platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
+                                     SYS_BUS_DEVICE(dev));
+        }
+    }
+}
+
+static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
+                                                        DeviceState *dev)
+{
+    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        return HOTPLUG_HANDLER(machine);
+    }
+
+    return NULL;
+}
+
 static void virt_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
 
     mc->init = machvirt_init;
     /* Start max_cpus at the maximum QEMU supports. We'll further restrict
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
+    mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
+    hc->plug = virt_machine_device_plug_cb;
 }
 
 static const TypeInfo virt_machine_info = {
@@ -XXX,XX +XXX,XX @@ static const TypeInfo virt_machine_info = {
     .instance_size = sizeof(VirtMachineState),
     .class_size    = sizeof(VirtMachineClass),
     .class_init    = virt_machine_class_init,
+    .interfaces = (InterfaceInfo[]) {
+         { TYPE_HOTPLUG_HANDLER },
+         { }
+    },
 };
 
 static void machvirt_machine_init(void)
diff --git a/hw/core/platform-bus.c b/hw/core/platform-bus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/platform-bus.c
+++ b/hw/core/platform-bus.c
@@ -XXX,XX +XXX,XX @@ static void plaform_bus_refresh_irqs(PlatformBusDevice *pbus)
 {
     bitmap_zero(pbus->used_irqs, pbus->num_irqs);
     foreach_dynamic_sysbus_device(platform_bus_count_irqs, pbus);
-    pbus->done_gathering = true;
 }
 
 static void platform_bus_map_irq(PlatformBusDevice *pbus, SysBusDevice *sbdev,
@@ -XXX,XX +XXX,XX @@ static void platform_bus_map_mmio(PlatformBusDevice *pbus, SysBusDevice *sbdev,
 }
 
 /*
- * For each sysbus device, look for unassigned IRQ lines as well as
- * unassociated MMIO regions. Connect them to the platform bus if available.
+ * Look for unassigned IRQ lines as well as unassociated MMIO regions.
+ * Connect them to the platform bus if available.
  */
-static void link_sysbus_device(SysBusDevice *sbdev, void *opaque)
+void platform_bus_link_device(PlatformBusDevice *pbus, SysBusDevice *sbdev)
 {
-    PlatformBusDevice *pbus = opaque;
     int i;
 
     for (i = 0; sysbus_has_irq(sbdev, i); i++) {
@@ -XXX,XX +XXX,XX @@ static void link_sysbus_device(SysBusDevice *sbdev, void *opaque)
     }
 }
 
-static void platform_bus_init_notify(Notifier *notifier, void *data)
-{
-    PlatformBusDevice *pb = container_of(notifier, PlatformBusDevice, notifier);
-
-    /*
-     * Generate a bitmap of used IRQ lines, as the user might have specified
-     * them on the command line.
-     */
-    plaform_bus_refresh_irqs(pb);
-
-    foreach_dynamic_sysbus_device(link_sysbus_device, pb);
-}
-
 static void platform_bus_realize(DeviceState *dev, Error **errp)
 {
     PlatformBusDevice *pbus;
@@ -XXX,XX +XXX,XX @@ static void platform_bus_realize(DeviceState *dev, Error **errp)
         sysbus_init_irq(d, &pbus->irqs[i]);
     }
 
-    /*
-     * Register notifier that allows us to gather dangling devices once the
-     * machine is completely assembled
-     */
-    pbus->notifier.notify = platform_bus_init_notify;
-    qemu_add_machine_init_done_notifier(&pbus->notifier);
+    /* some devices might be initialized before so update used IRQs map */
+    plaform_bus_refresh_irqs(pbus);
 }
 
 static Property platform_bus_properties[] = {
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -XXX,XX +XXX,XX @@ static void sysbus_device_create_devtree(SysBusDevice *sbdev, void *opaque)
     }
 }
 
-static void platform_bus_create_devtree(const PPCE500MachineClass *pmc,
+static void platform_bus_create_devtree(PPCE500MachineState *pms,
                                         void *fdt, const char *mpic)
 {
+    const PPCE500MachineClass *pmc = PPCE500_MACHINE_GET_CLASS(pms);
     gchar *node = g_strdup_printf("/platform@%"PRIx64, pmc->platform_bus_base);
     const char platcomp[] = "qemu,platform\0simple-bus";
     uint64_t addr = pmc->platform_bus_base;
     uint64_t size = pmc->platform_bus_size;
     int irq_start = pmc->platform_bus_first_irq;
-    PlatformBusDevice *pbus;
-    DeviceState *dev;
 
     /* Create a /platform node that we can put all devices into */
 
@@ -XXX,XX +XXX,XX @@ static void platform_bus_create_devtree(const PPCE500MachineClass *pmc,
 
     qemu_fdt_setprop_phandle(fdt, node, "interrupt-parent", mpic);
 
-    dev = qdev_find_recursive(sysbus_get_default(), TYPE_PLATFORM_BUS_DEVICE);
-    pbus = PLATFORM_BUS_DEVICE(dev);
+    /* Create dt nodes for dynamic devices */
+    PlatformDevtreeData data = {
+        .fdt = fdt,
+        .mpic = mpic,
+        .irq_start = irq_start,
+        .node = node,
+        .pbus = pms->pbus_dev,
+    };
 
-    /* We can only create dt nodes for dynamic devices when they're ready */
-    if (pbus->done_gathering) {
-        PlatformDevtreeData data = {
-            .fdt = fdt,
-            .mpic = mpic,
-            .irq_start = irq_start,
-            .node = node,
-            .pbus = pbus,
-        };
-
-        /* Loop through all dynamic sysbus devices and create nodes for them */
-        foreach_dynamic_sysbus_device(sysbus_device_create_devtree, &data);
-    }
+    /* Loop through all dynamic sysbus devices and create nodes for them */
+    foreach_dynamic_sysbus_device(sysbus_device_create_devtree, &data);
 
     g_free(node);
 }
@@ -XXX,XX +XXX,XX @@ static int ppce500_load_device_tree(PPCE500MachineState *pms,
     }
     g_free(soc);
 
-    if (pmc->has_platform_bus) {
-        platform_bus_create_devtree(pmc, fdt, mpic);
+    if (pms->pbus_dev) {
+        platform_bus_create_devtree(pms, fdt, mpic);
     }
     g_free(mpic);
 
@@ -XXX,XX +XXX,XX @@ void ppce500_init(MachineState *machine)
         qdev_prop_set_uint32(dev, "num_irqs", pmc->platform_bus_num_irqs);
         qdev_prop_set_uint32(dev, "mmio_size", pmc->platform_bus_size);
         qdev_init_nofail(dev);
-        s = SYS_BUS_DEVICE(dev);
+        pms->pbus_dev = PLATFORM_BUS_DEVICE(dev);
 
+        s = SYS_BUS_DEVICE(pms->pbus_dev);
         for (i = 0; i < pmc->platform_bus_num_irqs; i++) {
             int irqn = pmc->platform_bus_first_irq + i;
             sysbus_connect_irq(s, i, qdev_get_gpio_in(mpicdev, irqn));
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ppce500_info = {
     .name          = TYPE_PPCE500_MACHINE,
     .parent        = TYPE_MACHINE,
     .abstract      = true,
+    .instance_size = sizeof(PPCE500MachineState),
     .class_size    = sizeof(PPCE500MachineClass),
 };
 
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -XXX,XX +XXX,XX @@ static void e500plat_init(MachineState *machine)
     ppce500_init(machine);
 }
 
+static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+                                            DeviceState *dev, Error **errp)
+{
+    PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
+
+    if (pms->pbus_dev) {
+        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+            platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
+        }
+    }
+}
+
+static
+HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
+                                                    DeviceState *dev)
+{
+    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        return HOTPLUG_HANDLER(machine);
+    }
+
+    return NULL;
+}
+
 #define TYPE_E500PLAT_MACHINE  MACHINE_TYPE_NAME("ppce500")
 
 static void e500plat_machine_class_init(ObjectClass *oc, void *data)
 {
     PPCE500MachineClass *pmc = PPCE500_MACHINE_CLASS(oc);
+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
 
+    mc->get_hotplug_handler = e500plat_machine_get_hotpug_handler;
+    hc->plug = e500plat_machine_device_plug_cb;
+
     pmc->pci_first_slot = 0x1;
     pmc->pci_nr_slots = PCI_SLOT_MAX - 1;
     pmc->fixup_devtree = e500plat_fixup_devtree;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo e500plat_info = {
     .name          = TYPE_E500PLAT_MACHINE,
     .parent        = TYPE_PPCE500_MACHINE,
     .class_init    = e500plat_machine_class_init,
+    .interfaces    = (InterfaceInfo[]) {
+         { TYPE_HOTPLUG_HANDLER },
+         { }
+    }
 };
 
 static void e500plat_register_types(void)
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

load_dtb() depends on arm_load_kernel() to figure out place
in RAM where it should be loaded, but it's not required for
arm_load_kernel() to work. Sometimes it's neccesary for
devices added with -device/device_add to be enumerated in
DTB as well, which's lead to [1] and surrounding commits to
add 2 more machine_done notifiers with non obvious ordering
to make dynamic sysbus devices initialization happen in
the right order.

However instead of moving whole arm_load_kernel() in to
machine_done, it's sufficient to move only load_dtb() into
virt_machine_done() notifier and remove ArmLoadKernelNotifier/
/PlatformBusFDTNotifierParams notifiers, which saves us ~90LOC
and simplifies code flow quite a bit.
Later would allow to consolidate DTB generation within one
function for 'mach-virt' board and make it reentrant so it
could generate updated DTB in device hotplug secenarios.

While at it rename load_dtb() to arm_load_dtb() since it's
public now.

Add additional field skip_dtb_autoload to struct arm_boot_info
to allow manual DTB load later in mach-virt and to avoid touching
all other boards to explicitly call arm_load_dtb().

