Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[Qemu-devel] [PULL 00/10] target-arm queue
-The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
+Some Arm bugfixes for rc2...
-  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
+thanks
 -- PMM
 The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:
   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119
-for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
+for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:
-  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
+  MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix coverity nit in int_to_float code
+ * various MAINTAINERS file updates
- * Don't set Invalid for float-to-int(MAXINT)
+ * hw/block/onenand: use qemu_log_mask() for reporting
- * Fix fp_status_f16 tininess before rounding
+ * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
- * Add various missing insns from the v8.2-FP16 extension
+   on the n800 and n810 machine models
- * Fix sqrt_f16 exception raising
+ * target/arm: fix smc incorrectly trapping to EL3 when secure is off
- * sdcard: Correct CRC16 offset in sd_function_switch()
+ * hw/arm/stm32f205: Fix the UART and Timer region size
- * tcg: Optionally log FPU state in TCG -d cpu logging
+ * target/arm: read ID registers for KVM guests so they can be
    used to gate "is feature X present" checks
 ----------------------------------------------------------------
-Alex Bennée (5):
+Luc Michel (1):
-      fpu/softfloat: int_to_float ensure r fully initialised
+      target/arm: fix smc incorrectly trapping to EL3 when secure is off
       target/arm: Implement FCMP for fp16
       target/arm: Implement FCSEL for fp16
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
 Peter Maydell (3):
-      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
-      target/arm: Fix fp_status_f16 tininess before rounding
+      hw/block/onenand: use qemu_log_mask() for reporting
-      tcg: Optionally log FPU state in TCG -d cpu logging
+      MAINTAINERS: list myself as maintainer for various Arm boards
-Philippe Mathieu-Daudé (1):
+Richard Henderson (4):
-      sdcard: Correct CRC16 offset in sd_function_switch()
+      target/arm: Install ARMISARegisters from kvm host
       target/arm: Fill in ARMISARegisters for kvm64
       target/arm: Introduce read_sys_reg32 for kvm32
       target/arm: Fill in ARMISARegisters for kvm32
-Richard Henderson (7):
+Seth Kintigh (1):
-      target/arm: Implement FMOV (general) for fp16
+      hw/arm/stm32f205: Fix the UART and Timer region size
       target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
       target/arm: Implement FCVT (scalar, integer) for fp16
       target/arm: Implement FCVT (scalar, fixed-point) for fp16
       target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
- include/qemu/log.h         |   1 +
+Thomas Huth (1):
- target/arm/helper-a64.h    |   2 +
+      MAINTAINERS: Add entries for missing ARM boards
  target/arm/helper.h        |   6 +
  accel/tcg/cpu-exec.c       |   9 +-
  fpu/softfloat.c            |   6 +-
  hw/sd/sd.c                 |   2 +-
  target/arm/cpu.c           |   2 +
  target/arm/helper-a64.c    |  10 ++
  target/arm/helper.c        |  38 +++-
  target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
  util/log.c                 |   2 +
 files changed, 428 insertions(+), 71 deletions(-)
+ target/arm/kvm_arm.h       |   1 +
+ hw/block/onenand.c         |  24 +++++-----
+ hw/char/stm32f2xx_usart.c  |   2 +-
+ hw/timer/stm32f2xx_timer.c |   2 +-
+ target/arm/kvm.c           |   1 +
+ target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
+ target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
+ target/arm/op_helper.c     |  54 +++++++++++++++++++----
+ MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
+files changed, 293 insertions(+), 64 deletions(-)

