Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[Qemu-devel] [PULL 00/15] target-arm queue
-The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
+A mixed bag, all bug fixes or similar small stuff.
-  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
+thanks
 -- PMM
 The following changes since commit 19eb2d4e736dc895f31fbd6b520e514f10cc08e0:
   Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2019-05-07 10:43:32 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190507
-for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
+for you to fetch changes up to 63159601fb3e396b28da14cbb71e50ed3f5a0331:
-  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
+  target/arm: Stop using variable length array in dc_zva (2019-05-07 12:55:04 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix coverity nit in int_to_float code
+ * Stop using variable length array in dc_zva
- * Don't set Invalid for float-to-int(MAXINT)
+ * Implement M-profile XPSR GE bits
- * Fix fp_status_f16 tininess before rounding
+ * Don't enable ARMV7M_EXCP_DEBUG from reset
- * Add various missing insns from the v8.2-FP16 extension
+ * armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
- * Fix sqrt_f16 exception raising
+ * armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
- * sdcard: Correct CRC16 offset in sd_function_switch()
+ * fix various minor issues to allow building for Windows-on-ARM64
- * tcg: Optionally log FPU state in TCG -d cpu logging
+ * aspeed: Set SDRAM size
  * Allow system registers for KVM guests to be changed by QEMU code
  * raspi: Diagnose requests for too much RAM
  * virt: Support firmware configuration with -blockdev
 ----------------------------------------------------------------
-Alex Bennée (5):
+Cao Jiaxi (4):
-      fpu/softfloat: int_to_float ensure r fully initialised
+      QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
-      target/arm: Implement FCMP for fp16
+      qga: Fix mingw compilation warnings on enum conversion
-      target/arm: Implement FCSEL for fp16
+      util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
-      target/arm: Implement FMOV (immediate) for fp16
+      osdep: Fix mingw compilation regarding stdio formats
       target/arm: Fix sqrt_f16 exception raising
-Peter Maydell (3):
+Joel Stanley (1):
-      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+      arm: aspeed: Set SDRAM size
       target/arm: Fix fp_status_f16 tininess before rounding
       tcg: Optionally log FPU state in TCG -d cpu logging
-Philippe Mathieu-Daudé (1):
+Markus Armbruster (3):
-      sdcard: Correct CRC16 offset in sd_function_switch()
+      pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
       pflash_cfi01: New pflash_cfi01_legacy_drive()
       hw/arm/virt: Support firmware configuration with -blockdev
-Richard Henderson (7):
+Peter Maydell (7):
-      target/arm: Implement FMOV (general) for fp16
+      hw/arm/raspi: Diagnose requests for too much RAM
-      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+      arm: Allow system registers for KVM guests to be changed by QEMU code
-      target/arm: Implement FCVT (scalar, integer) for fp16
+      hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
-      target/arm: Implement FCVT (scalar, fixed-point) for fp16
+      hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
-      target/arm: Introduce and use read_fp_hreg
+      hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
-      target/arm: Implement FP data-processing (2 source) for fp16
+      target/arm: Implement XPSR GE bits
-      target/arm: Implement FP data-processing (3 source) for fp16
+      target/arm: Stop using variable length array in dc_zva
- include/qemu/log.h         |   1 +
+ contrib/libvhost-user/libvhost-user.h |   2 +-
- target/arm/helper-a64.h    |   2 +
+ include/hw/arm/aspeed.h               |   1 +
- target/arm/helper.h        |   6 +
+ include/hw/arm/virt.h                 |   2 +
- accel/tcg/cpu-exec.c       |   9 +-
+ include/hw/block/flash.h              |   1 +
- fpu/softfloat.c            |   6 +-
+ include/qemu/compiler.h               |   2 +-
- hw/sd/sd.c                 |   2 +-
+ include/qemu/osdep.h                  |  10 +-
- target/arm/cpu.c           |   2 +
+ scripts/cocci-macro-file.h            |   7 +-
- target/arm/helper-a64.c    |  10 ++
+ target/arm/cpu.h                      |  13 ++-
- target/arm/helper.c        |  38 +++-
+ hw/arm/aspeed.c                       |   8 ++
- target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
+ hw/arm/raspi.c                        |   7 ++
- util/log.c                 |   2 +
+ hw/arm/virt.c                         | 202 ++++++++++++++++++++++------------
-files changed, 428 insertions(+), 71 deletions(-)
+ hw/block/pflash_cfi01.c               |  28 +++++
  hw/i386/pc_sysfw.c                    |  18 +--
  hw/intc/armv7m_nvic.c                 |  40 ++++++-
  qga/commands-win32.c                  |   2 +-
  target/arm/helper.c                   |  47 +++++++-
  target/arm/kvm.c                      |   8 ++
  target/arm/kvm32.c                    |  20 +---
  target/arm/kvm64.c                    |   2 +
  target/arm/machine.c                  |   2 +-
  util/cacheinfo.c                      |   2 +-
 files changed, 294 insertions(+), 130 deletions(-)

-[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+[Qemu-devel] [PULL 01/15] pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Markus Armbruster <armbru@redhat.com>
-We are meant to explicitly pass fpst, not cpu_env.