1) (ac9d32e hw/arm/boot: arm_load_kernel implemented as a machine init done notifier)

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 1525691524-32265-4-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/arm.h        | 45 +++++++++++++++++------
 include/hw/arm/sysbus-fdt.h | 37 ++++---------------
 hw/arm/boot.c               | 72 ++++++++++---------------------------
 hw/arm/sysbus-fdt.c         | 61 +++----------------------------
 hw/arm/virt.c               | 64 ++++++++++++++++-----------------
 5 files changed, 94 insertions(+), 185 deletions(-)

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ DeviceState *armv7m_init(MemoryRegion *system_memory, int mem_size, int num_irq,
  */
 void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename, int mem_size);
 
-/*
- * struct used as a parameter of the arm_load_kernel machine init
- * done notifier
- */
-typedef struct {
-    Notifier notifier; /* actual notifier */
-    ARMCPU *cpu; /* handle to the first cpu object */
-} ArmLoadKernelNotifier;
-
 /* arm_boot.c */
 struct arm_boot_info {
     uint64_t ram_size;
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
     const char *initrd_filename;
     const char *dtb_filename;
     hwaddr loader_start;
+    hwaddr dtb_start;
+    hwaddr dtb_limit;
+    /* If set to True, arm_load_kernel() will not load DTB.
+     * It allows board to load DTB manually later.
+     * (default: False)
+     */
+    bool skip_dtb_autoload;
     /* multicore boards that use the default secondary core boot functions
      * need to put the address of the secondary boot code, the boot reg,
      * and the GIC address in the next 3 values, respectively. boards that
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
      * the user it should implement this hook.
      */
     void (*modify_dtb)(const struct arm_boot_info *info, void *fdt);
-    /* machine init done notifier executing arm_load_dtb */
-    ArmLoadKernelNotifier load_kernel_notifier;
     /* Used internally by arm_boot.c */
     int is_linux;
     hwaddr initrd_start;
@@ -XXX,XX +XXX,XX @@ struct arm_boot_info {
  */
 void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info);
 
+AddressSpace *arm_boot_address_space(ARMCPU *cpu,
+                                     const struct arm_boot_info *info);
+
+/**
+ * arm_load_dtb() - load a device tree binary image into memory
+ * @addr:       the address to load the image at
+ * @binfo:      struct describing the boot environment
+ * @addr_limit: upper limit of the available memory area at @addr
+ * @as:         address space to load image to
+ *
+ * Load a device tree supplied by the machine or by the user  with the
+ * '-dtb' command line option, and put it at offset @addr in target
+ * memory.
+ *
+ * If @addr_limit contains a meaningful value (i.e., it is strictly greater
+ * than @addr), the device tree is only loaded if its size does not exceed
+ * the limit.
+ *
+ * Returns: the size of the device tree image on success,
+ *          0 if the image size exceeds the limit,
+ *          -1 on errors.
+ *
+ * Note: Must not be called unless have_dtb(binfo) is true.
+ */
+int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
+                 hwaddr addr_limit, AddressSpace *as);
+
 /* Write a secure board setup routine with a dummy handler for SMCs */
 void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
diff --git a/include/hw/arm/sysbus-fdt.h b/include/hw/arm/sysbus-fdt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/sysbus-fdt.h
+++ b/include/hw/arm/sysbus-fdt.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_ARM_SYSBUS_FDT_H
 #define HW_ARM_SYSBUS_FDT_H
 
-#include "hw/arm/arm.h"
-#include "qemu-common.h"
-#include "hw/sysbus.h"
-
-/*
- * struct that contains dimensioning parameters of the platform bus
- */
-typedef struct {
-    hwaddr platform_bus_base; /* start address of the bus */
-    hwaddr platform_bus_size; /* size of the bus */
-    int platform_bus_first_irq; /* first hwirq assigned to the bus */
-    int platform_bus_num_irqs; /* number of hwirq assigned to the bus */
-} ARMPlatformBusSystemParams;
-
-/*
- * struct that contains all relevant info to build the fdt nodes of
- * platform bus and attached dynamic sysbus devices
- * in the future might be augmented with additional info
- * such as PHY, CLK handles ...
- */
-typedef struct {
-    const ARMPlatformBusSystemParams *system_params;
-    struct arm_boot_info *binfo;
-    const char *intc; /* parent interrupt controller name */
-} ARMPlatformBusFDTParams;
+#include "exec/hwaddr.h"
 
 /**
- * arm_register_platform_bus_fdt_creator - register a machine init done
- * notifier that creates the device tree nodes of the platform bus and
- * associated dynamic sysbus devices
+ * platform_bus_add_all_fdt_nodes - create all the platform bus nodes
+ *
+ * builds the parent platform bus node and all the nodes of dynamic
+ * sysbus devices attached to it.
  */
-void arm_register_platform_bus_fdt_creator(ARMPlatformBusFDTParams *fdt_params);
-
+void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
+                                    hwaddr bus_size, int irq_start);
 #endif
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #define ARM64_TEXT_OFFSET_OFFSET    8
 #define ARM64_MAGIC_OFFSET          56
 
-static AddressSpace *arm_boot_address_space(ARMCPU *cpu,
-                                            const struct arm_boot_info *info)
+AddressSpace *arm_boot_address_space(ARMCPU *cpu,
+                                     const struct arm_boot_info *info)
 {
     /* Return the address space to use for bootloader reads and writes.
      * We prefer the secure address space if the CPU has it and we're
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
     qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
 }
 
-/**
- * load_dtb() - load a device tree binary image into memory
- * @addr:       the address to load the image at
- * @binfo:      struct describing the boot environment
- * @addr_limit: upper limit of the available memory area at @addr
- * @as:         address space to load image to
- *
- * Load a device tree supplied by the machine or by the user  with the
- * '-dtb' command line option, and put it at offset @addr in target
- * memory.
- *
- * If @addr_limit contains a meaningful value (i.e., it is strictly greater
- * than @addr), the device tree is only loaded if its size does not exceed
- * the limit.
- *
- * Returns: the size of the device tree image on success,
- *          0 if the image size exceeds the limit,
- *          -1 on errors.
- *
- * Note: Must not be called unless have_dtb(binfo) is true.
- */
-static int load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
-                    hwaddr addr_limit, AddressSpace *as)
+int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
+                 hwaddr addr_limit, AddressSpace *as)
 {
     void *fdt = NULL;
     int size, rc;
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
     return size;
 }
 
-static void arm_load_kernel_notify(Notifier *notifier, void *data)
+void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
 {
     CPUState *cs;
     int kernel_size;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
-    ArmLoadKernelNotifier *n = DO_UPCAST(ArmLoadKernelNotifier,
-                                         notifier, notifier);
-    ARMCPU *cpu = n->cpu;
-    struct arm_boot_info *info =
-        container_of(n, struct arm_boot_info, load_kernel_notifier);
     AddressSpace *as = arm_boot_address_space(cpu, info);
 
     /* The board code is not supposed to set secure_board_setup unless
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     assert(!(info->secure_board_setup && kvm_enabled()));
 
     info->dtb_filename = qemu_opt_get(qemu_get_machine_opts(), "dtb");
+    info->dtb_limit = 0;
 
     /* Load the kernel.  */
     if (!info->kernel_filename || info->firmware_loaded) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
              * the kernel is supposed to be loaded by the bootloader), copy the
              * DTB to the base of RAM for the bootloader to pick up.
              */
-            if (load_dtb(info->loader_start, info, 0, as) < 0) {
-                exit(1);
-            }
+            info->dtb_start = info->loader_start;
         }
 
         if (info->kernel_filename) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
          */
         if (elf_low_addr > info->loader_start
             || elf_high_addr < info->loader_start) {
-            /* Pass elf_low_addr as address limit to load_dtb if it may be
+            /* Set elf_low_addr as address limit for arm_load_dtb if it may be
              * pointing into RAM, otherwise pass '0' (no limit)
              */
             if (elf_low_addr < info->loader_start) {
                 elf_low_addr = 0;
             }
-            if (load_dtb(info->loader_start, info, elf_low_addr, as) < 0) {
-                exit(1);
-            }
+            info->dtb_start = info->loader_start;
+            info->dtb_limit = elf_low_addr;
         }
     }
     entry = elf_entry;
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
          */
         if (have_dtb(info)) {
             hwaddr align;
-            hwaddr dtb_start;
 
             if (elf_machine == EM_AARCH64) {
                 /*
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
             }
 
             /* Place the DTB after the initrd in memory with alignment. */
-            dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size, align);
-            if (load_dtb(dtb_start, info, 0, as) < 0) {
-                exit(1);
-            }
-            fixupcontext[FIXUP_ARGPTR] = dtb_start;
+            info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
+                                           align);
+            fixupcontext[FIXUP_ARGPTR] = info->dtb_start;
         } else {
             fixupcontext[FIXUP_ARGPTR] = info->loader_start + KERNEL_ARGS_ADDR;
             if (info->ram_size >= (1ULL << 32)) {
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
         ARM_CPU(cs)->env.boot_info = info;
     }
-}
-
-void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
-{
-    CPUState *cs;
-
-    info->load_kernel_notifier.cpu = cpu;
-    info->load_kernel_notifier.notifier.notify = arm_load_kernel_notify;
-    qemu_add_machine_init_done_notifier(&info->load_kernel_notifier.notifier);
 
     /* CPU objects (unlike devices) are not automatically reset on system
      * reset, so we must always register a handler to do so. If we're
@@ -XXX,XX +XXX,XX @@ void arm_load_kernel(ARMCPU *cpu, struct arm_boot_info *info)
     for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
         qemu_register_reset(do_cpu_reset, ARM_CPU(cs));
     }
+
+    if (!info->skip_dtb_autoload && have_dtb(info)) {
+        if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
+            exit(1);
+        }
+    }
 }
 
 static const TypeInfo arm_linux_boot_if_info = {
diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sysbus-fdt.c
+++ b/hw/arm/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ typedef struct PlatformBusFDTData {
     PlatformBusDevice *pbus;
 } PlatformBusFDTData;
 
-/*
- * struct used when calling the machine init done notifier
- * that constructs the fdt nodes of platform bus devices
- */
-typedef struct PlatformBusFDTNotifierParams {
-    Notifier notifier;
-    ARMPlatformBusFDTParams *fdt_params;
-} PlatformBusFDTNotifierParams;
-
 /* struct that associates a device type name and a node creation function */
 typedef struct NodeCreationPair {
     const char *typename;
@@ -XXX,XX +XXX,XX @@ static void add_fdt_node(SysBusDevice *sbdev, void *opaque)
     exit(1);
 }
 
-/**
- * add_all_platform_bus_fdt_nodes - create all the platform bus nodes
- *
- * builds the parent platform bus node and all the nodes of dynamic
- * sysbus devices attached to it.
- */
-static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
+void platform_bus_add_all_fdt_nodes(void *fdt, const char *intc, hwaddr addr,
+                                    hwaddr bus_size, int irq_start)
 {
     const char platcomp[] = "qemu,platform\0simple-bus";
     PlatformBusDevice *pbus;
     DeviceState *dev;
     gchar *node;
-    uint64_t addr, size;
-    int irq_start, dtb_size;
-    struct arm_boot_info *info = fdt_params->binfo;
-    const ARMPlatformBusSystemParams *params = fdt_params->system_params;
-    const char *intc = fdt_params->intc;
-    void *fdt = info->get_dtb(info, &dtb_size);
-
-    /*
-     * If the user provided a dtb, we assume the dynamic sysbus nodes
-     * already are integrated there. This corresponds to a use case where
-     * the dynamic sysbus nodes are complex and their generation is not yet
-     * supported. In that case the user can take charge of the guest dt
-     * while qemu takes charge of the qom stuff.
-     */
-    if (info->dtb_filename) {
-        return;
-    }
 
     assert(fdt);
 
-    node = g_strdup_printf("/platform@%"PRIx64, params->platform_bus_base);
-    addr = params->platform_bus_base;
-    size = params->platform_bus_size;
-    irq_start = params->platform_bus_first_irq;
+    node = g_strdup_printf("/platform@%"PRIx64, addr);
 
     /* Create a /platform node that we can put all devices into */
     qemu_fdt_add_subnode(fdt, node);
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
      */
     qemu_fdt_setprop_cells(fdt, node, "#size-cells", 1);
     qemu_fdt_setprop_cells(fdt, node, "#address-cells", 1);
-    qemu_fdt_setprop_cells(fdt, node, "ranges", 0, addr >> 32, addr, size);
+    qemu_fdt_setprop_cells(fdt, node, "ranges", 0, addr >> 32, addr, bus_size);
 
     qemu_fdt_setprop_phandle(fdt, node, "interrupt-parent", intc);
 