-[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+[Qemu-devel] [PULL 01/10] target/arm: Install ARMISARegisters from kvm host
 From: Richard Henderson <richard.henderson@linaro.org>
-No sense in emitting code after the exception.
+The ID registers are replacing (some of) the feature bits.
 We need (some of) these values to determine the set of data
 to be handled during migration.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ target/arm/kvm_arm.h | 1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/kvm.c     | 1 +
 files changed, 2 insertions(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/kvm_arm.h
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
-         default:
+  * by asking the host kernel)
-             /* all other sf/type/rmode combinations are invalid */
+  */
-             unallocated_encoding(s);
+ typedef struct ARMHostCPUFeatures {
--            break;
++    ARMISARegisters isar;
-+            return;
+     uint64_t features;
-         }
+     uint32_t target;
+     const char *dtb_compatible;
-         if (!fp_access_check(s)) {
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
      cpu->kvm_target = arm_host_cpu_features.target;
      cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
 +    cpu->isar = arm_host_cpu_features.isar;
      env->features = arm_host_cpu_features.features;
  }
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+[Qemu-devel] [PULL 02/10] target/arm: Fill in ARMISARegisters for kvm64
 From: Richard Henderson <richard.henderson@linaro.org>
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
-Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  6 +++
+ target/arm/kvm64.c | 90 ++++++++++++++++++++++++++++++++++++++++++++--
- target/arm/helper.c        | 38 ++++++++++++++-
+file changed, 88 insertions(+), 2 deletions(-)
  target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 files changed, 122 insertions(+), 18 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/kvm64.c
-+++ b/target/arm/helper.h
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ static inline void unset_feature(uint64_t *features, int feature)
- DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+     *features &= ~(1ULL << feature);
  DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
 +DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
 +DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
  DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
  DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
  DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
  DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
 +DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
 +DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
  DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
  DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
  #undef VFP_CONV_FIX_A64
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
-+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
++static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
 +{
-+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
++    uint64_t ret;
 +    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
 +    int err;
 +
 +    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
 +    err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +    if (err < 0) {
 +        return -1;
 +    }
 +    *pret = ret;
 +    return 0;
 +}
 +
-+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
++static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
 +{
-+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
++    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
 +
 +    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
 +    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +}
 +
- static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
+ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
  {
-     if (unlikely(float16_is_any_nan(f))) {
+     /* Identify the feature bits corresponding to the host CPU, and
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
+      * fill out the ARMHostCPUClass fields accordingly. To do this
-     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
+      * we have to create a scratch VM, create a single CPU inside it,
- }
+      * and then query that CPU for the relevant ID registers.
+-     * For AArch64 we currently don't care about ID registers at
-+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+-     * all; we just want to know the CPU type.
-+{
+      */
-+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+     int fdarray[3];
-+}
+     uint64_t features = 0;
 +    int err;
 +
-+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-+{
+      * we know these will only support creating one kind of guest CPU,
-+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+      * which is its preferred CPU type. Fortunately these old kernels
-+}
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      ahcf->target = init.target;
      ahcf->dtb_compatible = "arm,arm-v8";
 +    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
 +                         ARM64_SYS_REG(3, 0, 0, 4, 0));
 +    if (unlikely(err < 0)) {
 +        /*
 +         * Before v4.15, the kernel only exposed a limited number of system
 +         * registers, not including any of the interesting AArch64 ID regs.
 +         * For the most part we could leave these fields as zero with minimal
 +         * effect, since this does not affect the values seen by the guest.
 +         *
 +         * However, it could cause problems down the line for QEMU,
 +         * so provide a minimal v8.0 default.
 +         *
 +         * ??? Could read MIDR and use knowledge from cpu64.c.
 +         * ??? Could map a page of memory into our temp guest and
 +         *     run the tiniest of hand-crafted kernels to extract
 +         *     the values seen by the guest.
 +         * ??? Either of these sounds like too much effort just
 +         *     to work around running a modern host kernel.
 +         */
 +        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
 +        err = 0;
 +    } else {
 +        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
 +                              ARM64_SYS_REG(3, 0, 0, 4, 1));
 +        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
 +                              ARM64_SYS_REG(3, 0, 0, 6, 0));
 +        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
 +                              ARM64_SYS_REG(3, 0, 0, 6, 1));
 +
-+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
++        /*
-+{
++         * Note that if AArch32 support is not present in the host,
-+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
++         * the AArch32 sysregs are present to be read, but will
-+}
++         * return UNKNOWN values.  This is neither better nor worse
 +         * than skipping the reads and leaving 0, as we must avoid
 +         * considering the values in every case.
 +         */
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 0));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 1));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 2));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 3));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 4));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 5));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
 +                              ARM64_SYS_REG(3, 0, 0, 2, 7));
 +
-+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
++        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
-+{
++                              ARM64_SYS_REG(3, 0, 0, 3, 0));
-+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
++        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
-+}
++                              ARM64_SYS_REG(3, 0, 0, 3, 1));
 +        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
 +                              ARM64_SYS_REG(3, 0, 0, 3, 2));
 +    }
 +
- /* Set the current fp rounding mode and return the old one.
+     kvm_arm_destroy_scratch_host_vcpu(fdarray);
-  * The argument is a softfloat float_round_ value.
-  */
++    if (err < 0) {
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
++        return false;
-index XXXXXXX..XXXXXXX 100644
++    }
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
-+        case 0: /* float32 */
+    /* We can assume any KVM supporting CPU is at least a v8
-+            tcg_single = tcg_temp_new_i32();
+      * with VFPv4+Neon; this in turn implies most of the other
-             if (is_signed) {
+      * feature bits.
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+[Qemu-devel] [PULL 03/10] target/arm: Introduce read_sys_reg32 for kvm32
 From: Richard Henderson <richard.henderson@linaro.org>
-Cc: qemu-stable@nongnu.org
+Assert that the value to be written is the correct size.
 No change in functionality here, just mirroring the same
 function from kvm64.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 30 ++++++++++++++----------------
+ target/arm/kvm32.c | 41 ++++++++++++++++-------------------------
-file changed, 14 insertions(+), 16 deletions(-)
+file changed, 16 insertions(+), 25 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/kvm32.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+@@ -XXX,XX +XXX,XX @@ static inline void set_feature(uint64_t *features, int feature)
-     return v;
+     *features |= 1ULL << feature;
  }
-+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
++static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
 +{
-+    TCGv_i32 v = tcg_temp_new_i32();
++    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
 +
-+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
++    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32);
-+    return v;
++    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
 +}
 +
- /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
+ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
-     TCGv_ptr fpst = NULL;
+     /* Identify the feature bits corresponding to the host CPU, and
--    TCGv_i32 tcg_op = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+      * we have to create a scratch VM, create a single CPU inside it,
-     TCGv_i32 tcg_res = tcg_temp_new_i32();
+      * and then query that CPU for the relevant ID registers.
+      */
--    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
+-    int i, ret, fdarray[3];
--
++    int err = 0, fdarray[3];
-     switch (opcode) {
+     uint32_t midr, id_pfr0, mvfr1;
-     case 0x0: /* FMOV */
+     uint64_t features = 0;
-         tcg_gen_mov_i32(tcg_res, tcg_op);
++
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
+     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-         tcg_temp_free_i64(tcg_op2);
+      * we know these will only support creating one kind of guest CPU,
-         tcg_temp_free_i64(tcg_res);
+      * which is its preferred CPU type.
-     } else {
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
--        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
+         QEMU_KVM_ARM_TARGET_NONE
--        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+     };
-+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+     struct kvm_vcpu_init init;
-+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
+-    struct kvm_one_reg idregs[] = {
-         TCGv_i64 tcg_res = tcg_temp_new_i64();
+-        {
+-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
--        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+-            | ENCODE_CP_REG(15, 0, 0, 0, 0, 0, 0),
--        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
+-            .addr = (uintptr_t)&midr,
--
+-        },
-         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
+-        {
-         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
+-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
+-            | ENCODE_CP_REG(15, 0, 0, 0, 1, 0, 0),
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
+-            .addr = (uintptr_t)&id_pfr0,
+-        },
-     fpst = get_fpstatus_ptr(true);
+-        {
+-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
--    tcg_op1 = tcg_temp_new_i32();
+-            | KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1,
--    tcg_op2 = tcg_temp_new_i32();
+-            .addr = (uintptr_t)&mvfr1,
-+    tcg_op1 = read_fp_hreg(s, rn);
+-        },
-+    tcg_op2 = read_fp_hreg(s, rm);
+-    };
-     tcg_res = tcg_temp_new_i32();
+     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
--    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+         return false;
--    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
--
+      */
-     switch (fpopcode) {
+     ahcf->dtb_compatible = "arm,arm-v7";
-     case 0x03: /* FMULX */
-         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
+-    for (i = 0; i < ARRAY_SIZE(idregs); i++) {
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
+-        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &idregs[i]);
 -        if (ret) {
 -            break;
 -        }
 -    }
 +    err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
 +    err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
 +    err |= read_sys_reg32(fdarray[2], &mvfr1,
 +                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
 +                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
 -    if (ret) {
 +    if (err < 0) {
          return false;
      }
-     if (is_scalar) {
--        TCGv_i32 tcg_op = tcg_temp_new_i32();
-+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-         TCGv_i32 tcg_res = tcg_temp_new_i32();
--        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
--
-         switch (fpop) {
-         case 0x1a: /* FCVTNS */
-         case 0x1b: /* FCVTMS */
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
+[Qemu-devel] [PULL 04/10] target/arm: Fill in ARMISARegisters for kvm32
 From: Richard Henderson <richard.henderson@linaro.org>
-We missed all of the scalar fp16 fma operations.
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
-Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
+ target/arm/kvm32.c | 40 +++++++++++++++++++++++++++++++++++-----
-file changed, 48 insertions(+)
+file changed, 35 insertions(+), 5 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/kvm32.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     tcg_temp_free_i64(tcg_res);
+      * and then query that CPU for the relevant ID registers.
- }
+      */
+     int err = 0, fdarray[3];
-+/* Floating-point data-processing (3 source) - half precision */
+-    uint32_t midr, id_pfr0, mvfr1;
-+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
++    uint32_t midr, id_pfr0;
-+                                int rd, int rn, int rm, int ra)
+     uint64_t features = 0;
-+{
-+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+    TCGv_ptr fpst = get_fpstatus_ptr(true);
      err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
      err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
 -    err |= read_sys_reg32(fdarray[2], &mvfr1,
 +
-+    tcg_op1 = read_fp_hreg(s, rn);
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
-+    tcg_op2 = read_fp_hreg(s, rm);
++                          ARM_CP15_REG32(0, 0, 2, 0));
-+    tcg_op3 = read_fp_hreg(s, ra);
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
-+
++                          ARM_CP15_REG32(0, 0, 2, 1));
-+    /* These are fused multiply-add, and must be done as one
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
-+     * floating point operation with no rounding between the
++                          ARM_CP15_REG32(0, 0, 2, 2));
-+     * multiplication and addition steps.
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
-+     * NB that doing the negations here as separate steps is
++                          ARM_CP15_REG32(0, 0, 2, 3));
-+     * correct : an input NaN should come out with its sign bit
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
-+     * flipped if it is a negated-input.
++                          ARM_CP15_REG32(0, 0, 2, 4));
-+     */
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
-+    if (o1 == true) {
++                          ARM_CP15_REG32(0, 0, 2, 5));
-+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
++    if (read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
 +                       ARM_CP15_REG32(0, 0, 2, 7))) {
 +        /*
 +         * Older kernels don't support reading ID_ISAR6. This register was
 +         * only introduced in ARMv8, so we can assume that it is zero on a
 +         * CPU that a kernel this old is running on.
 +         */
 +        ahcf->isar.id_isar6 = 0;
 +    }
 +
-+    if (o0 != o1) {
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
-+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
++                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
-+    }
++                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR0);
-+
++    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
-+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+                           KVM_REG_ARM | KVM_REG_SIZE_U32 |
-+