+The loop does two things: map legacy -drive to properties, and collect
 all the backends for use after the loop.  The next patch will factor
 out the former for reuse in hw/arm/virt.c.  To make that easier,
 rearrange the loop so it does the first thing first, and the second
 thing second.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Markus Armbruster <armbru@redhat.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190416091348.26075-2-armbru@redhat.com
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 3 ++-
+ hw/i386/pc_sysfw.c | 24 +++++++++++-------------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 11 insertions(+), 13 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/i386/pc_sysfw.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/i386/pc_sysfw.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
-         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
-         break;
+     /* Map legacy -drive if=pflash to machine properties */
-     case 0x3: /* FSQRT */
+     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
--        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+-        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
-+        fpst = get_fpstatus_ptr(true);
+         pflash_drv = drive_get(IF_PFLASH, 0, i);
-+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
+-        if (!pflash_drv) {
-         break;
+-            continue;
-     case 0x8: /* FRINTN */
++        if (pflash_drv) {
-     case 0x9: /* FRINTP */
++            loc_push_none(&loc);
 +            qemu_opts_loc_restore(pflash_drv->opts);
 +            if (pflash_cfi01_get_blk(pcms->flash[i])) {
 +                error_report("clashes with -machine");
 +                exit(1);
 +            }
 +            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
 +                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
 +            loc_pop(&loc);
          }
 -        loc_push_none(&loc);
 -        qemu_opts_loc_restore(pflash_drv->opts);
 -        if (pflash_blk[i]) {
 -            error_report("clashes with -machine");
 -            exit(1);
 -        }
 -        pflash_blk[i] = blk_by_legacy_dinfo(pflash_drv);
 -        qdev_prop_set_drive(DEVICE(pcms->flash[i]),
 -                            "drive", pflash_blk[i], &error_fatal);
 -        loc_pop(&loc);
 +        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
      }
      /* Reject gaps */
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+[Qemu-devel] [PULL 02/15] pflash_cfi01: New pflash_cfi01_legacy_drive()
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Markus Armbruster <armbru@redhat.com>
-Cc: qemu-stable@nongnu.org
+Factored out of pc_system_firmware_init() so the next commit can reuse
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+it in hw/arm/virt.c.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Markus Armbruster <armbru@redhat.com>
-Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
+Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190416091348.26075-3-armbru@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 30 ++++++++++++++----------------
+ include/hw/block/flash.h |  1 +
-file changed, 14 insertions(+), 16 deletions(-)
+ hw/block/pflash_cfi01.c  | 28 ++++++++++++++++++++++++++++
  hw/i386/pc_sysfw.c       | 16 ++--------------
 files changed, 31 insertions(+), 14 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/hw/block/flash.h
-+++ b/target/arm/translate-a64.c
++++ b/include/hw/block/flash.h
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+@@ -XXX,XX +XXX,XX @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
-     return v;
+                                    int be);
  BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl);
  MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
 +void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
  /* pflash_cfi02.c */
 diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/pflash_cfi01.c
 +++ b/hw/block/pflash_cfi01.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/timer.h"
  #include "qemu/bitops.h"
 +#include "qemu/error-report.h"
  #include "qemu/host-utils.h"
  #include "qemu/log.h"
 +#include "qemu/option.h"
  #include "hw/sysbus.h"
 +#include "sysemu/blockdev.h"
  #include "sysemu/sysemu.h"
  #include "trace.h"
@@ -XXX,XX +XXX,XX @@ MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
      return &fl->mem;
  }
-+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
++/*
 + * Handle -drive if=pflash for machines that use properties.
 + * If @dinfo is null, do nothing.
 + * Else if @fl's property "drive" is already set, fatal error.
 + * Else set it to the BlockBackend with @dinfo.
 + */
 +void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
 +{
-+    TCGv_i32 v = tcg_temp_new_i32();
++    Location loc;
 +
-+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
++    if (!dinfo) {
-+    return v;
++        return;
 +    }
 +
 +    loc_push_none(&loc);
 +    qemu_opts_loc_restore(dinfo->opts);
 +    if (fl->blk) {
 +        error_report("clashes with -machine");
 +        exit(1);
 +    }
 +    qdev_prop_set_drive(DEVICE(fl), "drive",
 +                        blk_by_legacy_dinfo(dinfo), &error_fatal);
 +    loc_pop(&loc);
 +}
 +
- /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
+ static void postload_update_cb(void *opaque, int running, RunState state)
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
-     TCGv_ptr fpst = NULL;
+     PFlashCFI01 *pfl = opaque;
--    TCGv_i32 tcg_op = tcg_temp_new_i32();
+diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
-+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
+index XXXXXXX..XXXXXXX 100644
-     TCGv_i32 tcg_res = tcg_temp_new_i32();
+--- a/hw/i386/pc_sysfw.c
++++ b/hw/i386/pc_sysfw.c
--    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
+@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
--
+ {
-     switch (opcode) {
+     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
-     case 0x0: /* FMOV */
+     int i;
-         tcg_gen_mov_i32(tcg_res, tcg_op);
+-    DriveInfo *pflash_drv;
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
+     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
-         tcg_temp_free_i64(tcg_op2);
+-    Location loc;
-         tcg_temp_free_i64(tcg_res);
-     } else {
+     if (!pcmc->pci_enabled) {
--        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
+         old_pc_system_rom_init(rom_memory, true);
--        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
-+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
-+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
+     /* Map legacy -drive if=pflash to machine properties */
-         TCGv_i64 tcg_res = tcg_temp_new_i64();
+     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
+-        pflash_drv = drive_get(IF_PFLASH, 0, i);
--        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
+-        if (pflash_drv) {
--        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
+-            loc_push_none(&loc);
--
+-            qemu_opts_loc_restore(pflash_drv->opts);
-         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
+-            if (pflash_cfi01_get_blk(pcms->flash[i])) {
-         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
+-                error_report("clashes with -machine");
+-                exit(1);
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
+-            }
+-            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
-     fpst = get_fpstatus_ptr(true);
+-                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
+-            loc_pop(&loc);
--    tcg_op1 = tcg_temp_new_i32();
+-        }
--    tcg_op2 = tcg_temp_new_i32();
++        pflash_cfi01_legacy_drive(pcms->flash[i],
-+    tcg_op1 = read_fp_hreg(s, rn);
++                                  drive_get(IF_PFLASH, 0, i));
-+    tcg_op2 = read_fp_hreg(s, rm);
+         pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
-     if (is_scalar) {
--        TCGv_i32 tcg_op = tcg_temp_new_i32();
-+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
-         TCGv_i32 tcg_res = tcg_temp_new_i32();
--        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
--
-         switch (fpop) {
-         case 0x1a: /* FCVTNS */
-         case 0x1b: /* FCVTMS */
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+[Qemu-devel] [PULL 03/15] hw/arm/virt: Support firmware configuration with -blockdev
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Markus Armbruster <armbru@redhat.com>
-These where missed out from the rest of the half-precision work.