@@ -XXX,XX +XXX,XX @@ static void add_all_platform_bus_fdt_nodes(ARMPlatformBusFDTParams *fdt_params)
 
     g_free(node);
 }
-
-static void platform_bus_fdt_notify(Notifier *notifier, void *data)
-{
-    PlatformBusFDTNotifierParams *p = DO_UPCAST(PlatformBusFDTNotifierParams,
-                                                notifier, notifier);
-
-    add_all_platform_bus_fdt_nodes(p->fdt_params);
-    g_free(p->fdt_params);
-    g_free(p);
-}
-
-void arm_register_platform_bus_fdt_creator(ARMPlatformBusFDTParams *fdt_params)
-{
-    PlatformBusFDTNotifierParams *p = g_new(PlatformBusFDTNotifierParams, 1);
-
-    p->fdt_params = fdt_params;
-    p->notifier.notify = platform_bus_fdt_notify;
-    qemu_add_machine_init_done_notifier(&p->notifier);
-}
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 
 #define PLATFORM_BUS_NUM_IRQS 64
 
-static ARMPlatformBusSystemParams platform_bus_params;
-
 /* RAM limit in GB. Since VIRT_MEM starts at the 1GB mark, this means
  * RAM can go up to the 256GB mark, leaving 256GB of the physical
  * address space unallocated and free for future use between 256G and 512G.
@@ -XXX,XX +XXX,XX @@ static void create_platform_bus(VirtMachineState *vms, qemu_irq *pic)
     DeviceState *dev;
     SysBusDevice *s;
     int i;
-    ARMPlatformBusFDTParams *fdt_params = g_new(ARMPlatformBusFDTParams, 1);
     MemoryRegion *sysmem = get_system_memory();
 
-    platform_bus_params.platform_bus_base = vms->memmap[VIRT_PLATFORM_BUS].base;
-    platform_bus_params.platform_bus_size = vms->memmap[VIRT_PLATFORM_BUS].size;
-    platform_bus_params.platform_bus_first_irq = vms->irqmap[VIRT_PLATFORM_BUS];
-    platform_bus_params.platform_bus_num_irqs = PLATFORM_BUS_NUM_IRQS;
-
-    fdt_params->system_params = &platform_bus_params;
-    fdt_params->binfo = &vms->bootinfo;
-    fdt_params->intc = "/intc";
-    /*
-     * register a machine init done notifier that creates the device tree
-     * nodes of the platform bus and its children dynamic sysbus devices
-     */
-    arm_register_platform_bus_fdt_creator(fdt_params);
-
     dev = qdev_create(NULL, TYPE_PLATFORM_BUS_DEVICE);
     dev->id = TYPE_PLATFORM_BUS_DEVICE;
-    qdev_prop_set_uint32(dev, "num_irqs",
-        platform_bus_params.platform_bus_num_irqs);
-    qdev_prop_set_uint32(dev, "mmio_size",
-        platform_bus_params.platform_bus_size);
+    qdev_prop_set_uint32(dev, "num_irqs", PLATFORM_BUS_NUM_IRQS);
+    qdev_prop_set_uint32(dev, "mmio_size", vms->memmap[VIRT_PLATFORM_BUS].size);
     qdev_init_nofail(dev);
     vms->platform_bus_dev = dev;
-    s = SYS_BUS_DEVICE(dev);
 
-    for (i = 0; i < platform_bus_params.platform_bus_num_irqs; i++) {
-        int irqn = platform_bus_params.platform_bus_first_irq + i;
+    s = SYS_BUS_DEVICE(dev);
+    for (i = 0; i < PLATFORM_BUS_NUM_IRQS; i++) {
+        int irqn = vms->irqmap[VIRT_PLATFORM_BUS] + i;
         sysbus_connect_irq(s, i, pic[irqn]);
     }
 
     memory_region_add_subregion(sysmem,
-                                platform_bus_params.platform_bus_base,
+                                vms->memmap[VIRT_PLATFORM_BUS].base,
                                 sysbus_mmio_get_region(s, 0));
 }
 
@@ -XXX,XX +XXX,XX @@ void virt_machine_done(Notifier *notifier, void *data)
 {
     VirtMachineState *vms = container_of(notifier, VirtMachineState,
                                          machine_done);
+    ARMCPU *cpu = ARM_CPU(first_cpu);
+    struct arm_boot_info *info = &vms->bootinfo;
+    AddressSpace *as = arm_boot_address_space(cpu, info);
+
+    /*
+     * If the user provided a dtb, we assume the dynamic sysbus nodes
+     * already are integrated there. This corresponds to a use case where
+     * the dynamic sysbus nodes are complex and their generation is not yet
+     * supported. In that case the user can take charge of the guest dt
+     * while qemu takes charge of the qom stuff.
+     */
+    if (info->dtb_filename == NULL) {
+        platform_bus_add_all_fdt_nodes(vms->fdt, "/intc",
+                                       vms->memmap[VIRT_PLATFORM_BUS].base,
+                                       vms->memmap[VIRT_PLATFORM_BUS].size,
+                                       vms->irqmap[VIRT_PLATFORM_BUS]);
+    }
+    if (arm_load_dtb(info->dtb_start, info, info->dtb_limit, as) < 0) {
+        exit(1);
+    }
 
     virt_acpi_setup(vms);
     virt_build_smbios(vms);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     vms->fw_cfg = create_fw_cfg(vms, &address_space_memory);
     rom_set_fw(vms->fw_cfg);
 
-    vms->machine_done.notify = virt_machine_done;
-    qemu_add_machine_init_done_notifier(&vms->machine_done);
+    create_platform_bus(vms, pic);
 
     vms->bootinfo.ram_size = machine->ram_size;
     vms->bootinfo.kernel_filename = machine->kernel_filename;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     vms->bootinfo.board_id = -1;
     vms->bootinfo.loader_start = vms->memmap[VIRT_MEM].base;
     vms->bootinfo.get_dtb = machvirt_dtb;
+    vms->bootinfo.skip_dtb_autoload = true;
     vms->bootinfo.firmware_loaded = firmware_loaded;
     arm_load_kernel(ARM_CPU(first_cpu), &vms->bootinfo);
 
-    /*
-     * arm_load_kernel machine init done notifier registration must
-     * happen before the platform_bus_create call. In this latter,
-     * another notifier is registered which adds platform bus nodes.
-     * Notifiers are executed in registration reverse order.
-     */
-    create_platform_bus(vms, pic);
+    vms->machine_done.notify = virt_machine_done;
+    qemu_add_machine_init_done_notifier(&vms->machine_done);
 }
 
 static bool virt_get_secure(Object *obj, Error **errp)
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

Suggested-by: Eduardo Habkost <ehabkost@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1525691524-32265-5-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c              | 1 +
 hw/i386/pc.c               | 1 +
 hw/ppc/e500plat.c          | 1 +
 hw/ppc/spapr.c             | 1 +
 hw/s390x/s390-virtio-ccw.c | 1 +
 5 files changed, 5 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
+    assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = virt_machine_get_hotplug_handler;
     hc->plug = virt_machine_device_plug_cb;
 }
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_class_init(ObjectClass *oc, void *data)
     pcmc->acpi_data_size = 0x20000 + 0x8000;
     pcmc->save_tsc_khz = true;
     pcmc->linuxboot_dma_enabled = true;
+    assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = pc_get_hotpug_handler;
     mc->cpu_index_to_instance_props = pc_cpu_index_to_props;
     mc->get_default_cpu_node_id = pc_get_default_cpu_node_id;
diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_class_init(ObjectClass *oc, void *data)
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
     MachineClass *mc = MACHINE_CLASS(oc);
 
+    assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = e500plat_machine_get_hotpug_handler;
     hc->plug = e500plat_machine_device_plug_cb;
 
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -XXX,XX +XXX,XX @@ static void spapr_machine_class_init(ObjectClass *oc, void *data)
     mc->kvm_type = spapr_kvm_type;
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_SPAPR_PCI_HOST_BRIDGE);
     mc->pci_allow_0_address = true;
+    assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = spapr_get_hotplug_handler;
     hc->pre_plug = spapr_machine_device_pre_plug;
     hc->plug = spapr_machine_device_plug;
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -XXX,XX +XXX,XX @@ static void ccw_machine_class_init(ObjectClass *oc, void *data)
     mc->no_sdcard = 1;
     mc->max_cpus = S390_MAX_CPUS;
     mc->has_hotpluggable_cpus = true;
+    assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = s390_get_hotplug_handler;
     mc->cpu_index_to_instance_props = s390_cpu_index_to_props;
     mc->possible_cpu_arch_ids = s390_possible_cpu_arch_ids;
-- 
2.17.0

Some versions of gcc produce a spurious warning if the result of
__atomic_compare_echange_n() is not used and the type involved
is a signed 8 bit value:
  error: value computed is not used [-Werror=unused-value]
This has been seen on at least
 gcc (Ubuntu 5.4.0-6ubuntu1~16.04.9) 5.4.0 20160609

Work around this by using an explicit cast to void to indicate
that we don't care about the return value.

We don't currently use our atomic_cmpxchg() macro on any signed
8 bit types, but the upcoming support for the Arm v8.1-Atomics
will require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
---
 include/qemu/atomic.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/qemu/atomic.h b/include/qemu/atomic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/atomic.h
+++ b/include/qemu/atomic.h
@@ -XXX,XX +XXX,XX @@
 /* Returns the eventual value, failed or not */
 #define atomic_cmpxchg__nocheck(ptr, old, new)    ({                    \
     typeof_strip_qual(*ptr) _old = (old);                               \
-    __atomic_compare_exchange_n(ptr, &_old, new, false,                 \
+    (void)__atomic_compare_exchange_n(ptr, &_old, new, false,           \
                               __ATOMIC_SEQ_CST, __ATOMIC_SEQ_CST);      \
     _old;                                                               \
 })
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

These operations are re-invented by several targets so far.
Several supported hosts have insns for these, so place the
expanders out-of-line for a future introduction of tcg opcodes.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tcg/tcg-op.h | 16 ++++++++++++++++
 tcg/tcg-op.c | 40 ++++++++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext8u_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_ext16u_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_bswap16_i32(TCGv_i32 ret, TCGv_i32 arg);
 void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg);
+void tcg_gen_smin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
+void tcg_gen_smax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
+void tcg_gen_umin_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
+void tcg_gen_umax_i32(TCGv_i32, TCGv_i32 arg1, TCGv_i32 arg2);
 
 static inline void tcg_gen_discard_i32(TCGv_i32 arg)
 {
@@ -XXX,XX +XXX,XX @@ void tcg_gen_ext32u_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_bswap16_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_bswap32_i64(TCGv_i64 ret, TCGv_i64 arg);
 void tcg_gen_bswap64_i64(TCGv_i64 ret, TCGv_i64 arg);
+void tcg_gen_smin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
+void tcg_gen_smax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
+void tcg_gen_umin_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
+void tcg_gen_umax_i64(TCGv_i64, TCGv_i64 arg1, TCGv_i64 arg2);
 