+                           KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
-+    write_fp_sreg(s, rd, tcg_res);
++    /*
-+
++     * FIXME: There is not yet a way to read MVFR2.
-+    tcg_temp_free_ptr(fpst);
++     * Fortunately there is not yet anything in there that affects migration.
-+    tcg_temp_free_i32(tcg_op1);
++     */
-+    tcg_temp_free_i32(tcg_op2);
-+    tcg_temp_free_i32(tcg_op3);
+     kvm_arm_destroy_scratch_host_vcpu(fdarray);
-+    tcg_temp_free_i32(tcg_res);
-+}
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+
+     if (extract32(id_pfr0, 12, 4) == 1) {
- /* Floating point data-processing (3 source)
+         set_feature(&features, ARM_FEATURE_THUMB2EE);
-  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
+     }
-  * +---+---+---+-----------+------+----+------+----+------+------+------+
+-    if (extract32(mvfr1, 20, 4) == 1) {
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
++    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
-         }
+         set_feature(&features, ARM_FEATURE_VFP_FP16);
-         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
+     }
-         break;
+-    if (extract32(mvfr1, 12, 4) == 1) {
-+    case 3:
++    if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+         set_feature(&features, ARM_FEATURE_NEON);
-+            unallocated_encoding(s);
+     }
-+            return;
+-    if (extract32(mvfr1, 28, 4) == 1) {
-+        }
++    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
-+        if (!fp_access_check(s)) {
+         /* FMAC support implies VFPv4 */
-+            return;
+         set_feature(&features, ARM_FEATURE_VFP4);
 +        }
 +        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+[Qemu-devel] [PULL 05/10] MAINTAINERS: Add entries for missing ARM boards
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Thomas Huth <thuth@redhat.com>
-Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
 "raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
 While we're at it, also adjust the "i.MX31" section a little bit,
 so that the wildcards there do not match anymore for unrelated files
 (e.g. the new hw/misc/imx6ul_ccm.c file).
-  The block length is predefined to 512 bits
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
 and "4.10.2 SD Status":
   The SD Status contains status bits that are related to the SD Memory Card
   proprietary features and may be used for future application-specific usage.
   The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 2 +-
+ MAINTAINERS | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 65 insertions(+), 5 deletions(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/MAINTAINERS
-+++ b/hw/sd/sd.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
-         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+ S: Odd Fixes
-     }
+ F: hw/arm/gumstix.c
-     memset(&sd->data[17], 0, 47);
--    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+-i.MX31
-+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
++i.MX31 (kzm)
- }
+ M: Peter Chubb <peter.chubb@nicta.com.au>
+ L: qemu-arm@nongnu.org
- static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
+-S: Odd fixes
 -F: hw/*/imx*
 -F: include/hw/*/imx*
 +S: Odd Fixes
  F: hw/arm/kzm.c
 -F: include/hw/arm/fsl-imx31.h
 +F: hw/*/imx_*
 +F: hw/*/*imx31*
 +F: include/hw/*/imx_*
 +F: include/hw/*/*imx31*
  Integrator CP
  M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ S: Maintained
  F: hw/arm/integratorcp.c
  F: hw/misc/arm_integrator_debug.c
 +MCIMX6UL EVK / i.MX6ul
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Jean-Christophe Dubois <jcd@tribudubois.net>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/mcimx6ul-evk.c
 +F: hw/arm/fsl-imx6ul.c
 +F: hw/misc/imx6ul_ccm.c
 +F: include/hw/arm/fsl-imx6ul.h
 +F: include/hw/misc/imx6ul_ccm.h
 +
 +MCIMX7D SABRE / i.MX7
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Andrey Smirnov <andrew.smirnov@gmail.com>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/mcimx7d-sabre.c
 +F: hw/arm/fsl-imx7.c
 +F: include/hw/arm/fsl-imx7.h
 +F: hw/pci-host/designware.c
 +F: include/hw/pci-host/designware.h
 +
  MPS2
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/arm/palm.c
 +Raspberry Pi
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Andrew Baumann <Andrew.Baumann@microsoft.com>
 +R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/raspi_platform.h
 +F: hw/*/bcm283*
 +F: include/hw/arm/raspi*
 +F: include/hw/*/bcm283*
 +
  Real View
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: hw/*/pxa2xx*
  F: hw/misc/mst_fpga.c
  F: include/hw/arm/pxa.h
 +SABRELITE / i.MX6
 +M: Peter Maydell <peter.maydell@linaro.org>
 +R: Jean-Christophe Dubois <jcd@tribudubois.net>
 +L: qemu-arm@nongnu.org
 +S: Odd Fixes
 +F: hw/arm/sabrelite.c
 +F: hw/arm/fsl-imx6.c
 +F: hw/misc/imx6_src.c
 +F: hw/ssi/imx_spi.c
 +F: include/hw/arm/fsl-imx6.h
 +F: include/hw/misc/imx6_src.h
 +F: include/hw/ssi/imx_spi.h
 +
  Sharp SL-5500 (Collie) PDA
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/stellaris*
 +Versatile Express
 +M: Peter Maydell <peter.maydell@linaro.org>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/arm/vexpress.c
 +
  Versatile PB
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ S: Maintained
  F: hw/*/versatile*
  F: hw/misc/arm_sysctl.c
 +Virt
 +M: Peter Maydell <peter.maydell@linaro.org>
 +L: qemu-arm@nongnu.org
 +S: Maintained
 +F: hw/arm/virt*
 +F: include/hw/arm/virt.h
 +
  Xilinx Zynq
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
  M: Alistair Francis <alistair@alistair23.me>
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+[Qemu-devel] [PULL 06/10] hw/arm/stm32f205: Fix the UART and Timer region size
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Seth Kintigh <skintigh@gmail.com>
-We missed all of the scalar fp16 binary operations.
+The UART and timer devices for the stm32f205 were being created
 with memory regions that were too large. Use the size specified
 in the chip datasheet.
-Cc: qemu-stable@nongnu.org
+The old sizes were so large that the devices would overlap with
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+each other in the SoC memory map, so this fixes a bug that
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+caused odd behavior and/or crashes when trying to set up multiple
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+UARTs.
-Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 Signed-off-by: Seth Kintigh <skintigh@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: rephrased commit message to follow our usual standard]
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
+ hw/char/stm32f2xx_usart.c  | 2 +-
-file changed, 65 insertions(+)
+ hw/timer/stm32f2xx_timer.c | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/char/stm32f2xx_usart.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/char/stm32f2xx_usart.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_init(Object *obj)
-     tcg_temp_free_i64(tcg_res);
+     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
      memory_region_init_io(&s->mmio, obj, &stm32f2xx_usart_ops, s,
 -                          TYPE_STM32F2XX_USART, 0x2000);
 +                          TYPE_STM32F2XX_USART, 0x400);
      sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
  }
-+/* Floating-point data-processing (2 source) - half precision */
+diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
-+static void handle_fp_2src_half(DisasContext *s, int opcode,
+index XXXXXXX..XXXXXXX 100644
-+                                int rd, int rn, int rm)
+--- a/hw/timer/stm32f2xx_timer.c
-+{
++++ b/hw/timer/stm32f2xx_timer.c
-+    TCGv_i32 tcg_op1;
+@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_timer_init(Object *obj)
-+    TCGv_i32 tcg_op2;
+     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-+    TCGv_i32 tcg_res;
-+    TCGv_ptr fpst;
+     memory_region_init_io(&s->iomem, obj, &stm32f2xx_timer_ops, s,
-+
+-                          "stm32f2xx_timer", 0x4000);
-+    tcg_res = tcg_temp_new_i32();
++                          "stm32f2xx_timer", 0x400);
-+    fpst = get_fpstatus_ptr(true);
+     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
-+    tcg_op1 = read_fp_hreg(s, rn);
-+    tcg_op2 = read_fp_hreg(s, rm);
+     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
 +
 +    switch (opcode) {
 +    case 0x0: /* FMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x1: /* FDIV */
 +        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
  /* Floating point data-processing (2 source)
   *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
   * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
          }
          handle_fp_2src_double(s, opcode, rd, rn, rm);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+[Qemu-devel] [PULL 07/10] target/arm: fix smc incorrectly trapping to EL3 when secure is off
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Luc Michel <luc.michel@greensocs.com>
-Cc: qemu-stable@nongnu.org
+This commit fixes a case where the CPU would try to go to EL3 when
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+case is raised when the PSCI conduit is set to smc, but the smc
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+instruction does not lead to a valid PSCI call.
-Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
 QEMU crashes with an assertion failure latter on because of incoherent
 mmu_idx.
 This commit refactors the pre_smc helper by enumerating all the possible
 way of handling an scm instruction, and covering the previously missing
 case leading to the crash.
 The following minimal test would crash before this commit:
 .global _start
     .text
 _start:
     ldr x0, =0xdeadbeef  ; invalid PSCI call
     smc #0
 run with the following command line:
 aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                       -o test test.s
 qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                     -cpu cortex-a57 -kernel test
 Signed-off-by: Luc Michel <luc.michel@greensocs.com>
 Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 17 +++++++++++++++--
+ target/arm/op_helper.c | 54 +++++++++++++++++++++++++++++++++++-------
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 46 insertions(+), 8 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/op_helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
-     bool sf = extract32(insn, 31, 1);
+     ARMCPU *cpu = arm_env_get_cpu(env);
-     bool itof;
+     int cur_el = arm_current_el(env);
+     bool secure = arm_is_secure(env);
--    if (sbit || (type > 1)
+-    bool smd = env->cp15.scr_el3 & SCR_SMD;
--        || (!sf && scale < 32)) {
++    bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
-+    if (sbit || (!sf && scale < 32)) {
++
-+        unallocated_encoding(s);
++    /*
-+        return;
++     * SMC behaviour is summarized in the following table.
 +     * This helper handles the "Trap to EL2" and "Undef insn" cases.
 +     * The "Trap to EL3" and "PSCI call" cases are handled in the exception
 +     * helper.
 +     *
 +     *  -> ARM_FEATURE_EL3 and !SMD
 +     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
 +     *
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Trap to EL3
 +     *  Conduit not SMC          Trap to EL2         Trap to EL3
 +     *
 +     *
 +     *  -> ARM_FEATURE_EL3 and SMD
 +     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
 +     *
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Undef insn
 +     *  Conduit not SMC          Trap to EL2         Undef insn
 +     *
 +     *
 +     *  -> !ARM_FEATURE_EL3
 +     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
 +     *
 +     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
 +     *  Conduit SMC, inval call  Trap to EL2         Undef insn
 +     *  Conduit not SMC          Undef insn          Undef insn
 +     */
 +
      /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
       * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
       *  extensions, SMD only applies to NS state.
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
       * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
       * so we need not special case this here.
       */
 -    bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 +    bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
 +                                                     : smd_flag && !secure;
      if (!arm_feature(env, ARM_FEATURE_EL3) &&
          cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
           * to forbid its EL1 from making PSCI calls into QEMU's
           * "firmware" via HCR.TSC, so for these purposes treat
           * PSCI-via-SMC as implying an EL3.
 +         * This handles the very last line of the previous table.
           */
 -        undef = true;
 -    } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 +        raise_exception(env, EXCP_UDEF, syn_uncategorized(),
 +                        exception_target_el(env));
 +    }
 +
-+    switch (type) {
++    if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
-+    case 0: /* float32 */
+         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
-+    case 1: /* float64 */
+          * We also want an EL2 guest to be able to forbid its EL1 from
-+        break;
+          * making PSCI calls into QEMU's "firmware" via HCR.TSC.
-+    case 3: /* float16 */
++         * This handles all the "Trap to EL2" cases of the previous table.
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+          */
-+            break;
+         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
-+        }
+     }
-+        /* fallthru */
-+    default:
+-    /* If PSCI is enabled and this looks like a valid PSCI call then
-         unallocated_encoding(s);
+-     * suppress the UNDEF -- we'll catch the SMC exception and
-         return;
+-     * implement the PSCI call behaviour there.
 +    /* Catch the two remaining "Undef insn" cases of the previous table:
 +     *    - PSCI conduit is SMC but we don't have a valid PCSI call,
 +     *    - We don't have EL3 or SMD is set.
       */
 -    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
 +    if (!arm_is_psci_call(cpu, EXCP_SMC) &&
 +        (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
          raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                          exception_target_el(env));
      }
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+[Qemu-devel] [PULL 08/10] hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
-From: Alex Bennée <alex.bennee@linaro.org>
+An off-by-one error in a switch case in onenand_read() allowed
 a misbehaving guest to read off the end of a block of memory.
-Reported by Coverity (CID1390635). We ensure this for uint_to_float
+NB: the onenand device is used only by the "n800" and "n810"
-later on so we might as well mirror that.
+machines, which are usable only with TCG, not KVM, so this is
 not a security issue.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reported-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- fpu/softfloat.c | 2 +-
+ hw/block/onenand.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/hw/block/onenand.c b/hw/block/onenand.c
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/hw/block/onenand.c
-+++ b/fpu/softfloat.c
++++ b/hw/block/onenand.c
-@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
+     int offset = addr >> s->shift;
- static FloatParts int_to_float(int64_t a, float_status *status)
- {
+     switch (offset) {
--    FloatParts r;
+-    case 0x0000 ... 0xc000:
-+    FloatParts r = {};
++    case 0x0000 ... 0xbffe:
-     if (a == 0) {
+         return lduw_le_p(s->boot[0] + addr);
-         r.cls = float_class_zero;
-         r.sign = false;
+     case 0xf000:    /* Manufacturer ID */
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+Deleted patch
-In float-to-integer conversion, if the floating point input
-converts exactly to the largest or smallest integer that
-fits in to the result type, this is not an overflow.
-In this situation we were producing the correct result value,
-but were incorrectly setting the Invalid flag.
-For example for Arm A64, "FCVTAS w0, d0" on an input of
-x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Fix the boundary case to take the right half of the if()
-statements.
-This fixes a regression from 2.11 introduced by the softfloat
-refactoring.
-Cc: qemu-stable@nongnu.org
-Fixes: ab52f973a50
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
----
- fpu/softfloat.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
-index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
-+++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
-             r = UINT64_MAX;
-         }
-         if (p.sign) {
--            if (r < -(uint64_t) min) {
-+            if (r <= -(uint64_t) min) {
-                 return -r;
-             } else {
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
-                 return min;
-             }
-         } else {
--            if (r < max) {
-+            if (r <= max) {
-                 return r;
-             } else {
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
---
-.17.0