+The ARM virt machines put firmware in flash memory.  To configure it,
+you use -drive if=pflash,unit=0,... and optionally -drive
-Cc: qemu-stable@nongnu.org
+if=pflash,unit=1,...
 Why two -drive?  This permits setting up one part of the flash memory
 read-only, and the other part read/write.  It also makes upgrading
 firmware on the host easier.  Below the hood, we get two separate
 flash devices, because we were too lazy to improve our flash device
 models to support sector protection.
 The problem at hand is to do the same with -blockdev somehow, as one
 more step towards deprecating -drive.
 We recently solved this problem for x86 PC machines, in commit
 ebc29e1beab.  See the commit message for design rationale.
 This commit solves it for ARM virt basically the same way: new machine
 properties pflash0, pflash1 forward to the onboard flash devices'
 properties.  Requires creating the onboard devices in the
 .instance_init() method virt_instance_init().  The existing code to
 pick up drives defined with -drive if=pflash is replaced by code to
 desugar into the machine properties.
 There are a few behavioral differences, though:
 * The flash devices are always present (x86: only present if
   configured)
 * Flash base addresses and sizes are fixed (x86: sizes depend on
   images, mapped back to back below a fixed address)
 * -bios configures contents of first pflash (x86: -bios configures ROM
    contents)
 * -bios is rejected when first pflash is also configured with -machine
    pflash0=... (x86: bios is silently ignored then)
 * -machine pflash1=... does not require -machine pflash0=... (x86: it
    does).
 The actual code is a bit simpler than for x86 mostly due to the first
 two differences.
 Before the patch, all the action is in create_flash(), called from the
 machine's .init() method machvirt_init():
     main()
         machine_run_board_init()
             machvirt_init()
                 create_flash()
                     create_one_flash() for flash[0]
                         create
                         configure
                             includes obeying -drive if=pflash,unit=0
                         realize
                         map
                         fall back to -bios
                     create_one_flash() for flash[1]
                         create
                         configure
                             includes obeying -drive if=pflash,unit=1
                         realize
                         map
                     update FDT
 To make the machine properties work, we need to move device creation
 to its .instance_init() method virt_instance_init().
 Another complication is machvirt_init()'s computation of
 @firmware_loaded: it predicts what create_flash() will do.  Instead of
 predicting what create_flash()'s replacement virt_firmware_init() will
 do, I decided to have virt_firmware_init() return what it did.
 Requires calling it a bit earlier.
 Resulting call tree:
     main()
         current_machine = object_new()
             ...
                 virt_instance_init()
                     virt_flash_create()
                         virt_flash_create1() for flash[0]
                             create
                             configure: set defaults
                             become child of machine [NEW]
                             add machine prop pflash0 as alias for drive [NEW]
                         virt_flash_create1() for flash[1]
                             create
                             configure: set defaults
                             become child of machine [NEW]
                             add machine prop pflash1 as alias for drive [NEW]
         for all machine props from the command line: machine_set_property()
             ...
                 property_set_alias() for machine props pflash0, pflash1
                     ...
                         set_drive() for cfi.pflash01 prop drive
                             this is how -machine pflash0=... etc set
         machine_run_board_init(current_machine);
             virt_firmware_init()
                 pflash_cfi01_legacy_drive()
                     legacy -drive if=pflash,unit=0 and =1 [NEW]
                 virt_flash_map()
                     virt_flash_map1() for flash[0]
                         configure: num-blocks
                         realize
                         map
                     virt_flash_map1() for flash[1]
                         configure: num-blocks
                         realize
                         map
                 fall back to -bios
             virt_flash_fdt()
                 update FDT
 You have László to thank for making me explain this in detail.