 #if TCG_TARGET_REG_BITS == 64
 static inline void tcg_gen_discard_i64(TCGv_i64 arg)
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_mulu2_tl tcg_gen_mulu2_i64
 #define tcg_gen_muls2_tl tcg_gen_muls2_i64
 #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i64
+#define tcg_gen_smin_tl tcg_gen_smin_i64
+#define tcg_gen_umin_tl tcg_gen_umin_i64
+#define tcg_gen_smax_tl tcg_gen_smax_i64
+#define tcg_gen_umax_tl tcg_gen_umax_i64
 #define tcg_gen_atomic_cmpxchg_tl tcg_gen_atomic_cmpxchg_i64
 #define tcg_gen_atomic_xchg_tl tcg_gen_atomic_xchg_i64
 #define tcg_gen_atomic_fetch_add_tl tcg_gen_atomic_fetch_add_i64
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_mulu2_tl tcg_gen_mulu2_i32
 #define tcg_gen_muls2_tl tcg_gen_muls2_i32
 #define tcg_gen_mulsu2_tl tcg_gen_mulsu2_i32
+#define tcg_gen_smin_tl tcg_gen_smin_i32
+#define tcg_gen_umin_tl tcg_gen_umin_i32
+#define tcg_gen_smax_tl tcg_gen_smax_i32
+#define tcg_gen_umax_tl tcg_gen_umax_i32
 #define tcg_gen_atomic_cmpxchg_tl tcg_gen_atomic_cmpxchg_i32
 #define tcg_gen_atomic_xchg_tl tcg_gen_atomic_xchg_i32
 #define tcg_gen_atomic_fetch_add_tl tcg_gen_atomic_fetch_add_i32
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_bswap32_i32(TCGv_i32 ret, TCGv_i32 arg)
     }
 }
 
+void tcg_gen_smin_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
+{
+    tcg_gen_movcond_i32(TCG_COND_LT, ret, a, b, a, b);
+}
+
+void tcg_gen_umin_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
+{
+    tcg_gen_movcond_i32(TCG_COND_LTU, ret, a, b, a, b);
+}
+
+void tcg_gen_smax_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
+{
+    tcg_gen_movcond_i32(TCG_COND_LT, ret, a, b, b, a);
+}
+
+void tcg_gen_umax_i32(TCGv_i32 ret, TCGv_i32 a, TCGv_i32 b)
+{
+    tcg_gen_movcond_i32(TCG_COND_LTU, ret, a, b, b, a);
+}
+
 /* 64-bit ops */
 
 #if TCG_TARGET_REG_BITS == 32
@@ -XXX,XX +XXX,XX @@ void tcg_gen_mulsu2_i64(TCGv_i64 rl, TCGv_i64 rh, TCGv_i64 arg1, TCGv_i64 arg2)
     tcg_temp_free_i64(t2);
 }
 
+void tcg_gen_smin_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
+{
+    tcg_gen_movcond_i64(TCG_COND_LT, ret, a, b, a, b);
+}
+
+void tcg_gen_umin_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
+{
+    tcg_gen_movcond_i64(TCG_COND_LTU, ret, a, b, a, b);
+}
+
+void tcg_gen_smax_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
+{
+    tcg_gen_movcond_i64(TCG_COND_LT, ret, a, b, b, a);
+}
+
+void tcg_gen_umax_i64(TCGv_i64 ret, TCGv_i64 a, TCGv_i64 b)
+{
+    tcg_gen_movcond_i64(TCG_COND_LTU, ret, a, b, b, a);
+}
+
 /* Size changing operations.  */
 
 void tcg_gen_extrl_i64_i32(TCGv_i32 ret, TCGv_i64 arg)
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The generic expanders replace nearly identical code in the translator.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 46 ++++++++++++--------------------------
 1 file changed, 14 insertions(+), 32 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_across_lanes(DisasContext *s, uint32_t insn)
                 tcg_gen_add_i64(tcg_res, tcg_res, tcg_elt);
                 break;
             case 0x0a: /* SMAXV / UMAXV */
-                tcg_gen_movcond_i64(is_u ? TCG_COND_GEU : TCG_COND_GE,
-                                    tcg_res,
-                                    tcg_res, tcg_elt, tcg_res, tcg_elt);
+                if (is_u) {
+                    tcg_gen_umax_i64(tcg_res, tcg_res, tcg_elt);
+                } else {
+                    tcg_gen_smax_i64(tcg_res, tcg_res, tcg_elt);
+                }
                 break;
             case 0x1a: /* SMINV / UMINV */
-                tcg_gen_movcond_i64(is_u ? TCG_COND_LEU : TCG_COND_LE,
-                                    tcg_res,
-                                    tcg_res, tcg_elt, tcg_res, tcg_elt);
-                break;
+                if (is_u) {
+                    tcg_gen_umin_i64(tcg_res, tcg_res, tcg_elt);
+                } else {
+                    tcg_gen_smin_i64(tcg_res, tcg_res, tcg_elt);
+                }
                 break;
             default:
                 g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_logic(DisasContext *s, uint32_t insn)
     }
 }
 
-/* Helper functions for 32 bit comparisons */
-static void gen_max_s32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
-{
-    tcg_gen_movcond_i32(TCG_COND_GE, res, op1, op2, op1, op2);
-}
-
-static void gen_max_u32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
-{
-    tcg_gen_movcond_i32(TCG_COND_GEU, res, op1, op2, op1, op2);
-}
-
-static void gen_min_s32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
-{
-    tcg_gen_movcond_i32(TCG_COND_LE, res, op1, op2, op1, op2);
-}
-
-static void gen_min_u32(TCGv_i32 res, TCGv_i32 op1, TCGv_i32 op2)
-{
-    tcg_gen_movcond_i32(TCG_COND_LEU, res, op1, op2, op1, op2);
-}
-
 /* Pairwise op subgroup of C3.6.16.
  *
  * This is called directly or via the handle_3same_float for float pairwise
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
                 static NeonGenTwoOpFn * const fns[3][2] = {
                     { gen_helper_neon_pmax_s8, gen_helper_neon_pmax_u8 },
                     { gen_helper_neon_pmax_s16, gen_helper_neon_pmax_u16 },
-                    { gen_max_s32, gen_max_u32 },
+                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
                 };
                 genfn = fns[size][u];
                 break;
@@ -XXX,XX +XXX,XX @@ static void handle_simd_3same_pair(DisasContext *s, int is_q, int u, int opcode,
                 static NeonGenTwoOpFn * const fns[3][2] = {
                     { gen_helper_neon_pmin_s8, gen_helper_neon_pmin_u8 },
                     { gen_helper_neon_pmin_s16, gen_helper_neon_pmin_u16 },
-                    { gen_min_s32, gen_min_u32 },
+                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
                 };
                 genfn = fns[size][u];
                 break;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                 static NeonGenTwoOpFn * const fns[3][2] = {
                     { gen_helper_neon_max_s8, gen_helper_neon_max_u8 },
                     { gen_helper_neon_max_s16, gen_helper_neon_max_u16 },
-                    { gen_max_s32, gen_max_u32 },
+                    { tcg_gen_smax_i32, tcg_gen_umax_i32 },
                 };
                 genfn = fns[size][u];
                 break;
@@ -XXX,XX +XXX,XX @@ static void disas_simd_3same_int(DisasContext *s, uint32_t insn)
                 static NeonGenTwoOpFn * const fns[3][2] = {
                     { gen_helper_neon_min_s8, gen_helper_neon_min_u8 },
                     { gen_helper_neon_min_s16, gen_helper_neon_min_u16 },
-                    { gen_min_s32, gen_min_u32 },
+                    { tcg_gen_smin_i32, tcg_gen_umin_i32 },
                 };
                 genfn = fns[size][u];
                 break;
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The generic expanders replace nearly identical code in the translator.

Acked-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/xtensa/translate.c | 50 ++++++++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -XXX,XX +XXX,XX @@ static void translate_clamps(DisasContext *dc, const uint32_t arg[],
         TCGv_i32 tmp1 = tcg_const_i32(-1u << arg[2]);
         TCGv_i32 tmp2 = tcg_const_i32((1 << arg[2]) - 1);
 
-        tcg_gen_movcond_i32(TCG_COND_GT, tmp1,
-                            cpu_R[arg[1]], tmp1, cpu_R[arg[1]], tmp1);
-        tcg_gen_movcond_i32(TCG_COND_LT, cpu_R[arg[0]],
-                            tmp1, tmp2, tmp1, tmp2);
+        tcg_gen_smax_i32(tmp1, tmp1, cpu_R[arg[1]]);
+        tcg_gen_smin_i32(cpu_R[arg[0]], tmp1, tmp2);
         tcg_temp_free(tmp1);
         tcg_temp_free(tmp2);
     }
@@ -XXX,XX +XXX,XX @@ static void translate_memw(DisasContext *dc, const uint32_t arg[],
     tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
 }
 
-static void translate_minmax(DisasContext *dc, const uint32_t arg[],
-                             const uint32_t par[])
+static void translate_smin(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
 {
     if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
-        tcg_gen_movcond_i32(par[0], cpu_R[arg[0]],
-                            cpu_R[arg[1]], cpu_R[arg[2]],
-                            cpu_R[arg[1]], cpu_R[arg[2]]);
+        tcg_gen_smin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
+    }
+}
+
+static void translate_umin(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
+{
+    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
+        tcg_gen_umin_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
+    }
+}
+
+static void translate_smax(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
+{
+    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
+        tcg_gen_smax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
+    }
+}
+
+static void translate_umax(DisasContext *dc, const uint32_t arg[],
+                           const uint32_t par[])
+{
+    if (gen_window_check3(dc, arg[0], arg[1], arg[2])) {
+        tcg_gen_umax_i32(cpu_R[arg[0]], cpu_R[arg[1]], cpu_R[arg[2]]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static const XtensaOpcodeOps core_ops[] = {
         .par = (const uint32_t[]){TCG_COND_NE},
     }, {
         .name = "max",
-        .translate = translate_minmax,
-        .par = (const uint32_t[]){TCG_COND_GE},
+        .translate = translate_smax,
     }, {
         .name = "maxu",
-        .translate = translate_minmax,
-        .par = (const uint32_t[]){TCG_COND_GEU},
+        .translate = translate_umax,
     }, {
         .name = "memw",
         .translate = translate_memw,
     }, {
         .name = "min",
-        .translate = translate_minmax,
-        .par = (const uint32_t[]){TCG_COND_LT},
+        .translate = translate_smin,
     }, {
         .name = "minu",
-        .translate = translate_minmax,
-        .par = (const uint32_t[]){TCG_COND_LTU},
+        .translate = translate_umin,
     }, {
         .name = "mov",
         .translate = translate_mov,
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Given that this atomic operation will be used by both risc-v
and aarch64, let's not duplicate code across the two targets.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_template.h | 71 +++++++++++++++++++++++++++++++++++++
 accel/tcg/tcg-runtime.h     |  8 +++++
 tcg/tcg-op.h                | 34 ++++++++++++++++++
 tcg/tcg.h                   |  8 +++++
 tcg/tcg-op.c                |  8 +++++
 5 files changed, 129 insertions(+)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@
 #elif DATA_SIZE == 8
 # define SUFFIX     q
 # define DATA_TYPE  uint64_t
+# define SDATA_TYPE int64_t
 # define BSWAP      bswap64
 #elif DATA_SIZE == 4
 # define SUFFIX     l
 # define DATA_TYPE  uint32_t
+# define SDATA_TYPE int32_t
 # define BSWAP      bswap32
 #elif DATA_SIZE == 2
 # define SUFFIX     w
 # define DATA_TYPE  uint16_t
+# define SDATA_TYPE int16_t
 # define BSWAP      bswap16
 #elif DATA_SIZE == 1
 # define SUFFIX     b
 # define DATA_TYPE  uint8_t
+# define SDATA_TYPE int8_t
 # define BSWAP
 #else
 # error unsupported data size
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(or_fetch)
 GEN_ATOMIC_HELPER(xor_fetch)
 