-[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+Deleted patch
-In commit d81ce0ef2c4f105 we added an extra float_status field
-fp_status_fp16 for Arm, but forgot to initialize it correctly
-by setting it to float_tininess_before_rounding. This currently
-will only cause problems for the new V8_FP16 feature, since the
-float-to-float conversion code doesn't use it yet. The effect
-would be that we failed to set the Underflow IEEE exception flag
-in all the cases where we should.
-Add the missing initialization.
-Fixes: d81ce0ef2c4f105
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
----
- target/arm/cpu.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-                               &env->vfp.fp_status);
-     set_float_detect_tininess(float_tininess_before_rounding,
-                               &env->vfp.standard_fp_status);
-+    set_float_detect_tininess(float_tininess_before_rounding,
-+                              &env->vfp.fp_status_f16);
- #ifndef CONFIG_USER_ONLY
-     if (kvm_enabled()) {
-         kvm_arm_reset_vcpu(cpu);
---
-.17.0

-[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Adding the fp16 moves to/from general registers.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 21 +++++++++++++++++++++
-file changed, 21 insertions(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
-             clear_vec_high(s, true, rd);
-             break;
-+        case 3:
-+            /* 16 bit */
-+            tmp = tcg_temp_new_i64();
-+            tcg_gen_ext16u_i64(tmp, tcg_rn);
-+            write_fp_dreg(s, rd, tmp);
-+            tcg_temp_free_i64(tmp);
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
-     } else {
-         TCGv_i64 tcg_rd = cpu_reg(s, rd);
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
-             /* 64 bits from top half */
-             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
-             break;
-+        case 3:
-+            /* 16 bit */
-+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
-         case 0xa: /* 64 bit */
-         case 0xd: /* 64 bit to top half of quad */
-             break;
-+        case 0x6: /* 16-bit float, 32-bit int */
-+        case 0xe: /* 16-bit float, 64-bit int */
-+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+                break;
-+            }
-+            /* fallthru */
-         default:
-             /* all other sf/type/rmode combinations are invalid */
-             unallocated_encoding(s);
---
-.17.0

-[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+[Qemu-devel] [PULL 09/10] hw/block/onenand: use qemu_log_mask() for reporting
-From: Alex Bennée <alex.bennee@linaro.org>
+Update the onenand device to use qemu_log_mask() for reporting
 guest errors and unimplemented features, rather than plain
 fprintf() and hw_error().
-These where missed out from the rest of the half-precision work.
+(We leave the hw_error() in onenand_reset(), as that is
 triggered by a failure to read the underlying block device
 for the bootRAM, not by guest action.)
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
-[rth: Diagnose lack of FP16 before fp_access_check]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
 ---
- target/arm/helper-a64.h    |  2 +
+ hw/block/onenand.c | 22 +++++++++++++---------
- target/arm/helper-a64.c    | 10 +++++
+file changed, 13 insertions(+), 9 deletions(-)
  target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 files changed, 83 insertions(+), 17 deletions(-)
-diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
+diff --git a/hw/block/onenand.c b/hw/block/onenand.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.h
+--- a/hw/block/onenand.c
-+++ b/target/arm/helper-a64.h
++++ b/hw/block/onenand.c
 @@ -XXX,XX +XXX,XX @@
- DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ #include "exec/memory.h"
- DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ #include "hw/sysbus.h"
- DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+ #include "qemu/error-report.h"
-+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
++#include "qemu/log.h"
-+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
- DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+ /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
- DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
+ #define PAGE_SHIFT    11
- DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
+@@ -XXX,XX +XXX,XX @@ static void onenand_command(OneNANDState *s)
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+     default:
-index XXXXXXX..XXXXXXX 100644
+         s->status |= ONEN_ERR_CMD;
---- a/target/arm/helper-a64.c
+         s->intstatus |= ONEN_INT;
-+++ b/target/arm/helper-a64.c
+-        fprintf(stderr, "%s: unknown OneNAND command %x\n",
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
+-                        __func__, s->command);
-     return flags;
++        qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
 +                      s->command);
      }
      onenand_intr_update(s);
@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
      case 0xff02:    /* ECC Result of spare area data */
      case 0xff03:    /* ECC Result of main area data */
      case 0xff04:    /* ECC Result of spare area data */
 -        hw_error("%s: implement ECC\n", __func__);
 +        qemu_log_mask(LOG_UNIMP,
 +                      "onenand: ECC result registers unimplemented\n");
          return 0x0000;
      }
 -    fprintf(stderr, "%s: unknown OneNAND register %x\n",
 -                    __func__, offset);
 +    qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
 +                  offset);
      return 0;
  }
-+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
-+{
+             break;
-+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
-+}
+         default:
-+
+-            fprintf(stderr, "%s: unknown OneNAND boot command %"PRIx64"\n",
-+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+-                            __func__, value);
-+{
++            qemu_log_mask(LOG_GUEST_ERROR,
-+    return float_rel_to_flags(float16_compare(x, y, fp_status));
++                          "unknown OneNAND boot command %" PRIx64 "\n",
-+}
++                          value);
-+
+         }
- uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
+         break;
- {
-     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
+@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+         break;
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+     default:
-+++ b/target/arm/translate-a64.c
+-        fprintf(stderr, "%s: unknown OneNAND register %x\n",
-@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
+-                        __func__, offset);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "write to unknown OneNAND register 0x%x\n",
 +                      offset);
      }
  }
--static void handle_fp_compare(DisasContext *s, bool is_double,
-+static void handle_fp_compare(DisasContext *s, int size,
-                               unsigned int rn, unsigned int rm,
-                               bool cmp_with_zero, bool signal_all_nans)
- {
-     TCGv_i64 tcg_flags = tcg_temp_new_i64();
--    TCGv_ptr fpst = get_fpstatus_ptr(false);
-+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
--    if (is_double) {
-+    if (size == MO_64) {
-         TCGv_i64 tcg_vn, tcg_vm;
-         tcg_vn = read_fp_dreg(s, rn);
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
-         tcg_temp_free_i64(tcg_vn);
-         tcg_temp_free_i64(tcg_vm);
-     } else {
--        TCGv_i32 tcg_vn, tcg_vm;
-+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
-+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
--        tcg_vn = read_fp_sreg(s, rn);
-+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
-         if (cmp_with_zero) {
--            tcg_vm = tcg_const_i32(0);
-+            tcg_gen_movi_i32(tcg_vm, 0);
-         } else {
--            tcg_vm = read_fp_sreg(s, rm);
-+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
-         }
--        if (signal_all_nans) {
--            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
--        } else {
--            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+
-+        switch (size) {
-+        case MO_32:
-+            if (signal_all_nans) {
-+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+            } else {
-+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+            }
-+            break;
-+        case MO_16:
-+            if (signal_all_nans) {
-+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+            } else {
-+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-+            }
-+            break;
-+        default:
-+            g_assert_not_reached();
-         }
-+
-         tcg_temp_free_i32(tcg_vn);
-         tcg_temp_free_i32(tcg_vm);
-     }
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
- static void disas_fp_compare(DisasContext *s, uint32_t insn)
- {
-     unsigned int mos, type, rm, op, rn, opc, op2r;
-+    int size;
-     mos = extract32(insn, 29, 3);
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+    type = extract32(insn, 22, 2);
-     rm = extract32(insn, 16, 5);
-     op = extract32(insn, 14, 2);
-     rn = extract32(insn, 5, 5);
-     opc = extract32(insn, 3, 2);
-     op2r = extract32(insn, 0, 3);
--    if (mos || op || op2r || type > 1) {
-+    if (mos || op || op2r) {
-+        unallocated_encoding(s);
-+        return;
-+    }
-+
-+    switch (type) {
-+    case 0:
-+        size = MO_32;
-+        break;
-+    case 1:
-+        size = MO_64;
-+        break;
-+    case 3:
-+        size = MO_16;
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+            break;
-+        }
-+        /* fallthru */
-+    default:
-         unallocated_encoding(s);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
-         return;
-     }
--    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
-+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
- }
- /* Floating point conditional compare
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-     unsigned int mos, type, rm, cond, rn, op, nzcv;
-     TCGv_i64 tcg_flags;
-     TCGLabel *label_continue = NULL;
-+    int size;
-     mos = extract32(insn, 29, 3);
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+    type = extract32(insn, 22, 2);
-     rm = extract32(insn, 16, 5);
-     cond = extract32(insn, 12, 4);
-     rn = extract32(insn, 5, 5);
-     op = extract32(insn, 4, 1);
-     nzcv = extract32(insn, 0, 4);
--    if (mos || type > 1) {
-+    if (mos) {
-+        unallocated_encoding(s);
-+        return;
-+    }
-+
-+    switch (type) {
-+    case 0:
-+        size = MO_32;
-+        break;
-+    case 1:
-+        size = MO_64;
-+        break;
-+    case 3:
-+        size = MO_16;
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+            break;
-+        }
-+        /* fallthru */
-+    default:
-         unallocated_encoding(s);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
-         gen_set_label(label_match);
-     }
--    handle_fp_compare(s, type, rn, rm, false, op);
-+    handle_fp_compare(s, size, rn, rm, false, op);
-     if (cond < 0x0e) {
-         gen_set_label(label_continue);
 --
-.17.0
+.19.1