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Acked-by: Laszlo Ersek <lersek@redhat.com>
 Message-id: 20190416091348.26075-4-armbru@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
-[rth: Diagnose lack of FP16 before fp_access_check]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper-a64.h    |  2 +
+ include/hw/arm/virt.h |   2 +
- target/arm/helper-a64.c    | 10 +++++
+ hw/arm/virt.c         | 202 +++++++++++++++++++++++++++---------------
- target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
+files changed, 132 insertions(+), 72 deletions(-)
-files changed, 83 insertions(+), 17 deletions(-)
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.h
+--- a/include/hw/arm/virt.h
-+++ b/target/arm/helper-a64.h
++++ b/include/hw/arm/virt.h
 @@ -XXX,XX +XXX,XX @@
- DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ #include "qemu/notify.h"
- DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ #include "hw/boards.h"
- DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+ #include "hw/arm/arm.h"
-+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
++#include "hw/block/flash.h"
-+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
+ #include "sysemu/kvm.h"
- DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+ #include "hw/intc/arm_gicv3_common.h"
- DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
- DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
+@@ -XXX,XX +XXX,XX @@ typedef struct {
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+     Notifier machine_done;
      DeviceState *platform_bus_dev;
      FWCfgState *fw_cfg;
 +    PFlashCFI01 *flash[2];
      bool secure;
      bool highmem;
      bool highmem_ecam;
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.c
+--- a/hw/arm/virt.c
-+++ b/target/arm/helper-a64.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
+@@ -XXX,XX +XXX,XX @@
-     return flags;
- }
+ #include "qemu/osdep.h"
+ #include "qemu/units.h"
-+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
++#include "qemu/option.h"
-+{
+ #include "qapi/error.h"
-+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+ #include "hw/sysbus.h"
-+}
+ #include "hw/arm/arm.h"
-+
+@@ -XXX,XX +XXX,XX @@ static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
 +uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
 +{
 +    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
      return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
      }
  }
--static void handle_fp_compare(DisasContext *s, bool is_double,
+-static void create_one_flash(const char *name, hwaddr flashbase,
-+static void handle_fp_compare(DisasContext *s, int size,
+-                             hwaddr flashsize, const char *file,
-                               unsigned int rn, unsigned int rm,
+-                             MemoryRegion *sysmem)
-                               bool cmp_with_zero, bool signal_all_nans)
++#define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
 +
 +static PFlashCFI01 *virt_flash_create1(VirtMachineState *vms,
 +                                        const char *name,
 +                                        const char *alias_prop_name)
  {
-     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    /* Create and map a single flash device. We use the same
--    TCGv_ptr fpst = get_fpstatus_ptr(false);
+-     * parameters as the flash devices on the Versatile Express board.
-+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
++    /*
++     * Create a single flash device.  We use the same parameters as
--    if (is_double) {
++     * the flash devices on the Versatile Express board.
-+    if (size == MO_64) {
+      */
-         TCGv_i64 tcg_vn, tcg_vm;
+-    DriveInfo *dinfo = drive_get_next(IF_PFLASH);
+     DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
-         tcg_vn = read_fp_dreg(s, rn);
+-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
+-    const uint64_t sectorlength = 256 * 1024;
-         tcg_temp_free_i64(tcg_vn);
-         tcg_temp_free_i64(tcg_vm);
+-    if (dinfo) {
 -        qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
 -                            &error_abort);
 -    }
 -
 -    qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength);
 -    qdev_prop_set_uint64(dev, "sector-length", sectorlength);
 +    qdev_prop_set_uint64(dev, "sector-length", VIRT_FLASH_SECTOR_SIZE);
      qdev_prop_set_uint8(dev, "width", 4);
      qdev_prop_set_uint8(dev, "device-width", 2);
      qdev_prop_set_bit(dev, "big-endian", false);
@@ -XXX,XX +XXX,XX @@ static void create_one_flash(const char *name, hwaddr flashbase,
      qdev_prop_set_uint16(dev, "id2", 0x00);
      qdev_prop_set_uint16(dev, "id3", 0x00);
      qdev_prop_set_string(dev, "name", name);
 -    qdev_init_nofail(dev);
 -
 -    memory_region_add_subregion(sysmem, flashbase,
 -                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
 -
 -    if (file) {
 -        char *fn;
 -        int image_size;
 -
 -        if (drive_get(IF_PFLASH, 0, 0)) {
 -            error_report("The contents of the first flash device may be "
 -                         "specified with -bios or with -drive if=pflash... "
 -                         "but you cannot use both options at once");
 -            exit(1);
 -        }
 -        fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, file);
 -        if (!fn) {
 -            error_report("Could not find ROM image '%s'", file);
 -            exit(1);
 -        }
 -        image_size = load_image_mr(fn, sysbus_mmio_get_region(sbd, 0));
 -        g_free(fn);
 -        if (image_size < 0) {
 -            error_report("Could not load ROM image '%s'", file);
 -            exit(1);
 -        }
 -    }
 +    object_property_add_child(OBJECT(vms), name, OBJECT(dev),
 +                              &error_abort);
 +    object_property_add_alias(OBJECT(vms), alias_prop_name,
 +                              OBJECT(dev), "drive", &error_abort);
 +    return PFLASH_CFI01(dev);
  }
 -static void create_flash(const VirtMachineState *vms,
 -                         MemoryRegion *sysmem,
 -                         MemoryRegion *secure_sysmem)
 +static void virt_flash_create(VirtMachineState *vms)
  {
 -    /* Create two flash devices to fill the VIRT_FLASH space in the memmap.