 #undef GEN_ATOMIC_HELPER
+
+/* These helpers are, as a whole, full barriers.  Within the helper,
+ * the leading barrier is explicit and the trailing barrier is within
+ * cmpxchg primitive.
+ */
+#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+                        ABI_TYPE xval EXTRA_ARGS)                   \
+{                                                                   \
+    ATOMIC_MMU_DECLS;                                               \
+    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
+    XDATA_TYPE cmp, old, new, val = xval;                           \
+    smp_mb();                                                       \
+    cmp = atomic_read__nocheck(haddr);                              \
+    do {                                                            \
+        old = cmp; new = FN(old, val);                              \
+        cmp = atomic_cmpxchg__nocheck(haddr, old, new);             \
+    } while (cmp != old);                                           \
+    ATOMIC_MMU_CLEANUP;                                             \
+    return RET;                                                     \
+}
+
+GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
+
+GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
+
+#undef GEN_ATOMIC_HELPER_FN
 #endif /* DATA SIZE >= 16 */
 
 #undef END
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
         ldo = ldn;
     }
 }
+
+/* These helpers are, as a whole, full barriers.  Within the helper,
+ * the leading barrier is explicit and the trailing barrier is within
+ * cmpxchg primitive.
+ */
+#define GEN_ATOMIC_HELPER_FN(X, FN, XDATA_TYPE, RET)                \
+ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+                        ABI_TYPE xval EXTRA_ARGS)                   \
+{                                                                   \
+    ATOMIC_MMU_DECLS;                                               \
+    XDATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                          \
+    XDATA_TYPE ldo, ldn, old, new, val = xval;                      \
+    smp_mb();                                                       \
+    ldn = atomic_read__nocheck(haddr);                              \
+    do {                                                            \
+        ldo = ldn; old = BSWAP(ldo); new = FN(old, val);            \
+        ldn = atomic_cmpxchg__nocheck(haddr, ldo, BSWAP(new));      \
+    } while (ldo != ldn);                                           \
+    ATOMIC_MMU_CLEANUP;                                             \
+    return RET;                                                     \
+}
+
+GEN_ATOMIC_HELPER_FN(fetch_smin, MIN, SDATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_umin, MIN,  DATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_smax, MAX, SDATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(fetch_umax, MAX,  DATA_TYPE, old)
+
+GEN_ATOMIC_HELPER_FN(smin_fetch, MIN, SDATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
+GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
+
+#undef GEN_ATOMIC_HELPER_FN
 #endif /* DATA_SIZE >= 16 */
 
 #undef END
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
 #undef BSWAP
 #undef ABI_TYPE
 #undef DATA_TYPE
+#undef SDATA_TYPE
 #undef SUFFIX
 #undef DATA_SIZE
diff --git a/accel/tcg/tcg-runtime.h b/accel/tcg/tcg-runtime.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPERS(fetch_add)
 GEN_ATOMIC_HELPERS(fetch_and)
 GEN_ATOMIC_HELPERS(fetch_or)
 GEN_ATOMIC_HELPERS(fetch_xor)
+GEN_ATOMIC_HELPERS(fetch_smin)
+GEN_ATOMIC_HELPERS(fetch_umin)
+GEN_ATOMIC_HELPERS(fetch_smax)
+GEN_ATOMIC_HELPERS(fetch_umax)
 
 GEN_ATOMIC_HELPERS(add_fetch)
 GEN_ATOMIC_HELPERS(and_fetch)
 GEN_ATOMIC_HELPERS(or_fetch)
 GEN_ATOMIC_HELPERS(xor_fetch)
+GEN_ATOMIC_HELPERS(smin_fetch)
+GEN_ATOMIC_HELPERS(umin_fetch)
+GEN_ATOMIC_HELPERS(smax_fetch)
+GEN_ATOMIC_HELPERS(umax_fetch)
 
 GEN_ATOMIC_HELPERS(xchg)
 
diff --git a/tcg/tcg-op.h b/tcg/tcg-op.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.h
+++ b/tcg/tcg-op.h
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_cmpxchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGv_i64,
 
 void tcg_gen_atomic_xchg_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_xchg_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+
 void tcg_gen_atomic_fetch_add_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_fetch_add_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 void tcg_gen_atomic_fetch_and_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_fetch_or_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_fetch_or_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 void tcg_gen_atomic_fetch_xor_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_fetch_xor_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_smin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_smin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_umin_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_umin_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_smax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_smax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_umax_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_fetch_umax_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+
 void tcg_gen_atomic_add_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_add_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 void tcg_gen_atomic_and_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_atomic_or_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_or_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 void tcg_gen_atomic_xor_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
 void tcg_gen_atomic_xor_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_smin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_smin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_umin_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_umin_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_smax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_smax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
+void tcg_gen_atomic_umax_fetch_i32(TCGv_i32, TCGv, TCGv_i32, TCGArg, TCGMemOp);
+void tcg_gen_atomic_umax_fetch_i64(TCGv_i64, TCGv, TCGv_i64, TCGArg, TCGMemOp);
 
 void tcg_gen_mov_vec(TCGv_vec, TCGv_vec);
 void tcg_gen_dup_i32_vec(unsigned vece, TCGv_vec, TCGv_i32);
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_atomic_fetch_and_tl tcg_gen_atomic_fetch_and_i64
 #define tcg_gen_atomic_fetch_or_tl tcg_gen_atomic_fetch_or_i64
 #define tcg_gen_atomic_fetch_xor_tl tcg_gen_atomic_fetch_xor_i64
+#define tcg_gen_atomic_fetch_smin_tl tcg_gen_atomic_fetch_smin_i64
+#define tcg_gen_atomic_fetch_umin_tl tcg_gen_atomic_fetch_umin_i64
+#define tcg_gen_atomic_fetch_smax_tl tcg_gen_atomic_fetch_smax_i64
+#define tcg_gen_atomic_fetch_umax_tl tcg_gen_atomic_fetch_umax_i64
 #define tcg_gen_atomic_add_fetch_tl tcg_gen_atomic_add_fetch_i64
 #define tcg_gen_atomic_and_fetch_tl tcg_gen_atomic_and_fetch_i64
 #define tcg_gen_atomic_or_fetch_tl tcg_gen_atomic_or_fetch_i64
 #define tcg_gen_atomic_xor_fetch_tl tcg_gen_atomic_xor_fetch_i64
+#define tcg_gen_atomic_smin_fetch_tl tcg_gen_atomic_smin_fetch_i64
+#define tcg_gen_atomic_umin_fetch_tl tcg_gen_atomic_umin_fetch_i64
+#define tcg_gen_atomic_smax_fetch_tl tcg_gen_atomic_smax_fetch_i64
+#define tcg_gen_atomic_umax_fetch_tl tcg_gen_atomic_umax_fetch_i64
 #define tcg_gen_dup_tl_vec  tcg_gen_dup_i64_vec
 #else
 #define tcg_gen_movi_tl tcg_gen_movi_i32
@@ -XXX,XX +XXX,XX @@ void tcg_gen_stl_vec(TCGv_vec r, TCGv_ptr base, TCGArg offset, TCGType t);
 #define tcg_gen_atomic_fetch_and_tl tcg_gen_atomic_fetch_and_i32
 #define tcg_gen_atomic_fetch_or_tl tcg_gen_atomic_fetch_or_i32
 #define tcg_gen_atomic_fetch_xor_tl tcg_gen_atomic_fetch_xor_i32
+#define tcg_gen_atomic_fetch_smin_tl tcg_gen_atomic_fetch_smin_i32
+#define tcg_gen_atomic_fetch_umin_tl tcg_gen_atomic_fetch_umin_i32
+#define tcg_gen_atomic_fetch_smax_tl tcg_gen_atomic_fetch_smax_i32
+#define tcg_gen_atomic_fetch_umax_tl tcg_gen_atomic_fetch_umax_i32
 #define tcg_gen_atomic_add_fetch_tl tcg_gen_atomic_add_fetch_i32
 #define tcg_gen_atomic_and_fetch_tl tcg_gen_atomic_and_fetch_i32
 #define tcg_gen_atomic_or_fetch_tl tcg_gen_atomic_or_fetch_i32
 #define tcg_gen_atomic_xor_fetch_tl tcg_gen_atomic_xor_fetch_i32
+#define tcg_gen_atomic_smin_fetch_tl tcg_gen_atomic_smin_fetch_i32
+#define tcg_gen_atomic_umin_fetch_tl tcg_gen_atomic_umin_fetch_i32
+#define tcg_gen_atomic_smax_fetch_tl tcg_gen_atomic_smax_fetch_i32
+#define tcg_gen_atomic_umax_fetch_tl tcg_gen_atomic_umax_fetch_i32
 #define tcg_gen_dup_tl_vec  tcg_gen_dup_i32_vec
 #endif
 
diff --git a/tcg/tcg.h b/tcg/tcg.h
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg.h
+++ b/tcg/tcg.h
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER_ALL(fetch_sub)
 GEN_ATOMIC_HELPER_ALL(fetch_and)
 GEN_ATOMIC_HELPER_ALL(fetch_or)
 GEN_ATOMIC_HELPER_ALL(fetch_xor)
+GEN_ATOMIC_HELPER_ALL(fetch_smin)
+GEN_ATOMIC_HELPER_ALL(fetch_umin)
+GEN_ATOMIC_HELPER_ALL(fetch_smax)
+GEN_ATOMIC_HELPER_ALL(fetch_umax)
 
 GEN_ATOMIC_HELPER_ALL(add_fetch)
 GEN_ATOMIC_HELPER_ALL(sub_fetch)
 GEN_ATOMIC_HELPER_ALL(and_fetch)
 GEN_ATOMIC_HELPER_ALL(or_fetch)
 GEN_ATOMIC_HELPER_ALL(xor_fetch)
+GEN_ATOMIC_HELPER_ALL(smin_fetch)
+GEN_ATOMIC_HELPER_ALL(umin_fetch)
+GEN_ATOMIC_HELPER_ALL(smax_fetch)
+GEN_ATOMIC_HELPER_ALL(umax_fetch)
 
 GEN_ATOMIC_HELPER_ALL(xchg)
 
diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(fetch_add, add, 0)
 GEN_ATOMIC_HELPER(fetch_and, and, 0)
 GEN_ATOMIC_HELPER(fetch_or, or, 0)
 GEN_ATOMIC_HELPER(fetch_xor, xor, 0)
+GEN_ATOMIC_HELPER(fetch_smin, smin, 0)
+GEN_ATOMIC_HELPER(fetch_umin, umin, 0)
+GEN_ATOMIC_HELPER(fetch_smax, smax, 0)
+GEN_ATOMIC_HELPER(fetch_umax, umax, 0)
 
 GEN_ATOMIC_HELPER(add_fetch, add, 1)
 GEN_ATOMIC_HELPER(and_fetch, and, 1)
 GEN_ATOMIC_HELPER(or_fetch, or, 1)
 GEN_ATOMIC_HELPER(xor_fetch, xor, 1)
+GEN_ATOMIC_HELPER(smin_fetch, smin, 1)
+GEN_ATOMIC_HELPER(umin_fetch, umin, 1)
+GEN_ATOMIC_HELPER(smax_fetch, smax, 1)
+GEN_ATOMIC_HELPER(umax_fetch, umax, 1)
 
 static void tcg_gen_mov2_i32(TCGv_i32 r, TCGv_i32 a, TCGv_i32 b)
 {
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-6-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_template.h | 49 ++++++-------------------------------
 1 file changed, 7 insertions(+), 42 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER(xor_fetch)
 