-[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-These were missed out from the rest of the half-precision work.
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
-[rth: Fix erroneous check vs type]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
-file changed, 25 insertions(+), 6 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-     unsigned int mos, type, rm, cond, rn, rd;
-     TCGv_i64 t_true, t_false, t_zero;
-     DisasCompare64 c;
-+    TCGMemOp sz;
-     mos = extract32(insn, 29, 3);
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
-+    type = extract32(insn, 22, 2);
-     rm = extract32(insn, 16, 5);
-     cond = extract32(insn, 12, 4);
-     rn = extract32(insn, 5, 5);
-     rd = extract32(insn, 0, 5);
--    if (mos || type > 1) {
-+    if (mos) {
-+        unallocated_encoding(s);
-+        return;
-+    }
-+
-+    switch (type) {
-+    case 0:
-+        sz = MO_32;
-+        break;
-+    case 1:
-+        sz = MO_64;
-+        break;
-+    case 3:
-+        sz = MO_16;
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+            break;
-+        }
-+        /* fallthru */
-+    default:
-         unallocated_encoding(s);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-         return;
-     }
--    /* Zero extend sreg inputs to 64 bits now.  */
-+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
-     t_true = tcg_temp_new_i64();
-     t_false = tcg_temp_new_i64();
--    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
--    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
-+    read_vec_element(s, t_true, rn, 0, sz);
-+    read_vec_element(s, t_false, rm, 0, sz);
-     a64_test_cc(&c, cond);
-     t_zero = tcg_const_i64(0);
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-     tcg_temp_free_i64(t_false);
-     a64_free_cc(&c);
--    /* Note that sregs write back zeros to the high bits,
-+    /* Note that sregs & hregs write back zeros to the high bits,
-        and we've already done the zero-extension.  */
-     write_fp_dreg(s, rd, t_true);
-     tcg_temp_free_i64(t_true);
---
-.17.0

-[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-All the hard work is already done by vfp_expand_imm, we just need to
-make sure we pick up the correct size.
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
-[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 20 +++++++++++++++++---
-file changed, 17 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
- {
-     int rd = extract32(insn, 0, 5);
-     int imm8 = extract32(insn, 13, 8);
--    int is_double = extract32(insn, 22, 2);
-+    int type = extract32(insn, 22, 2);
-     uint64_t imm;
-     TCGv_i64 tcg_res;
-+    TCGMemOp sz;
--    if (is_double > 1) {
-+    switch (type) {
-+    case 0:
-+        sz = MO_32;
-+        break;
-+    case 1:
-+        sz = MO_64;
-+        break;
-+    case 3:
-+        sz = MO_16;
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+            break;
-+        }
-+        /* fallthru */
-+    default:
-         unallocated_encoding(s);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-         return;
-     }
--    imm = vfp_expand_imm(MO_32 + is_double, imm8);
-+    imm = vfp_expand_imm(sz, imm8);
-     tcg_res = tcg_const_i64(imm);
-     write_fp_dreg(s, rd, tcg_res);
---
-.17.0

-[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-We are meant to explicitly pass fpst, not cpu_env.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
-         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-         break;
-     case 0x3: /* FSQRT */
--        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
-+        fpst = get_fpstatus_ptr(true);
-+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
-         break;
-     case 0x8: /* FRINTN */
-     case 0x9: /* FRINTP */
---
-.17.0

-[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
+[Qemu-devel] [PULL 10/10] MAINTAINERS: list myself as maintainer for various Arm boards
-Usually the logging of the CPU state produced by -d cpu is sufficient
+In practice for most of the more-or-less orphan Arm board models,
-to diagnose problems, but sometimes you want to see the state of
+I will review patches and put them in via the target-arm tree.
-the floating point registers as well. We don't want to enable that
+So list myself as an "Odd Fixes" status maintainer for them.
-by default as it adds a lot of extra data to the log; instead,
-allow it to be optionally enabled via -d fpu.
+This commit downgrades these boards to "Odd Fixes":
  * Allwinner-A10
  * Exynos
  * Calxeda Highbank
  * Canon DIGIC
  * Musicpal
  * nSeries
  * Palm
  * PXA2xx
 These boards were already "Odd Fixes":
  * Gumstix
  * i.MX31 (kzm)
 Philippe Mathieu-Daudé has requested to be moved to R:
 status for Gumstix now that I am listed as the M: contact.
 Some boards are maintained, but their patches still go
 via the target-arm tree, so add myself as a secondary
 maintainer contact for those:
  * Xilinx Zynq
  * Xilinx ZynqMP
  * STM32F205
  * Netduino 2
  * SmartFusion2
  * Mecraft M2S-FG484
  * ASPEED BMCs
  * NRF51
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
+Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
 ---
- include/qemu/log.h   | 1 +
+ MAINTAINERS | 36 +++++++++++++++++++++++++++---------
- accel/tcg/cpu-exec.c | 9 ++++++---
+file changed, 27 insertions(+), 9 deletions(-)
- util/log.c           | 2 ++
-files changed, 9 insertions(+), 3 deletions(-)
+diff --git a/MAINTAINERS b/MAINTAINERS
 diff --git a/include/qemu/log.h b/include/qemu/log.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/log.h
+--- a/MAINTAINERS
-+++ b/include/qemu/log.h
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
+@@ -XXX,XX +XXX,XX @@ ARM Machines
- #define CPU_LOG_PAGE       (1 << 14)
+ ------------
- /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
+ Allwinner-a10
- #define CPU_LOG_TB_OP_IND  (1 << 16)
+ M: Beniamino Galvani <b.galvani@gmail.com>
-+#define CPU_LOG_TB_FPU     (1 << 17)
++M: Peter Maydell <peter.maydell@linaro.org>
+ L: qemu-arm@nongnu.org
- /* Lock output for a series of related logs.  Since this is not needed
+-S: Maintained
-  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
++S: Odd Fixes
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+ F: hw/*/allwinner*
-index XXXXXXX..XXXXXXX 100644
+ F: include/hw/*/allwinner*
---- a/accel/tcg/cpu-exec.c
+ F: hw/arm/cubieboard.c
-+++ b/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ F: tests/test-arm-mptimer.c
-@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
-     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
+ Exynos
-         && qemu_log_in_addr_range(itb->pc)) {
+ M: Igor Mitsyanko <i.mitsyanko@gmail.com>
-         qemu_log_lock();
++M: Peter Maydell <peter.maydell@linaro.org>
-+        int flags = 0;
+ L: qemu-arm@nongnu.org
-+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+-S: Maintained
-+            flags |= CPU_DUMP_FPU;
++S: Odd Fixes
-+        }
+ F: hw/*/exynos*
- #if defined(TARGET_I386)
+ F: include/hw/arm/exynos4210.h
--        log_cpu_state(cpu, CPU_DUMP_CCOP);
--#else
+ Calxeda Highbank
--        log_cpu_state(cpu, 0);
+ M: Rob Herring <robh@kernel.org>
-+        flags |= CPU_DUMP_CCOP;
++M: Peter Maydell <peter.maydell@linaro.org>
- #endif
+ L: qemu-arm@nongnu.org
-+        log_cpu_state(cpu, flags);
+-S: Maintained
-         qemu_log_unlock();
++S: Odd Fixes
-     }
+ F: hw/arm/highbank.c
- #endif /* DEBUG_DISAS */
+ F: hw/net/xgmac.c
-diff --git a/util/log.c b/util/log.c
-index XXXXXXX..XXXXXXX 100644
+ Canon DIGIC
---- a/util/log.c
+ M: Antony Pavlov <antonynpavlov@gmail.com>
-+++ b/util/log.c
++M: Peter Maydell <peter.maydell@linaro.org>
-@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
+ L: qemu-arm@nongnu.org
-       "show trace before each executed TB (lots of logs)" },
+-S: Maintained
-     { CPU_LOG_TB_CPU, "cpu",
++S: Odd Fixes
-       "show CPU registers before entering a TB (lots of logs)" },
+ F: include/hw/arm/digic.h
-+    { CPU_LOG_TB_FPU, "fpu",
+ F: hw/*/digic*
-+      "include FPU registers in the 'cpu' logging" },
-     { CPU_LOG_MMU, "mmu",
+ Gumstix
-       "log MMU-related activities" },
+-M: Philippe Mathieu-Daudé <f4bug@amsat.org>
-     { CPU_LOG_PCALL, "pcall",
++M: Peter Maydell <peter.maydell@linaro.org>
 +R: Philippe Mathieu-Daudé <f4bug@amsat.org>
  L: qemu-devel@nongnu.org
  L: qemu-arm@nongnu.org
  S: Odd Fixes
@@ -XXX,XX +XXX,XX @@ F: hw/arm/gumstix.c
  i.MX31 (kzm)
  M: Peter Chubb <peter.chubb@nicta.com.au>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Odd Fixes
  F: hw/arm/kzm.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/iotkit-sysinfo.h
  Musicpal
  M: Jan Kiszka <jan.kiszka@web.de>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/musicpal.c
  nSeries
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/nseries.c
  Palm
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/palm.c
  Raspberry Pi
@@ -XXX,XX +XXX,XX @@ F: include/hw/intc/realview_gic.h
  PXA2XX
  M: Andrzej Zaborowski <balrogg@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/mainstone.c
  F: hw/arm/spitz.c
  F: hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/arm/virt.h
  Xilinx Zynq
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/xilinx_*
@@ -XXX,XX +XXX,XX @@ X: hw/ssi/xilinx_*
  Xilinx ZynqMP
  M: Alistair Francis <alistair@alistair23.me>
  M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/*/xlnx*.c
@@ -XXX,XX +XXX,XX @@ F: hw/arm/virt-acpi-build.c
  STM32F205
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/stm32f205_soc.c
  F: hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/*/stm32*.h
  Netduino 2
  M: Alistair Francis <alistair@alistair23.me>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/netduino2.c
  SmartFusion2
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/msf2-soc.c
  F: hw/misc/msf2-sysreg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/mss-spi.h
  Emcraft M2S-FG484
  M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
 +M: Peter Maydell <peter.maydell@linaro.org>
  S: Maintained
  F: hw/arm/msf2-som.c
  ASPEED BMCs
  M: Cédric Le Goater <clg@kaod.org>
 +M: Peter Maydell <peter.maydell@linaro.org>
  R: Andrew Jeffery <andrew@aj.id.au>
  R: Joel Stanley <joel@jms.id.au>
  L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: include/hw/net/ftgmac100.h
  NRF51
  M: Joel Stanley <joel@jms.id.au>
 +M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/arm/nrf51_soc.c
 --
-.17.0
+.19.1