 -     * Any file passed via -bios goes in the first of these.
 +    vms->flash[0] = virt_flash_create1(vms, "virt.flash0", "pflash0");
 +    vms->flash[1] = virt_flash_create1(vms, "virt.flash1", "pflash1");
 +}
 +
 +static void virt_flash_map1(PFlashCFI01 *flash,
 +                            hwaddr base, hwaddr size,
 +                            MemoryRegion *sysmem)
 +{
 +    DeviceState *dev = DEVICE(flash);
 +
 +    assert(size % VIRT_FLASH_SECTOR_SIZE == 0);
 +    assert(size / VIRT_FLASH_SECTOR_SIZE <= UINT32_MAX);
 +    qdev_prop_set_uint32(dev, "num-blocks", size / VIRT_FLASH_SECTOR_SIZE);
 +    qdev_init_nofail(dev);
 +
 +    memory_region_add_subregion(sysmem, base,
 +                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
 +                                                       0));
 +}
 +
 +static void virt_flash_map(VirtMachineState *vms,
 +                           MemoryRegion *sysmem,
 +                           MemoryRegion *secure_sysmem)
 +{
 +    /*
 +     * Map two flash devices to fill the VIRT_FLASH space in the memmap.
       * sysmem is the system memory space. secure_sysmem is the secure view
       * of the system, and the first flash device should be made visible only
       * there. The second flash device is visible to both secure and nonsecure.
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
       */
      hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
      hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
 -    char *nodename;
 -    create_one_flash("virt.flash0", flashbase, flashsize,
 -                     bios_name, secure_sysmem);
 -    create_one_flash("virt.flash1", flashbase + flashsize, flashsize,
 -                     NULL, sysmem);
 +    virt_flash_map1(vms->flash[0], flashbase, flashsize,
 +                    secure_sysmem);
 +    virt_flash_map1(vms->flash[1], flashbase + flashsize, flashsize,
 +                    sysmem);
 +}
 +
 +static void virt_flash_fdt(VirtMachineState *vms,
 +                           MemoryRegion *sysmem,
 +                           MemoryRegion *secure_sysmem)
 +{
 +    hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
 +    hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
 +    char *nodename;
      if (sysmem == secure_sysmem) {
          /* Report both flash devices as a single node in the DT */
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
          qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
          g_free(nodename);
      } else {
--        TCGv_i32 tcg_vn, tcg_vm;
+-        /* Report the devices as separate nodes so we can mark one as
-+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
++        /*
-+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
++         * Report the devices as separate nodes so we can mark one as
+          * only visible to the secure world.
--        tcg_vn = read_fp_sreg(s, rn);
+          */
-+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
+         nodename = g_strdup_printf("/secflash@%" PRIx64, flashbase);
-         if (cmp_with_zero) {
+@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
+ }
- static void disas_fp_compare(DisasContext *s, uint32_t insn)
 +static bool virt_firmware_init(VirtMachineState *vms,
 +                               MemoryRegion *sysmem,
 +                               MemoryRegion *secure_sysmem)
 +{
 +    int i;
 +    BlockBackend *pflash_blk0;
 +
 +    /* Map legacy -drive if=pflash to machine properties */
 +    for (i = 0; i < ARRAY_SIZE(vms->flash); i++) {
 +        pflash_cfi01_legacy_drive(vms->flash[i],
 +                                  drive_get(IF_PFLASH, 0, i));
 +    }
 +
 +    virt_flash_map(vms, sysmem, secure_sysmem);
 +
 +    pflash_blk0 = pflash_cfi01_get_blk(vms->flash[0]);
 +
 +    if (bios_name) {
 +        char *fname;
 +        MemoryRegion *mr;
 +        int image_size;
 +
 +        if (pflash_blk0) {
 +            error_report("The contents of the first flash device may be "
 +                         "specified with -bios or with -drive if=pflash... "
 +                         "but you cannot use both options at once");
 +            exit(1);
 +        }
 +
 +        /* Fall back to -bios */
 +
 +        fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
 +        if (!fname) {
 +            error_report("Could not find ROM image '%s'", bios_name);
 +            exit(1);
 +        }
 +        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(vms->flash[0]), 0);
 +        image_size = load_image_mr(fname, mr);
 +        g_free(fname);
 +        if (image_size < 0) {
 +            error_report("Could not load ROM image '%s'", bios_name);
 +            exit(1);
 +        }
 +    }
 +
 +    return pflash_blk0 || bios_name;
 +}
 +
  static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
  {
-     unsigned int mos, type, rm, op, rn, opc, op2r;
+     hwaddr base = vms->memmap[VIRT_FW_CFG].base;
-+    int size;
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+     MemoryRegion *secure_sysmem = NULL;
-     mos = extract32(insn, 29, 3);
+     int n, virt_max_cpus;
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+     MemoryRegion *ram = g_new(MemoryRegion, 1);
-+    type = extract32(insn, 22, 2);
+-    bool firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0);
-     rm = extract32(insn, 16, 5);
++    bool firmware_loaded;
-     op = extract32(insn, 14, 2);
+     bool aarch64 = true;
-     rn = extract32(insn, 5, 5);
-     opc = extract32(insn, 3, 2);
+     /*
-     op2r = extract32(insn, 0, 3);
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+         exit(1);
--    if (mos || op || op2r || type > 1) {
+     }
-+    if (mos || op || op2r) {
-+        unallocated_encoding(s);
++    if (vms->secure) {
-+        return;
++        if (kvm_enabled()) {
 +            error_report("mach-virt: KVM does not support Security extensions");
 +            exit(1);
 +        }
 +
 +        /*
 +         * The Secure view of the world is the same as the NonSecure,
 +         * but with a few extra devices. Create it as a container region
 +         * containing the system memory at low priority; any secure-only
 +         * devices go in at higher priority and take precedence.