 #undef GEN_ATOMIC_HELPER
 
-/* Note that for addition, we need to use a separate cmpxchg loop instead
-   of bswaps for the reverse-host-endian helpers.  */
-ABI_TYPE ATOMIC_NAME(fetch_add)(CPUArchState *env, target_ulong addr,
-                         ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ldo, ldn, ret, sto;
-
-    ldo = atomic_read__nocheck(haddr);
-    while (1) {
-        ret = BSWAP(ldo);
-        sto = BSWAP(ret + val);
-        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
-        if (ldn == ldo) {
-            ATOMIC_MMU_CLEANUP;
-            return ret;
-        }
-        ldo = ldn;
-    }
-}
-
-ABI_TYPE ATOMIC_NAME(add_fetch)(CPUArchState *env, target_ulong addr,
-                         ABI_TYPE val EXTRA_ARGS)
-{
-    ATOMIC_MMU_DECLS;
-    DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;
-    DATA_TYPE ldo, ldn, ret, sto;
-
-    ldo = atomic_read__nocheck(haddr);
-    while (1) {
-        ret = BSWAP(ldo) + val;
-        sto = BSWAP(ret);
-        ldn = atomic_cmpxchg__nocheck(haddr, ldo, sto);
-        if (ldn == ldo) {
-            ATOMIC_MMU_CLEANUP;
-            return ret;
-        }
-        ldo = ldn;
-    }
-}
-
 /* These helpers are, as a whole, full barriers.  Within the helper,
  * the leading barrier is explicit and the trailing barrier is within
  * cmpxchg primitive.
@@ -XXX,XX +XXX,XX @@ GEN_ATOMIC_HELPER_FN(umin_fetch, MIN,  DATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 
+/* Note that for addition, we need to use a separate cmpxchg loop instead
+   of bswaps for the reverse-host-endian helpers.  */
+#define ADD(X, Y)   (X + Y)
+GEN_ATOMIC_HELPER_FN(fetch_add, ADD, DATA_TYPE, old)
+GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
+#undef ADD
+
 #undef GEN_ATOMIC_HELPER_FN
 #endif /* DATA_SIZE >= 16 */
 
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Michael Clark <mjc@sifive.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/riscv/translate.c | 72 +++++++++++-----------------------------
 1 file changed, 20 insertions(+), 52 deletions(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_atomic(DisasContext *ctx, uint32_t opc,
     TCGv src1, src2, dat;
     TCGLabel *l1, *l2;
     TCGMemOp mop;
-    TCGCond cond;
     bool aq, rl;
 
     /* Extract the size of the atomic operation.  */
@@ -XXX,XX +XXX,XX @@ static void gen_atomic(DisasContext *ctx, uint32_t opc,
         tcg_gen_atomic_fetch_or_tl(src2, src1, src2, ctx->mem_idx, mop);
         gen_set_gpr(rd, src2);
         break;
-
     case OPC_RISC_AMOMIN:
-        cond = TCG_COND_LT;
-        goto do_minmax;
-    case OPC_RISC_AMOMAX:
-        cond = TCG_COND_GT;
-        goto do_minmax;
-    case OPC_RISC_AMOMINU:
-        cond = TCG_COND_LTU;
-        goto do_minmax;
-    case OPC_RISC_AMOMAXU:
-        cond = TCG_COND_GTU;
-        goto do_minmax;
-    do_minmax:
-        /* Handle the RL barrier.  The AQ barrier is handled along the
-           parallel path by the SC atomic cmpxchg.  On the serial path,
-           of course, barriers do not matter.  */
-        if (rl) {
-            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
-        }
-        if (tb_cflags(ctx->tb) & CF_PARALLEL) {
-            l1 = gen_new_label();
-            gen_set_label(l1);
-        } else {
-            l1 = NULL;
-        }
-
         gen_get_gpr(src1, rs1);
         gen_get_gpr(src2, rs2);
-        if ((mop & MO_SSIZE) == MO_SL) {
-            /* Sign-extend the register comparison input.  */
-            tcg_gen_ext32s_tl(src2, src2);
-        }
-        dat = tcg_temp_local_new();
-        tcg_gen_qemu_ld_tl(dat, src1, ctx->mem_idx, mop);
-        tcg_gen_movcond_tl(cond, src2, dat, src2, dat, src2);
-
-        if (tb_cflags(ctx->tb) & CF_PARALLEL) {
-            /* Parallel context.  Make this operation atomic by verifying
-               that the memory didn't change while we computed the result.  */
-            tcg_gen_atomic_cmpxchg_tl(src2, src1, dat, src2, ctx->mem_idx, mop);
-
-            /* If the cmpxchg failed, retry. */
-            /* ??? There is an assumption here that this will eventually
-               succeed, such that we don't live-lock.  This is not unlike
-               a similar loop that the compiler would generate for e.g.
-               __atomic_fetch_and_xor, so don't worry about it.  */
-            tcg_gen_brcond_tl(TCG_COND_NE, dat, src2, l1);
-        } else {
-            /* Serial context.  Directly store the result.  */
-            tcg_gen_qemu_st_tl(src2, src1, ctx->mem_idx, mop);
-        }
-        gen_set_gpr(rd, dat);
-        tcg_temp_free(dat);
+        tcg_gen_atomic_fetch_smin_tl(src2, src1, src2, ctx->mem_idx, mop);
+        gen_set_gpr(rd, src2);
+        break;
+    case OPC_RISC_AMOMAX:
+        gen_get_gpr(src1, rs1);
+        gen_get_gpr(src2, rs2);
+        tcg_gen_atomic_fetch_smax_tl(src2, src1, src2, ctx->mem_idx, mop);
+        gen_set_gpr(rd, src2);
+        break;
+    case OPC_RISC_AMOMINU:
+        gen_get_gpr(src1, rs1);
+        gen_get_gpr(src2, rs2);
+        tcg_gen_atomic_fetch_umin_tl(src2, src1, src2, ctx->mem_idx, mop);
+        gen_set_gpr(rd, src2);
+        break;
+    case OPC_RISC_AMOMAXU:
+        gen_get_gpr(src1, rs1);
+        gen_get_gpr(src2, rs2);
+        tcg_gen_atomic_fetch_umax_tl(src2, src1, src2, ctx->mem_idx, mop);
+        gen_set_gpr(rd, src2);
         break;
 
     default:
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The insns in the ARMv8.1-Atomics are added to the existing
load/store exclusive and load/store reg opcode spaces.
Rearrange the top-level decoders for these to accomodate.
The Atomics insns themselves still generate Unallocated.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-8-richard.henderson@linaro.org
[PMM: Drop the ARM_FEATURE_V8_1 feature flag]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |   1 +
 linux-user/elfload.c       |   1 +
 target/arm/translate-a64.c | 182 +++++++++++++++++++++++++++----------
 3 files changed, 138 insertions(+), 46 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V8_SHA3, /* implements SHA3 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_SM3, /* implements SM3 part of v8 Crypto Extensions */
     ARM_FEATURE_V8_SM4, /* implements SM4 part of v8 Crypto Extensions */
+    ARM_FEATURE_V8_ATOMICS, /* ARMv8.1-Atomics feature */
     ARM_FEATURE_V8_RDM, /* implements v8.1 simd round multiply */
     ARM_FEATURE_V8_FP16, /* implements v8.2 half-precision float */
     ARM_FEATURE_V8_FCMA, /* has complex number part of v8.3 extensions.  */
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
     GET_FEATURE(ARM_FEATURE_V8_SHA512, ARM_HWCAP_A64_SHA512);
     GET_FEATURE(ARM_FEATURE_V8_FP16,
                 ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+    GET_FEATURE(ARM_FEATURE_V8_ATOMICS, ARM_HWCAP_A64_ATOMICS);
     GET_FEATURE(ARM_FEATURE_V8_RDM, ARM_HWCAP_A64_ASIMDRDM);
     GET_FEATURE(ARM_FEATURE_V8_FCMA, ARM_HWCAP_A64_FCMA);
 #undef GET_FEATURE
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
     int rt = extract32(insn, 0, 5);
     int rn = extract32(insn, 5, 5);
     int rt2 = extract32(insn, 10, 5);
-    int is_lasr = extract32(insn, 15, 1);
     int rs = extract32(insn, 16, 5);
-    int is_pair = extract32(insn, 21, 1);
-    int is_store = !extract32(insn, 22, 1);
-    int is_excl = !extract32(insn, 23, 1);
+    int is_lasr = extract32(insn, 15, 1);
+    int o2_L_o1_o0 = extract32(insn, 21, 3) * 2 | is_lasr;
     int size = extract32(insn, 30, 2);
     TCGv_i64 tcg_addr;
 
-    if ((!is_excl && !is_pair && !is_lasr) ||
-        (!is_excl && is_pair) ||
-        (is_pair && size < 2)) {
-        unallocated_encoding(s);
+    switch (o2_L_o1_o0) {
+    case 0x0: /* STXR */
+    case 0x1: /* STLXR */
+        if (rn == 31) {
+            gen_check_sp_alignment(s);
+        }
+        if (is_lasr) {
+            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
+        }
+        tcg_addr = read_cpu_reg_sp(s, rn, 1);
+        gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, false);
         return;
-    }
 
-    if (rn == 31) {
-        gen_check_sp_alignment(s);
-    }
-    tcg_addr = read_cpu_reg_sp(s, rn, 1);
-
-    /* Note that since TCG is single threaded load-acquire/store-release
-     * semantics require no extra if (is_lasr) { ... } handling.
-     */
-
-    if (is_excl) {
-        if (!is_store) {
-            s->is_ldex = true;
-            gen_load_exclusive(s, rt, rt2, tcg_addr, size, is_pair);
-            if (is_lasr) {
-                tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
-            }
-        } else {
-            if (is_lasr) {
-                tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
-            }
-            gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, is_pair);
+    case 0x4: /* LDXR */
+    case 0x5: /* LDAXR */
+        if (rn == 31) {
+            gen_check_sp_alignment(s);
         }
-    } else {
-        TCGv_i64 tcg_rt = cpu_reg(s, rt);
-        bool iss_sf = disas_ldst_compute_iss_sf(size, false, 0);
+        tcg_addr = read_cpu_reg_sp(s, rn, 1);
+        s->is_ldex = true;
+        gen_load_exclusive(s, rt, rt2, tcg_addr, size, false);
+        if (is_lasr) {
+            tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
+        }
+        return;
 