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0

Some Arm bugfixes for rc2...

thanks
-- PMM

The following changes since commit e6ebbd46b6e539f3613136111977721d212c2812:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-11-19 14:31:48 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181119

for you to fetch changes up to a00d7f2048c2a1a6a4487ac195c804c78adcf60e:

MAINTAINERS: list myself as maintainer for various Arm boards (2018-11-19 15:55:11 +0000)

----------------------------------------------------------------
target-arm queue:
 * various MAINTAINERS file updates
 * hw/block/onenand: use qemu_log_mask() for reporting
 * hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
   on the n800 and n810 machine models
 * target/arm: fix smc incorrectly trapping to EL3 when secure is off
 * hw/arm/stm32f205: Fix the UART and Timer region size
 * target/arm: read ID registers for KVM guests so they can be
   used to gate "is feature X present" checks

----------------------------------------------------------------
Luc Michel (1):
      target/arm: fix smc incorrectly trapping to EL3 when secure is off

Peter Maydell (3):
      hw/block/onenand: Fix off-by-one error allowing out-of-bounds read
      hw/block/onenand: use qemu_log_mask() for reporting
      MAINTAINERS: list myself as maintainer for various Arm boards

Richard Henderson (4):
      target/arm: Install ARMISARegisters from kvm host
      target/arm: Fill in ARMISARegisters for kvm64
      target/arm: Introduce read_sys_reg32 for kvm32
      target/arm: Fill in ARMISARegisters for kvm32

Seth Kintigh (1):
      hw/arm/stm32f205: Fix the UART and Timer region size

Thomas Huth (1):
      MAINTAINERS: Add entries for missing ARM boards

target/arm/kvm_arm.h       |   1 +
 hw/block/onenand.c         |  24 +++++-----
 hw/char/stm32f2xx_usart.c  |   2 +-
 hw/timer/stm32f2xx_timer.c |   2 +-
 target/arm/kvm.c           |   1 +
 target/arm/kvm32.c         |  77 ++++++++++++++++++++------------
 target/arm/kvm64.c         |  90 +++++++++++++++++++++++++++++++++++++-
 target/arm/op_helper.c     |  54 +++++++++++++++++++----
 MAINTAINERS                | 106 +++++++++++++++++++++++++++++++++++++++------
 9 files changed, 293 insertions(+), 64 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

The ID registers are replacing (some of) the feature bits.
We need (some of) these values to determine the set of data
to be handled during migration.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 1 +
 target/arm/kvm.c     | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
  * by asking the host kernel)
  */
 typedef struct ARMHostCPUFeatures {
+    ARMISARegisters isar;
     uint64_t features;
     uint32_t target;
     const char *dtb_compatible;
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
 
     cpu->kvm_target = arm_host_cpu_features.target;
     cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
+    cpu->isar = arm_host_cpu_features.isar;
     env->features = arm_host_cpu_features.features;
 }
 
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 90 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 88 insertions(+), 2 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static inline void unset_feature(uint64_t *features, int feature)
     *features &= ~(1ULL << feature);
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    uint64_t ret;
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)&ret };
+    int err;
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    err = ioctl(fd, KVM_GET_ONE_REG, &idreg);
+    if (err < 0) {
+        return -1;
+    }
+    *pret = ret;
+    return 0;
+}
+
+static int read_sys_reg64(int fd, uint64_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U64);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
      * fill out the ARMHostCPUClass fields accordingly. To do this
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
-     * For AArch64 we currently don't care about ID registers at
-     * all; we just want to know the CPU type.
      */
     int fdarray[3];
     uint64_t features = 0;
+    int err;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type. Fortunately these old kernels
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     ahcf->target = init.target;
     ahcf->dtb_compatible = "arm,arm-v8";
 
+    err = read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr0,
+                         ARM64_SYS_REG(3, 0, 0, 4, 0));
+    if (unlikely(err < 0)) {
+        /*
+         * Before v4.15, the kernel only exposed a limited number of system
+         * registers, not including any of the interesting AArch64 ID regs.
+         * For the most part we could leave these fields as zero with minimal
+         * effect, since this does not affect the values seen by the guest.
+         *
+         * However, it could cause problems down the line for QEMU,
+         * so provide a minimal v8.0 default.
+         *
+         * ??? Could read MIDR and use knowledge from cpu64.c.
+         * ??? Could map a page of memory into our temp guest and
+         *     run the tiniest of hand-crafted kernels to extract
+         *     the values seen by the guest.
+         * ??? Either of these sounds like too much effort just
+         *     to work around running a modern host kernel.
+         */
+        ahcf->isar.id_aa64pfr0 = 0x00000011; /* EL1&0, AArch64 only */
+        err = 0;
+    } else {
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64pfr1,
+                              ARM64_SYS_REG(3, 0, 0, 4, 1));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar0,
+                              ARM64_SYS_REG(3, 0, 0, 6, 0));
+        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64isar1,
+                              ARM64_SYS_REG(3, 0, 0, 6, 1));
+
+        /*
+         * Note that if AArch32 support is not present in the host,
+         * the AArch32 sysregs are present to be read, but will
+         * return UNKNOWN values.  This is neither better nor worse
+         * than skipping the reads and leaving 0, as we must avoid
+         * considering the values in every case.
+         */
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                              ARM64_SYS_REG(3, 0, 0, 2, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                              ARM64_SYS_REG(3, 0, 0, 2, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                              ARM64_SYS_REG(3, 0, 0, 2, 2));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                              ARM64_SYS_REG(3, 0, 0, 2, 3));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                              ARM64_SYS_REG(3, 0, 0, 2, 4));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                              ARM64_SYS_REG(3, 0, 0, 2, 5));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                              ARM64_SYS_REG(3, 0, 0, 2, 7));
+
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                              ARM64_SYS_REG(3, 0, 0, 3, 0));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
+                              ARM64_SYS_REG(3, 0, 0, 3, 1));
+        err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr2,
+                              ARM64_SYS_REG(3, 0, 0, 3, 2));
+    }
+
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
+    if (err < 0) {
+        return false;
+    }
+
    /* We can assume any KVM supporting CPU is at least a v8
      * with VFPv4+Neon; this in turn implies most of the other
      * feature bits.
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Assert that the value to be written is the correct size.
No change in functionality here, just mirroring the same
function from kvm64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 41 ++++++++++++++++-------------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ static inline void set_feature(uint64_t *features, int feature)
     *features |= 1ULL << feature;
 }
 