 +         */
 +        secure_sysmem = g_new(MemoryRegion, 1);
 +        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
 +                           UINT64_MAX);
 +        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
 +    }
 +
-+    switch (type) {
++    firmware_loaded = virt_firmware_init(vms, sysmem,
-+    case 0:
++                                         secure_sysmem ?: sysmem);
-+        size = MO_32;
++
-+        break;
+     /* If we have an EL3 boot ROM then the assumption is that it will
-+    case 1:
+      * implement PSCI itself, so disable QEMU's internal implementation
-+        size = MO_64;
+      * so it doesn't get in the way. Instead of starting secondary
-+        break;
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-+    case 3:
+         exit(1);
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
-         return;
+-    if (vms->secure) {
 -        if (kvm_enabled()) {
 -            error_report("mach-virt: KVM does not support Security extensions");
 -            exit(1);
 -        }
 -
 -        /* The Secure view of the world is the same as the NonSecure,
 -         * but with a few extra devices. Create it as a container region
 -         * containing the system memory at low priority; any secure-only
 -         * devices go in at higher priority and take precedence.
 -         */
 -        secure_sysmem = g_new(MemoryRegion, 1);
 -        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
 -                           UINT64_MAX);
 -        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
 -    }
 -
      create_fdt(vms);
      possible_cpus = mc->possible_cpu_arch_ids(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                      &machine->device_memory->mr);
      }
--    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+-    create_flash(vms, sysmem, secure_sysmem ? secure_sysmem : sysmem);
-+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
++    virt_flash_fdt(vms, sysmem, secure_sysmem);
      create_gic(vms, pic);
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                      NULL);
      vms->irqmap = a15irqmap;
 +
 +    virt_flash_create(vms);
  }
- /* Floating point conditional compare
+ static const TypeInfo virt_machine_info = {
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
+[Qemu-devel] [PULL 04/15] hw/arm/raspi: Diagnose requests for too much RAM
-From: Alex Bennée <alex.bennee@linaro.org>
+The Raspberry Pi boards have a physical memory map which does
 not allow for more than 1GB of RAM. Currently if the user tries
 to ask for more then we fail in a confusing way:
-These were missed out from the rest of the half-precision work.
+$ qemu-system-aarch64 --machine raspi3 -m 8G
 Unexpected error in visit_type_uintN() at qapi/qapi-visit-core.c:164:
 qemu-system-aarch64: Parameter 'vcram-base' expects uint32_t
 Aborted (core dumped)
-Cc: qemu-stable@nongnu.org
+Catch this earlier and diagnose it with a more friendly message:
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+$ qemu-system-aarch64 --machine raspi3 -m 8G
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+qemu-system-aarch64: Requested ram size is too large for this machine: maximum is 1GB
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Fixes: https://bugs.launchpad.net/qemu/+bug/1794187
 Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
 [rth: Fix erroneous check vs type]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
 ---
- target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
+ hw/arm/raspi.c | 7 +++++++
-file changed, 25 insertions(+), 6 deletions(-)
+file changed, 7 insertions(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/arm/raspi.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@
-     unsigned int mos, type, rm, cond, rn, rd;
+  */
-     TCGv_i64 t_true, t_false, t_zero;
-     DisasCompare64 c;
+ #include "qemu/osdep.h"
-+    TCGMemOp sz;
++#include "qemu/units.h"
+ #include "qapi/error.h"
-     mos = extract32(insn, 29, 3);
+ #include "qemu-common.h"
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+ #include "cpu.h"
-+    type = extract32(insn, 22, 2);
+@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
-     rm = extract32(insn, 16, 5);
+     BusState *bus;
-     cond = extract32(insn, 12, 4);
+     DeviceState *carddev;
-     rn = extract32(insn, 5, 5);
-     rd = extract32(insn, 0, 5);
++    if (machine->ram_size > 1 * GiB) {
++        error_report("Requested ram size is too large for this machine: "
--    if (mos || type > 1) {
++                     "maximum is 1GB");
-+    if (mos) {
++        exit(1);
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    switch (type) {
+     object_initialize(&s->soc, sizeof(s->soc),
-+    case 0:
+                       version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
-+        sz = MO_32;
+     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
          return;
      }
 -    /* Zero extend sreg inputs to 64 bits now.  */
 +    /* Zero extend sreg & hreg inputs to 64 bits now.  */
      t_true = tcg_temp_new_i64();
      t_false = tcg_temp_new_i64();
 -    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
 -    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
 +    read_vec_element(s, t_true, rn, 0, sz);
 +    read_vec_element(s, t_false, rm, 0, sz);
      a64_test_cc(&c, cond);
      t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+[Qemu-devel] [PULL 05/15] arm: Allow system registers for KVM guests to be changed by QEMU code
-From: Richard Henderson <richard.henderson@linaro.org>
+At the moment the Arm implementations of kvm_arch_{get,put}_registers()
+don't support having QEMU change the values of system registers
-Cc: qemu-stable@nongnu.org
+(aka coprocessor registers for AArch32). This is because although
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+kvm_arch_get_registers() calls write_list_to_cpustate() to
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+update the CPU state struct fields (so QEMU code can read the
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+values in the usual way), kvm_arch_put_registers() does not
-Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
+call write_cpustate_to_list(), meaning that any changes to
 the CPU state struct fields will not be passed back to KVM.