+    case 0x9: /* STLR */
         /* Generate ISS for non-exclusive accesses including LASR.  */
-        if (is_store) {
+        if (rn == 31) {
+            gen_check_sp_alignment(s);
+        }
+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
+        tcg_addr = read_cpu_reg_sp(s, rn, 1);
+        do_gpr_st(s, cpu_reg(s, rt), tcg_addr, size, true, rt,
+                  disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
+        return;
+
+    case 0xd: /* LDAR */
+        /* Generate ISS for non-exclusive accesses including LASR.  */
+        if (rn == 31) {
+            gen_check_sp_alignment(s);
+        }
+        tcg_addr = read_cpu_reg_sp(s, rn, 1);
+        do_gpr_ld(s, cpu_reg(s, rt), tcg_addr, size, false, false, true, rt,
+                  disas_ldst_compute_iss_sf(size, false, 0), is_lasr);
+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
+        return;
+
+    case 0x2: case 0x3: /* CASP / STXP */
+        if (size & 2) { /* STXP / STLXP */
+            if (rn == 31) {
+                gen_check_sp_alignment(s);
+            }
             if (is_lasr) {
                 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
             }
-            do_gpr_st(s, tcg_rt, tcg_addr, size,
-                      true, rt, iss_sf, is_lasr);
-        } else {
-            do_gpr_ld(s, tcg_rt, tcg_addr, size, false, false,
-                      true, rt, iss_sf, is_lasr);
+            tcg_addr = read_cpu_reg_sp(s, rn, 1);
+            gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, true);
+            return;
+        }
+        /* CASP / CASPL */
+        break;
+
+    case 0x6: case 0x7: /* CASP / LDXP */
+        if (size & 2) { /* LDXP / LDAXP */
+            if (rn == 31) {
+                gen_check_sp_alignment(s);
+            }
+            tcg_addr = read_cpu_reg_sp(s, rn, 1);
+            s->is_ldex = true;
+            gen_load_exclusive(s, rt, rt2, tcg_addr, size, true);
             if (is_lasr) {
                 tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
             }
+            return;
         }
+        /* CASPA / CASPAL */
+        break;
+
+    case 0xa: /* CAS */
+    case 0xb: /* CASL */
+    case 0xe: /* CASA */
+    case 0xf: /* CASAL */
+        break;
     }
+    unallocated_encoding(s);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_unsigned_imm(DisasContext *s, uint32_t insn,
     }
 }
 
+/* Atomic memory operations
+ *
+ *  31  30      27  26    24    22  21   16   15    12    10    5     0
+ * +------+-------+---+-----+-----+---+----+----+-----+-----+----+-----+
+ * | size | 1 1 1 | V | 0 0 | A R | 1 | Rs | o3 | opc | 0 0 | Rn |  Rt |
+ * +------+-------+---+-----+-----+--------+----+-----+-----+----+-----+
+ *
+ * Rt: the result register
+ * Rn: base address or SP
+ * Rs: the source register for the operation
+ * V: vector flag (always 0 as of v8.3)
+ * A: acquire flag
+ * R: release flag
+ */
+static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
+                              int size, int rt, bool is_vector)
+{
+    int rs = extract32(insn, 16, 5);
+    int rn = extract32(insn, 5, 5);
+    int o3_opc = extract32(insn, 12, 4);
+    int feature = ARM_FEATURE_V8_ATOMICS;
+
+    if (is_vector) {
+        unallocated_encoding(s);
+        return;
+    }
+    switch (o3_opc) {
+    case 000: /* LDADD */
+    case 001: /* LDCLR */
+    case 002: /* LDEOR */
+    case 003: /* LDSET */
+    case 004: /* LDSMAX */
+    case 005: /* LDSMIN */
+    case 006: /* LDUMAX */
+    case 007: /* LDUMIN */
+    case 010: /* SWP */
+    default:
+        unallocated_encoding(s);
+        return;
+    }
+    if (!arm_dc_feature(s, feature)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    (void)rs;
+    (void)rn;
+}
+
 /* Load/store register (all forms) */
 static void disas_ldst_reg(DisasContext *s, uint32_t insn)
 {
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg(DisasContext *s, uint32_t insn)
 
     switch (extract32(insn, 24, 2)) {
     case 0:
-        if (extract32(insn, 21, 1) == 1 && extract32(insn, 10, 2) == 2) {
-            disas_ldst_reg_roffset(s, insn, opc, size, rt, is_vector);
-        } else {
+        if (extract32(insn, 21, 1) == 0) {
             /* Load/store register (unscaled immediate)
              * Load/store immediate pre/post-indexed
              * Load/store register unprivileged
              */
             disas_ldst_reg_imm9(s, insn, opc, size, rt, is_vector);
+            return;
+        }
+        switch (extract32(insn, 10, 2)) {
+        case 0:
+            disas_ldst_atomic(s, insn, size, rt, is_vector);
+            return;
+        case 2:
+            disas_ldst_reg_roffset(s, insn, opc, size, rt, is_vector);
+            return;
         }
         break;
     case 1:
         disas_ldst_reg_unsigned_imm(s, insn, opc, size, rt, is_vector);
-        break;
-    default:
-        unallocated_encoding(s);
-        break;
+        return;
     }
+    unallocated_encoding(s);
 }
 
 /* AdvSIMD load/store multiple structures
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

This implements all of the v8.1-Atomics instructions except
for compare-and-swap, which is decoded elsewhere.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 36 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
 typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
 typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
+typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, TCGMemOp);
 
 /* Note that the gvec expanders operate on offsets + sizes.  */
 typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
     int rn = extract32(insn, 5, 5);
     int o3_opc = extract32(insn, 12, 4);
     int feature = ARM_FEATURE_V8_ATOMICS;
+    TCGv_i64 tcg_rn, tcg_rs;
+    AtomicThreeOpFn *fn;
 
     if (is_vector) {
         unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
     }
     switch (o3_opc) {
     case 000: /* LDADD */
+        fn = tcg_gen_atomic_fetch_add_i64;
+        break;
     case 001: /* LDCLR */
+        fn = tcg_gen_atomic_fetch_and_i64;
+        break;
     case 002: /* LDEOR */
+        fn = tcg_gen_atomic_fetch_xor_i64;
+        break;
     case 003: /* LDSET */
+        fn = tcg_gen_atomic_fetch_or_i64;
+        break;
     case 004: /* LDSMAX */
+        fn = tcg_gen_atomic_fetch_smax_i64;
+        break;
     case 005: /* LDSMIN */
+        fn = tcg_gen_atomic_fetch_smin_i64;
+        break;
     case 006: /* LDUMAX */
+        fn = tcg_gen_atomic_fetch_umax_i64;
+        break;
     case 007: /* LDUMIN */
+        fn = tcg_gen_atomic_fetch_umin_i64;
+        break;
     case 010: /* SWP */
+        fn = tcg_gen_atomic_xchg_i64;
+        break;
     default:
         unallocated_encoding(s);
         return;
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
         return;
     }
 
-    (void)rs;
-    (void)rn;
+    if (rn == 31) {
+        gen_check_sp_alignment(s);
+    }
+    tcg_rn = cpu_reg_sp(s, rn);
+    tcg_rs = read_cpu_reg(s, rs, true);
+
+    if (o3_opc == 1) { /* LDCLR */
+        tcg_gen_not_i64(tcg_rs, tcg_rs);
+    }
+
+    /* The tcg atomic primitives are all full barriers.  Therefore we
+     * can ignore the Acquire and Release bits of this instruction.
+     */
+    fn(cpu_reg(s, rt), tcg_rn, tcg_rs, get_mem_index(s),
+       s->be_data | size | MO_ALIGN);
 }
 
 /* Load/store register (all forms) */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180508151437.4232-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |   2 +
 target/arm/helper-a64.c    |  43 ++++++++++++++
 target/arm/translate-a64.c | 119 ++++++++++++++++++++++++++++++++++++-
 3 files changed, 161 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(paired_cmpxchg64_le_parallel, TCG_CALL_NO_WG,
 DEF_HELPER_FLAGS_4(paired_cmpxchg64_be, TCG_CALL_NO_WG, i64, env, i64, i64, i64)
 DEF_HELPER_FLAGS_4(paired_cmpxchg64_be_parallel, TCG_CALL_NO_WG,
                    i64, env, i64, i64, i64)
+DEF_HELPER_5(casp_le_parallel, void, env, i32, i64, i64, i64)
+DEF_HELPER_5(casp_be_parallel, void, env, i32, i64, i64, i64)
 DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
 DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
 DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(paired_cmpxchg64_be_parallel)(CPUARMState *env, uint64_t addr,
     return do_paired_cmpxchg64_be(env, addr, new_lo, new_hi, true, GETPC());
 }
 
+/* Writes back the old data into Rs.  */
+void HELPER(casp_le_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
+                              uint64_t new_lo, uint64_t new_hi)
+{
+    uintptr_t ra = GETPC();
+#ifndef CONFIG_ATOMIC128
+    cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
+#else
+    Int128 oldv, cmpv, newv;
+
+    cmpv = int128_make128(env->xregs[rs], env->xregs[rs + 1]);
+    newv = int128_make128(new_lo, new_hi);
+
+    int mem_idx = cpu_mmu_index(env, false);
+    TCGMemOpIdx oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
+    oldv = helper_atomic_cmpxchgo_le_mmu(env, addr, cmpv, newv, oi, ra);
+
+    env->xregs[rs] = int128_getlo(oldv);
+    env->xregs[rs + 1] = int128_gethi(oldv);
+#endif
+}
+
+void HELPER(casp_be_parallel)(CPUARMState *env, uint32_t rs, uint64_t addr,
+                              uint64_t new_hi, uint64_t new_lo)
+{
+    uintptr_t ra = GETPC();
+#ifndef CONFIG_ATOMIC128
+    cpu_loop_exit_atomic(ENV_GET_CPU(env), ra);
+#else
+    Int128 oldv, cmpv, newv;
+
+    cmpv = int128_make128(env->xregs[rs + 1], env->xregs[rs]);
+    newv = int128_make128(new_lo, new_hi);
+
+    int mem_idx = cpu_mmu_index(env, false);
+    TCGMemOpIdx oi = make_memop_idx(MO_LEQ | MO_ALIGN_16, mem_idx);
+    oldv = helper_atomic_cmpxchgo_be_mmu(env, addr, cmpv, newv, oi, ra);
+
+    env->xregs[rs + 1] = int128_getlo(oldv);
+    env->xregs[rs] = int128_gethi(oldv);
+#endif
+}
+
 /*
  * AdvSIMD half-precision
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
     tcg_gen_movi_i64(cpu_exclusive_addr, -1);
 }
 