+static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
+{
+    struct kvm_one_reg idreg = { .id = id, .addr = (uintptr_t)pret };
+
+    assert((id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32);
+    return ioctl(fd, KVM_GET_ONE_REG, &idreg);
+}
+
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     /* Identify the feature bits corresponding to the host CPU, and
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * we have to create a scratch VM, create a single CPU inside it,
      * and then query that CPU for the relevant ID registers.
      */
-    int i, ret, fdarray[3];
+    int err = 0, fdarray[3];
     uint32_t midr, id_pfr0, mvfr1;
     uint64_t features = 0;
+
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
      * we know these will only support creating one kind of guest CPU,
      * which is its preferred CPU type.
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         QEMU_KVM_ARM_TARGET_NONE
     };
     struct kvm_vcpu_init init;
-    struct kvm_one_reg idregs[] = {
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 0, 0, 0),
-            .addr = (uintptr_t)&midr,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | ENCODE_CP_REG(15, 0, 0, 0, 1, 0, 0),
-            .addr = (uintptr_t)&id_pfr0,
-        },
-        {
-            .id = KVM_REG_ARM | KVM_REG_SIZE_U32
-            | KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1,
-            .addr = (uintptr_t)&mvfr1,
-        },
-    };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      */
     ahcf->dtb_compatible = "arm,arm-v7";
 
-    for (i = 0; i < ARRAY_SIZE(idregs); i++) {
-        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &idregs[i]);
-        if (ret) {
-            break;
-        }
-    }
+    err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
+    err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
+    err |= read_sys_reg32(fdarray[2], &mvfr1,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
-    if (ret) {
+    if (err < 0) {
         return false;
     }
 
-- 
2.19.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181113180154.17903-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm32.c | 40 +++++++++++++++++++++++++++++++++++-----
 1 file changed, 35 insertions(+), 5 deletions(-)

diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * and then query that CPU for the relevant ID registers.
      */
     int err = 0, fdarray[3];
-    uint32_t midr, id_pfr0, mvfr1;
+    uint32_t midr, id_pfr0;
     uint64_t features = 0;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 
     err |= read_sys_reg32(fdarray[2], &midr, ARM_CP15_REG32(0, 0, 0, 0));
     err |= read_sys_reg32(fdarray[2], &id_pfr0, ARM_CP15_REG32(0, 0, 1, 0));
-    err |= read_sys_reg32(fdarray[2], &mvfr1,
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar0,
+                          ARM_CP15_REG32(0, 0, 2, 0));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar1,
+                          ARM_CP15_REG32(0, 0, 2, 1));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar2,
+                          ARM_CP15_REG32(0, 0, 2, 2));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar3,
+                          ARM_CP15_REG32(0, 0, 2, 3));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar4,
+                          ARM_CP15_REG32(0, 0, 2, 4));
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.id_isar5,
+                          ARM_CP15_REG32(0, 0, 2, 5));
+    if (read_sys_reg32(fdarray[2], &ahcf->isar.id_isar6,
+                       ARM_CP15_REG32(0, 0, 2, 7))) {
+        /*
+         * Older kernels don't support reading ID_ISAR6. This register was
+         * only introduced in ARMv8, so we can assume that it is zero on a
+         * CPU that a kernel this old is running on.
+         */
+        ahcf->isar.id_isar6 = 0;
+    }
+
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr0,
+                          KVM_REG_ARM | KVM_REG_SIZE_U32 |
+                          KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR0);
+    err |= read_sys_reg32(fdarray[2], &ahcf->isar.mvfr1,
                           KVM_REG_ARM | KVM_REG_SIZE_U32 |
                           KVM_REG_ARM_VFP | KVM_REG_ARM_VFP_MVFR1);
+    /*
+     * FIXME: There is not yet a way to read MVFR2.
+     * Fortunately there is not yet anything in there that affects migration.
+     */
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(id_pfr0, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_THUMB2EE);
     }
-    if (extract32(mvfr1, 20, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 20, 4) == 1) {
         set_feature(&features, ARM_FEATURE_VFP_FP16);
     }
-    if (extract32(mvfr1, 12, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
-    if (extract32(mvfr1, 28, 4) == 1) {
+    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
         /* FMAC support implies VFPv4 */
         set_feature(&features, ARM_FEATURE_VFP4);
     }
-- 
2.19.1

From: Thomas Huth <thuth@redhat.com>

Add entries for the boards "mcimx6ul-evk", "mcimx7d-sabre", "raspi2",
"raspi3", "sabrelite", "vexpress-a15", "vexpress-a9" and "virt".
While we're at it, also adjust the "i.MX31" section a little bit,
so that the wildcards there do not match anymore for unrelated files
(e.g. the new hw/misc/imx6ul_ccm.c file).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1542184999-11145-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 70 +++++++++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 65 insertions(+), 5 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/gumstix.c
 
-i.MX31
+i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
 L: qemu-arm@nongnu.org
-S: Odd fixes
-F: hw/*/imx*
-F: include/hw/*/imx*
+S: Odd Fixes
 F: hw/arm/kzm.c
-F: include/hw/arm/fsl-imx31.h
+F: hw/*/imx_*
+F: hw/*/*imx31*
+F: include/hw/*/imx_*
+F: include/hw/*/*imx31*
 
 Integrator CP
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 
+MCIMX6UL EVK / i.MX6ul
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx6ul-evk.c
+F: hw/arm/fsl-imx6ul.c
+F: hw/misc/imx6ul_ccm.c
+F: include/hw/arm/fsl-imx6ul.h
+F: include/hw/misc/imx6ul_ccm.h
+
+MCIMX7D SABRE / i.MX7
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrey Smirnov <andrew.smirnov@gmail.com>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/mcimx7d-sabre.c
+F: hw/arm/fsl-imx7.c
+F: include/hw/arm/fsl-imx7.h
+F: hw/pci-host/designware.c
+F: include/hw/pci-host/designware.h
+
 MPS2
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/palm.c
 
+Raspberry Pi
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Andrew Baumann <Andrew.Baumann@microsoft.com>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/raspi_platform.h
+F: hw/*/bcm283*
+F: include/hw/arm/raspi*
+F: include/hw/*/bcm283*
+
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: hw/*/pxa2xx*
 F: hw/misc/mst_fpga.c
 F: include/hw/arm/pxa.h
 
+SABRELITE / i.MX6
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Jean-Christophe Dubois <jcd@tribudubois.net>
+L: qemu-arm@nongnu.org
+S: Odd Fixes
+F: hw/arm/sabrelite.c
+F: hw/arm/fsl-imx6.c
+F: hw/misc/imx6_src.c
+F: hw/ssi/imx_spi.c
+F: include/hw/arm/fsl-imx6.h
+F: include/hw/misc/imx6_src.h
+F: include/hw/ssi/imx_spi.h
+
 Sharp SL-5500 (Collie) PDA
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/stellaris*
 
+Versatile Express
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/vexpress.c
+
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/*/versatile*
 F: hw/misc/arm_sysctl.c
 
+Virt
+M: Peter Maydell <peter.maydell@linaro.org>
+L: qemu-arm@nongnu.org
+S: Maintained
+F: hw/arm/virt*
+F: include/hw/arm/virt.h
+
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
-- 
2.19.1

From: Seth Kintigh <skintigh@gmail.com>

The UART and timer devices for the stm32f205 were being created
with memory regions that were too large. Use the size specified
in the chip datasheet.

The old sizes were so large that the devices would overlap with
each other in the SoC memory map, so this fixes a bug that
caused odd behavior and/or crashes when trying to set up multiple
UARTs.

Signed-off-by: Seth Kintigh <skintigh@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: rephrased commit message to follow our usual standard]
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/stm32f2xx_usart.c  | 2 +-
 hw/timer/stm32f2xx_timer.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_usart_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_usart_ops, s,
-                          TYPE_STM32F2XX_USART, 0x2000);
+                          TYPE_STM32F2XX_USART, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
diff --git a/hw/timer/stm32f2xx_timer.c b/hw/timer/stm32f2xx_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/stm32f2xx_timer.c
+++ b/hw/timer/stm32f2xx_timer.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_timer_init(Object *obj)
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
 
     memory_region_init_io(&s->iomem, obj, &stm32f2xx_timer_ops, s,
-                          "stm32f2xx_timer", 0x4000);
+                          "stm32f2xx_timer", 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);
 
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, stm32f2xx_timer_interrupt, s);
-- 
2.19.1

From: Luc Michel <luc.michel@greensocs.com>

This commit fixes a case where the CPU would try to go to EL3 when
executing an smc instruction, even though ARM_FEATURE_EL3 is false. This
case is raised when the PSCI conduit is set to smc, but the smc
instruction does not lead to a valid PSCI call.

QEMU crashes with an assertion failure latter on because of incoherent
mmu_idx.

This commit refactors the pre_smc helper by enumerating all the possible
way of handling an scm instruction, and covering the previously missing
case leading to the crash.