 The rationale for this design is documented in a comment in the
 AArch32 kvm_arch_put_registers() -- writing the values in the
 cpregs list into the CPU state struct is "lossy" because the
 write of a register might not succeed, and so if we blindly
 copy the CPU state values back again we will incorrectly
 change register values for the guest. The assumption was that
 no QEMU code would need to write to the registers.
 However, when we implemented debug support for KVM guests, we
 broke that assumption: the code to handle "set the guest up
 to take a breakpoint exception" does so by updating various
 guest registers including ESR_EL1.
 Support this by making kvm_arch_put_registers() synchronize
 CPU state back into the list. We sync only those registers
 where the initial write succeeds, which should be sufficient.
 This commit is the same as commit 823e1b3818f9b10b824ddc which we
 had to revert in commit 942f99c825fc94c8b1a4, except that the bug
 which was preventing EDK2 guest firmware running has been fixed:
 kvm_arm_reset_vcpu() now calls write_list_to_cpustate().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Eric Auger <eric.auger@redhat.com>
 ---
- target/arm/helper.h        |  6 +++
+ target/arm/cpu.h     |  9 ++++++++-
- target/arm/helper.c        | 38 ++++++++++++++-
+ target/arm/helper.c  | 27 +++++++++++++++++++++++++--
- target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
+ target/arm/kvm.c     |  8 ++++++++
-files changed, 122 insertions(+), 18 deletions(-)
+ target/arm/kvm32.c   | 20 ++------------------
+ target/arm/kvm64.c   |  2 ++
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+ target/arm/machine.c |  2 +-
-index XXXXXXX..XXXXXXX 100644
+files changed, 46 insertions(+), 22 deletions(-)
---- a/target/arm/helper.h
-+++ b/target/arm/helper.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+index XXXXXXX..XXXXXXX 100644
- DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+--- a/target/arm/cpu.h
- DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
++++ b/target/arm/cpu.h
- DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
-+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+ /**
-+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+  * write_cpustate_to_list:
-+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+  * @cpu: ARMCPU
-+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
++ * @kvm_sync: true if this is for syncing back to KVM
- DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
+  *
- DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
+  * For each register listed in the ARMCPU cpreg_indexes list, write
- DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
+  * its value from the ARMCPUState structure into the cpreg_values list.
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
+  * This is used to copy info from TCG's working data structures into
- DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
+  * KVM or for outbound migration.
- DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
+  *
- DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
++ * @kvm_sync is true if we are doing this in order to sync the
-+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
++ * register state back to KVM. In this case we will only update
-+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
++ * values in the list if the previous list->cpustate sync actually
++ * successfully wrote the CPU state. Otherwise we will keep the value
- DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
++ * that is in the list.
- DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
++ *
   * Returns: true if all register values were read correctly,
   * false if some register was unknown or could not be read.
   * Note that we do not stop early on failure -- we will attempt
   * reading all registers in the list.
   */
 -bool write_cpustate_to_list(ARMCPU *cpu);
 +bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  #define ARM_CPUID_TI915T      0x54029152
  #define ARM_CPUID_TI925T      0x54029252
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
+@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
- #undef VFP_CONV_FIX_A64
+     return true;
  /* Conversion to/from f16 can overflow to infinity before/after scaling.
 - * Therefore we convert to f64 (which does not round), scale,
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
-+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+-bool write_cpustate_to_list(ARMCPU *cpu)
-+{
++bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
-     if (unlikely(float16_is_any_nan(f))) {
+     /* Write the coprocessor state from cpu->env to the (index,value) list. */
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
+     int i;
-     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
+@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
      for (i = 0; i < cpu->cpreg_array_len; i++) {
          uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
          const ARMCPRegInfo *ri;
 +        uint64_t newval;
          ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
          if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
          if (ri->type & ARM_CP_NO_RAW) {
              continue;
          }
 -        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
 +
 +        newval = read_raw_cp_reg(&cpu->env, ri);
 +        if (kvm_sync) {
 +            /*
 +             * Only sync if the previous list->cpustate sync succeeded.
 +             * Rather than tracking the success/failure state for every
 +             * item in the list, we just recheck "does the raw write we must
 +             * have made in write_list_to_cpustate() read back OK" here.