+static void gen_compare_and_swap(DisasContext *s, int rs, int rt,
+                                 int rn, int size)
+{
+    TCGv_i64 tcg_rs = cpu_reg(s, rs);
+    TCGv_i64 tcg_rt = cpu_reg(s, rt);
+    int memidx = get_mem_index(s);
+    TCGv_i64 addr = cpu_reg_sp(s, rn);
+
+    if (rn == 31) {
+        gen_check_sp_alignment(s);
+    }
+    tcg_gen_atomic_cmpxchg_i64(tcg_rs, addr, tcg_rs, tcg_rt, memidx,
+                               size | MO_ALIGN | s->be_data);
+}
+
+static void gen_compare_and_swap_pair(DisasContext *s, int rs, int rt,
+                                      int rn, int size)
+{
+    TCGv_i64 s1 = cpu_reg(s, rs);
+    TCGv_i64 s2 = cpu_reg(s, rs + 1);
+    TCGv_i64 t1 = cpu_reg(s, rt);
+    TCGv_i64 t2 = cpu_reg(s, rt + 1);
+    TCGv_i64 addr = cpu_reg_sp(s, rn);
+    int memidx = get_mem_index(s);
+
+    if (rn == 31) {
+        gen_check_sp_alignment(s);
+    }
+
+    if (size == 2) {
+        TCGv_i64 cmp = tcg_temp_new_i64();
+        TCGv_i64 val = tcg_temp_new_i64();
+
+        if (s->be_data == MO_LE) {
+            tcg_gen_concat32_i64(val, t1, t2);
+            tcg_gen_concat32_i64(cmp, s1, s2);
+        } else {
+            tcg_gen_concat32_i64(val, t2, t1);
+            tcg_gen_concat32_i64(cmp, s2, s1);
+        }
+
+        tcg_gen_atomic_cmpxchg_i64(cmp, addr, cmp, val, memidx,
+                                   MO_64 | MO_ALIGN | s->be_data);
+        tcg_temp_free_i64(val);
+
+        if (s->be_data == MO_LE) {
+            tcg_gen_extr32_i64(s1, s2, cmp);
+        } else {
+            tcg_gen_extr32_i64(s2, s1, cmp);
+        }
+        tcg_temp_free_i64(cmp);
+    } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+        TCGv_i32 tcg_rs = tcg_const_i32(rs);
+
+        if (s->be_data == MO_LE) {
+            gen_helper_casp_le_parallel(cpu_env, tcg_rs, addr, t1, t2);
+        } else {
+            gen_helper_casp_be_parallel(cpu_env, tcg_rs, addr, t1, t2);
+        }
+        tcg_temp_free_i32(tcg_rs);
+    } else {
+        TCGv_i64 d1 = tcg_temp_new_i64();
+        TCGv_i64 d2 = tcg_temp_new_i64();
+        TCGv_i64 a2 = tcg_temp_new_i64();
+        TCGv_i64 c1 = tcg_temp_new_i64();
+        TCGv_i64 c2 = tcg_temp_new_i64();
+        TCGv_i64 zero = tcg_const_i64(0);
+
+        /* Load the two words, in memory order.  */
+        tcg_gen_qemu_ld_i64(d1, addr, memidx,
+                            MO_64 | MO_ALIGN_16 | s->be_data);
+        tcg_gen_addi_i64(a2, addr, 8);
+        tcg_gen_qemu_ld_i64(d2, addr, memidx, MO_64 | s->be_data);
+
+        /* Compare the two words, also in memory order.  */
+        tcg_gen_setcond_i64(TCG_COND_EQ, c1, d1, s1);
+        tcg_gen_setcond_i64(TCG_COND_EQ, c2, d2, s2);
+        tcg_gen_and_i64(c2, c2, c1);
+
+        /* If compare equal, write back new data, else write back old data.  */
+        tcg_gen_movcond_i64(TCG_COND_NE, c1, c2, zero, t1, d1);
+        tcg_gen_movcond_i64(TCG_COND_NE, c2, c2, zero, t2, d2);
+        tcg_gen_qemu_st_i64(c1, addr, memidx, MO_64 | s->be_data);
+        tcg_gen_qemu_st_i64(c2, a2, memidx, MO_64 | s->be_data);
+        tcg_temp_free_i64(a2);
+        tcg_temp_free_i64(c1);
+        tcg_temp_free_i64(c2);
+        tcg_temp_free_i64(zero);
+
+        /* Write back the data from memory to Rs.  */
+        tcg_gen_mov_i64(s1, d1);
+        tcg_gen_mov_i64(s2, d2);
+        tcg_temp_free_i64(d1);
+        tcg_temp_free_i64(d2);
+    }
+}
+
 /* Update the Sixty-Four bit (SF) registersize. This logic is derived
  * from the ARMv8 specs for LDR (Shared decode for all encodings).
  */
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
             gen_store_exclusive(s, rs, rt, rt2, tcg_addr, size, true);
             return;
         }
-        /* CASP / CASPL */
+        if (rt2 == 31
+            && ((rt | rs) & 1) == 0
+            && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
+            /* CASP / CASPL */
+            gen_compare_and_swap_pair(s, rs, rt, rn, size | 2);
+            return;
+        }
         break;
 
-    case 0x6: case 0x7: /* CASP / LDXP */
+    case 0x6: case 0x7: /* CASPA / LDXP */
         if (size & 2) { /* LDXP / LDAXP */
             if (rn == 31) {
                 gen_check_sp_alignment(s);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_excl(DisasContext *s, uint32_t insn)
             }
             return;
         }
-        /* CASPA / CASPAL */
+        if (rt2 == 31
+            && ((rt | rs) & 1) == 0
+            && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
+            /* CASPA / CASPAL */
+            gen_compare_and_swap_pair(s, rs, rt, rn, size | 2);
+            return;
+        }
         break;
 
     case 0xa: /* CAS */
     case 0xb: /* CASL */
     case 0xe: /* CASA */
     case 0xf: /* CASAL */
+        if (rt2 == 31 && arm_dc_feature(s, ARM_FEATURE_V8_ATOMICS)) {
+            gen_compare_and_swap(s, rs, rt, rn, size);
+            return;
+        }
         break;
     }
     unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

While we have some of the scalar paths for *CVF for fp16,
we failed to decode the fp16 version of these instructions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180502221552.3873-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 33 ++++++++++++++++++++-------------
 1 file changed, 20 insertions(+), 13 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_intfp_conv(DisasContext *s, bool is_scalar,
                                          int immh, int immb, int opcode,
                                          int rn, int rd)
 {
-    bool is_double = extract32(immh, 3, 1);
-    int size = is_double ? MO_64 : MO_32;
-    int elements;
+    int size, elements, fracbits;
     int immhb = immh << 3 | immb;
-    int fracbits = (is_double ? 128 : 64) - immhb;
 
-    if (!extract32(immh, 2, 2)) {
+    if (immh & 8) {
+        size = MO_64;
+        if (!is_scalar && !is_q) {
+            unallocated_encoding(s);
+            return;
+        }
+    } else if (immh & 4) {
+        size = MO_32;
+    } else if (immh & 2) {
+        size = MO_16;
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+    } else {
+        /* immh == 0 would be a failure of the decode logic */
+        g_assert(immh == 1);
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_intfp_conv(DisasContext *s, bool is_scalar,
     if (is_scalar) {
         elements = 1;
     } else {
-        elements = is_double ? 2 : is_q ? 4 : 2;
-        if (is_double && !is_q) {
-            unallocated_encoding(s);
-            return;
-        }
+        elements = (8 << is_q) >> size;
     }
+    fracbits = (16 << size) - immhb;
 
     if (!fp_access_check(s)) {
         return;
     }
 
-    /* immh == 0 would be a failure of the decode logic */
-    g_assert(immh);
-
     handle_simd_intfp_conv(s, rd, rn, elements, !is_u, fracbits, size);
 }
 
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

While we have some of the scalar paths for FCVT for fp16,
we failed to decode the fp16 version of these instructions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180502221552.3873-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 +++++++++++++++++++++++++++-----------
 1 file changed, 46 insertions(+), 19 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
                                          bool is_q, bool is_u,
                                          int immh, int immb, int rn, int rd)
 {
-    bool is_double = extract32(immh, 3, 1);
     int immhb = immh << 3 | immb;
-    int fracbits = (is_double ? 128 : 64) - immhb;
-    int pass;
+    int pass, size, fracbits;
     TCGv_ptr tcg_fpstatus;
     TCGv_i32 tcg_rmode, tcg_shift;
 
-    if (!extract32(immh, 2, 2)) {
-        unallocated_encoding(s);
-        return;
-    }
-
-    if (!is_scalar && !is_q && is_double) {
+    if (immh & 0x8) {
+        size = MO_64;
+        if (!is_scalar && !is_q) {
+            unallocated_encoding(s);
+            return;
+        }
+    } else if (immh & 0x4) {
+        size = MO_32;
+    } else if (immh & 0x2) {
+        size = MO_16;
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+    } else {
+        /* Should have split out AdvSIMD modified immediate earlier.  */
+        assert(immh == 1);
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
     assert(!(is_scalar && is_q));
 
     tcg_rmode = tcg_const_i32(arm_rmode_to_sf(FPROUNDING_ZERO));
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(size == MO_16);
     gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
+    fracbits = (16 << size) - immhb;
     tcg_shift = tcg_const_i32(fracbits);
 
-    if (is_double) {
+    if (size == MO_64) {
         int maxpass = is_scalar ? 1 : 2;
 
         for (pass = 0; pass < maxpass; pass++) {
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
         }
         clear_vec_high(s, is_q, rd);
     } else {
-        int maxpass = is_scalar ? 1 : is_q ? 4 : 2;
+        void (*fn)(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+        int maxpass = is_scalar ? 1 : ((8 << is_q) >> size);
+
+        switch (size) {
+        case MO_16:
+            if (is_u) {
+                fn = gen_helper_vfp_toulh;
+            } else {
+                fn = gen_helper_vfp_toslh;
+            }
+            break;
+        case MO_32:
+            if (is_u) {
+                fn = gen_helper_vfp_touls;
+            } else {
+                fn = gen_helper_vfp_tosls;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+
         for (pass = 0; pass < maxpass; pass++) {
             TCGv_i32 tcg_op = tcg_temp_new_i32();
 
-            read_vec_element_i32(s, tcg_op, rn, pass, MO_32);
-            if (is_u) {
-                gen_helper_vfp_touls(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
-            } else {
-                gen_helper_vfp_tosls(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
-            }
+            read_vec_element_i32(s, tcg_op, rn, pass, size);
+            fn(tcg_op, tcg_op, tcg_shift, tcg_fpstatus);
             if (is_scalar) {
                 write_fp_sreg(s, rd, tcg_op);
             } else {
-                write_vec_element_i32(s, tcg_op, rd, pass, MO_32);
+                write_vec_element_i32(s, tcg_op, rd, pass, size);
             }
             tcg_temp_free_i32(tcg_op);
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The instruction "ucvtf v0.4h, v04h, #2", with input 0x8000u,
overflows the intermediate float16 to infinity before we have a
chance to scale the output.  Use float64 as the intermediate type
so that no input argument (uint32_t in this case) can overflow
or round before scaling.  Given the declared argument, the signed
int32_t function has the same problem.

When converting from float16 to integer, using u/int32_t instead
of u/int16_t means that the bounding is incorrect.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180502221552.3873-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  4 +--
 target/arm/helper.c        | 53 ++++++++++++++++++++++++++++++++++++--
 target/arm/translate-a64.c |  4 +--
 3 files changed, 55 insertions(+), 6 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Use write_fp_dreg and clear_vec_high to zero the bits
that need zeroing for these cases.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180502221552.3873-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
 
     if (itof) {
         TCGv_i64 tcg_rn = cpu_reg(s, rn);
+        TCGv_i64 tmp;
 
         switch (type) {
         case 0:
-        {
             /* 32 bit */
-            TCGv_i64 tmp = tcg_temp_new_i64();
+            tmp = tcg_temp_new_i64();
             tcg_gen_ext32u_i64(tmp, tcg_rn);
-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_offset(s, rd, MO_64));
-            tcg_gen_movi_i64(tmp, 0);
-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_hi_offset(s, rd));
+            write_fp_dreg(s, rd, tmp);
             tcg_temp_free_i64(tmp);
             break;
-        }
         case 1:
-        {
             /* 64 bit */
-            TCGv_i64 tmp = tcg_const_i64(0);
-            tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_offset(s, rd, MO_64));
-            tcg_gen_st_i64(tmp, cpu_env, fp_reg_hi_offset(s, rd));
-            tcg_temp_free_i64(tmp);
+            write_fp_dreg(s, rd, tcg_rn);
             break;
-        }
         case 2:
             /* 64 bit to top half. */
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+            clear_vec_high(s, true, rd);
             break;
         }
     } else {
-- 
2.17.0