The following minimal test would crash before this commit:

.global _start
    .text
_start:
    ldr x0, =0xdeadbeef  ; invalid PSCI call
    smc #0

run with the following command line:

aarch64-linux-gnu-gcc -nostdinc -nostdlib -Wl,-Ttext=40000000 \
                      -o test test.s

qemu-system-aarch64 -M virt,virtualization=on,secure=off \
                    -cpu cortex-a57 -kernel test

Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20181117160213.18995-1-luc.michel@greensocs.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/op_helper.c | 54 +++++++++++++++++++++++++++++++++++-------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
     ARMCPU *cpu = arm_env_get_cpu(env);
     int cur_el = arm_current_el(env);
     bool secure = arm_is_secure(env);
-    bool smd = env->cp15.scr_el3 & SCR_SMD;
+    bool smd_flag = env->cp15.scr_el3 & SCR_SMD;
+
+    /*
+     * SMC behaviour is summarized in the following table.
+     * This helper handles the "Trap to EL2" and "Undef insn" cases.
+     * The "Trap to EL3" and "PSCI call" cases are handled in the exception
+     * helper.
+     *
+     *  -> ARM_FEATURE_EL3 and !SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Trap to EL3
+     *  Conduit not SMC          Trap to EL2         Trap to EL3
+     *
+     *
+     *  -> ARM_FEATURE_EL3 and SMD
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Trap to EL2         Undef insn
+     *
+     *
+     *  -> !ARM_FEATURE_EL3
+     *                           HCR_TSC && NS EL1   !HCR_TSC || !NS EL1
+     *
+     *  Conduit SMC, valid call  Trap to EL2         PSCI Call
+     *  Conduit SMC, inval call  Trap to EL2         Undef insn
+     *  Conduit not SMC          Undef insn          Undef insn
+     */
+
     /* On ARMv8 with EL3 AArch64, SMD applies to both S and NS state.
      * On ARMv8 with EL3 AArch32, or ARMv7 with the Virtualization
      *  extensions, SMD only applies to NS state.
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
      * doesn't exist, but we forbid the guest to set it to 1 in scr_write(),
      * so we need not special case this here.
      */
-    bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
+    bool smd = arm_feature(env, ARM_FEATURE_AARCH64) ? smd_flag
+                                                     : smd_flag && !secure;
 
     if (!arm_feature(env, ARM_FEATURE_EL3) &&
         cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
          * to forbid its EL1 from making PSCI calls into QEMU's
          * "firmware" via HCR.TSC, so for these purposes treat
          * PSCI-via-SMC as implying an EL3.
+         * This handles the very last line of the previous table.
          */
-        undef = true;
-    } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
+        raise_exception(env, EXCP_UDEF, syn_uncategorized(),
+                        exception_target_el(env));
+    }
+
+    if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
         /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
          * We also want an EL2 guest to be able to forbid its EL1 from
          * making PSCI calls into QEMU's "firmware" via HCR.TSC.
+         * This handles all the "Trap to EL2" cases of the previous table.
          */
         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
     }
 
-    /* If PSCI is enabled and this looks like a valid PSCI call then
-     * suppress the UNDEF -- we'll catch the SMC exception and
-     * implement the PSCI call behaviour there.
+    /* Catch the two remaining "Undef insn" cases of the previous table:
+     *    - PSCI conduit is SMC but we don't have a valid PCSI call,
+     *    - We don't have EL3 or SMD is set.
      */
-    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
+    if (!arm_is_psci_call(cpu, EXCP_SMC) &&
+        (smd || !arm_feature(env, ARM_FEATURE_EL3))) {
         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                         exception_target_el(env));
     }
-- 
2.19.1

An off-by-one error in a switch case in onenand_read() allowed
a misbehaving guest to read off the end of a block of memory.

NB: the onenand device is used only by the "n800" and "n810"
machines, which are usable only with TCG, not KVM, so this is
not a security issue.

Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20181115143535.5885-2-peter.maydell@linaro.org
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/onenand.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     int offset = addr >> s->shift;
 
     switch (offset) {
-    case 0x0000 ... 0xc000:
+    case 0x0000 ... 0xbffe:
         return lduw_le_p(s->boot[0] + addr);
 
     case 0xf000:	/* Manufacturer ID */
-- 
2.19.1

Update the onenand device to use qemu_log_mask() for reporting
guest errors and unimplemented features, rather than plain
fprintf() and hw_error().

(We leave the hw_error() in onenand_reset(), as that is
triggered by a failure to read the underlying block device
for the bootRAM, not by guest action.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20181115143535.5885-3-peter.maydell@linaro.org
---
 hw/block/onenand.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/hw/block/onenand.c b/hw/block/onenand.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/onenand.c
+++ b/hw/block/onenand.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/memory.h"
 #include "hw/sysbus.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
 
 /* 11 for 2kB-page OneNAND ("2nd generation") and 10 for 1kB-page chips */
 #define PAGE_SHIFT	11
@@ -XXX,XX +XXX,XX @@ static void onenand_command(OneNANDState *s)
     default:
         s->status |= ONEN_ERR_CMD;
         s->intstatus |= ONEN_INT;
-        fprintf(stderr, "%s: unknown OneNAND command %x\n",
-                        __func__, s->command);
+        qemu_log_mask(LOG_GUEST_ERROR, "unknown OneNAND command %x\n",
+                      s->command);
     }
 
     onenand_intr_update(s);
@@ -XXX,XX +XXX,XX @@ static uint64_t onenand_read(void *opaque, hwaddr addr,
     case 0xff02:	/* ECC Result of spare area data */
     case 0xff03:	/* ECC Result of main area data */
     case 0xff04:	/* ECC Result of spare area data */
-        hw_error("%s: implement ECC\n", __func__);
+        qemu_log_mask(LOG_UNIMP,
+                      "onenand: ECC result registers unimplemented\n");
         return 0x0000;
     }
 
-    fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                    __func__, offset);
+    qemu_log_mask(LOG_GUEST_ERROR, "read of unknown OneNAND register 0x%x\n",
+                  offset);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
             break;
 
         default:
-            fprintf(stderr, "%s: unknown OneNAND boot command %"PRIx64"\n",
-                            __func__, value);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "unknown OneNAND boot command %" PRIx64 "\n",
+                          value);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void onenand_write(void *opaque, hwaddr addr,
         break;
 
     default:
-        fprintf(stderr, "%s: unknown OneNAND register %x\n",
-                        __func__, offset);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "write to unknown OneNAND register 0x%x\n",
+                      offset);
     }
 }
 
-- 
2.19.1

In practice for most of the more-or-less orphan Arm board models,
I will review patches and put them in via the target-arm tree.
So list myself as an "Odd Fixes" status maintainer for them.

This commit downgrades these boards to "Odd Fixes":
 * Allwinner-A10
 * Exynos
 * Calxeda Highbank
 * Canon DIGIC
 * Musicpal
 * nSeries
 * Palm
 * PXA2xx

These boards were already "Odd Fixes":
 * Gumstix
 * i.MX31 (kzm)

Philippe Mathieu-Daudé has requested to be moved to R:
status for Gumstix now that I am listed as the M: contact.

Some boards are maintained, but their patches still go
via the target-arm tree, so add myself as a secondary
maintainer contact for those:
 * Xilinx Zynq
 * Xilinx ZynqMP
 * STM32F205
 * Netduino 2
 * SmartFusion2
 * Mecraft M2S-FG484
 * ASPEED BMCs
 * NRF51

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20181108134139.31666-1-peter.maydell@linaro.org
---
 MAINTAINERS | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ ARM Machines
 ------------
 Allwinner-a10
 M: Beniamino Galvani <b.galvani@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/allwinner*
 F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
@@ -XXX,XX +XXX,XX @@ F: tests/test-arm-mptimer.c
 
 Exynos
 M: Igor Mitsyanko <i.mitsyanko@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/exynos*
 F: include/hw/arm/exynos4210.h
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/highbank.c
 F: hw/net/xgmac.c
 
 Canon DIGIC
 M: Antony Pavlov <antonynpavlov@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
 
 Gumstix
-M: Philippe Mathieu-Daudé <f4bug@amsat.org>
+M: Peter Maydell <peter.maydell@linaro.org>
+R: Philippe Mathieu-Daudé <f4bug@amsat.org>
 L: qemu-devel@nongnu.org
 L: qemu-arm@nongnu.org
 S: Odd Fixes
@@ -XXX,XX +XXX,XX @@ F: hw/arm/gumstix.c
 
 i.MX31 (kzm)
 M: Peter Chubb <peter.chubb@nicta.com.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Odd Fixes
 F: hw/arm/kzm.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/iotkit-sysinfo.h
 
 Musicpal
 M: Jan Kiszka <jan.kiszka@web.de>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/musicpal.c
 
 nSeries
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/nseries.c
 
 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/palm.c
 
 Raspberry Pi
@@ -XXX,XX +XXX,XX @@ F: include/hw/intc/realview_gic.h
 
 PXA2XX
 M: Andrzej Zaborowski <balrogg@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/mainstone.c
 F: hw/arm/spitz.c
 F: hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/arm/virt.h
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xilinx_*
@@ -XXX,XX +XXX,XX @@ X: hw/ssi/xilinx_*
 Xilinx ZynqMP
 M: Alistair Francis <alistair@alistair23.me>
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/*/xlnx*.c
@@ -XXX,XX +XXX,XX @@ F: hw/arm/virt-acpi-build.c
 
 STM32F205
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/stm32f205_soc.c
 F: hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/*/stm32*.h
 
 Netduino 2
 M: Alistair Francis <alistair@alistair23.me>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/netduino2.c
 
 SmartFusion2
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-soc.c
 F: hw/misc/msf2-sysreg.c
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/mss-spi.h
 
 Emcraft M2S-FG484
 M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+M: Peter Maydell <peter.maydell@linaro.org>
 S: Maintained
 F: hw/arm/msf2-som.c
 
 ASPEED BMCs
 M: Cédric Le Goater <clg@kaod.org>
+M: Peter Maydell <peter.maydell@linaro.org>
 R: Andrew Jeffery <andrew@aj.id.au>
 R: Joel Stanley <joel@jms.id.au>
 L: qemu-arm@nongnu.org
@@ -XXX,XX +XXX,XX @@ F: include/hw/net/ftgmac100.h
 
 NRF51
 M: Joel Stanley <joel@jms.id.au>
+M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/nrf51_soc.c
-- 
2.19.1