 +             */
 +            uint64_t oldval = cpu->cpreg_values[i];
 +
 +            if (oldval == newval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, oldval);
 +            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
 +                continue;
 +            }
 +
 +            write_raw_cp_reg(&cpu->env, ri, newval);
 +        }
 +        cpu->cpreg_values[i] = newval;
      }
      return ok;
  }
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
-+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/target/arm/kvm.c
-+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
++++ b/target/arm/kvm.c
-+}
+@@ -XXX,XX +XXX,XX @@ void kvm_arm_reset_vcpu(ARMCPU *cpu)
-+
+         fprintf(stderr, "write_kvmstate_to_list failed\n");
-+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+         abort();
-+{
+     }
-+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
++    /*
-+}
++     * Sync the reset values also into the CPUState. This is necessary
-+
++     * because the next thing we do will be a kvm_arch_put_registers()
-+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
++     * which will update the list values from the CPUState before copying
-+{
++     * the list values back to KVM. It's OK to ignore failure returns here
-+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
++     * for the same reason we do so in kvm_arch_get_registers().
-+}
++     */
-+
++    write_list_to_cpustate(cpu);
-+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+ }
-+{
-+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+ /*
-+}
+diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-+
+index XXXXXXX..XXXXXXX 100644
- /* Set the current fp rounding mode and return the old one.
+--- a/target/arm/kvm32.c
-  * The argument is a softfloat float_round_ value.
++++ b/target/arm/kvm32.c
-  */
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+         return ret;
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
+-    /* Note that we do not call write_cpustate_to_list()
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+-     * here, so we are only writing the tuple list back to
-                            bool itof, int rmode, int scale, int sf, int type)
+-     * KVM. This is safe because nothing can change the
- {
+-     * CPUARMState cp15 fields (in particular gdb accesses cannot)
-     bool is_signed = !(opcode & 1);
+-     * and so there are no changes to sync. In fact syncing would
--    bool is_double = type;
+-     * be wrong at this point: for a constant register where TCG and
-     TCGv_ptr tcg_fpstatus;
+-     * KVM disagree about its value, the preceding write_list_to_cpustate()
--    TCGv_i32 tcg_shift;
+-     * would not have had any effect on the CPUARMState value (since the
-+    TCGv_i32 tcg_shift, tcg_single;
+-     * register is read-only), and a write_cpustate_to_list() here would
-+    TCGv_i64 tcg_double;
+-     * then try to write the TCG value back into KVM -- this would either
+-     * fail or incorrectly change the value the guest sees.
--    tcg_fpstatus = get_fpstatus_ptr(false);
+-     *
-+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
+-     * If we ever want to allow the user to modify cp15 registers via
+-     * the gdb stub, we would need to be more clever here (for instance
-     tcg_shift = tcg_const_i32(64 - scale);
+-     * tracking the set of registers kvm_arch_get_registers() successfully
+-     * managed to update the CPUARMState with, and only allowing those
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+-     * to be written back up into the kernel).
-             tcg_int = tcg_extend;
+-     */
-         }
++    write_cpustate_to_list(cpu, true);
++
--        if (is_double) {
+     if (!write_list_to_kvmstate(cpu, level)) {
--            TCGv_i64 tcg_double = tcg_temp_new_i64();
+         return EINVAL;
-+        switch (type) {
+     }
-+        case 1: /* float64 */
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-+            tcg_double = tcg_temp_new_i64();
+index XXXXXXX..XXXXXXX 100644
-             if (is_signed) {
+--- a/target/arm/kvm64.c
-                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
++++ b/target/arm/kvm64.c
-                                      tcg_shift, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+         return ret;
-             }
+     }
-             write_fp_dreg(s, rd, tcg_double);
-             tcg_temp_free_i64(tcg_double);
++    write_cpustate_to_list(cpu, true);
--        } else {
++
--            TCGv_i32 tcg_single = tcg_temp_new_i32();
+     if (!write_list_to_kvmstate(cpu, level)) {
-+            break;
+         return EINVAL;
-+
+     }
-+        case 0: /* float32 */
+diff --git a/target/arm/machine.c b/target/arm/machine.c
-+            tcg_single = tcg_temp_new_i32();
+index XXXXXXX..XXXXXXX 100644
-             if (is_signed) {
+--- a/target/arm/machine.c
-                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
++++ b/target/arm/machine.c
-                                      tcg_shift, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+             abort();
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
-         TCGv_i64 tcg_int = cpu_reg(s, rd);
+-        if (!write_cpustate_to_list(cpu)) {
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
++        if (!write_cpustate_to_list(cpu, false)) {
+             /* This should never fail. */
-         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
+             abort();
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+[Qemu-devel] [PULL 06/15] arm: aspeed: Set SDRAM size
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Joel Stanley <joel@jms.id.au>
-Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+We currently use Qemu's default of 128MB. As we know how much ram each
 machine ships with, make it easier on users by setting a default.
-  The block length is predefined to 512 bits
+It can still be overridden with -m on the command line.
-and "4.10.2 SD Status":
+Signed-off-by: Joel Stanley <joel@jms.id.au>
+Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
-  The SD Status contains status bits that are related to the SD Memory Card
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-  proprietary features and may be used for future application-specific usage.
+Message-id: 20190503022958.1394-1-joel@jms.id.au
-  The size of the SD Status is one data block of 512 bit. The content of this
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 2 +-
+ include/hw/arm/aspeed.h | 1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/arm/aspeed.c         | 8 ++++++++
 files changed, 9 insertions(+)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/include/hw/arm/aspeed.h
-+++ b/hw/sd/sd.c
++++ b/include/hw/arm/aspeed.h
-@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
-         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+     const char *spi_model;
-     }
+     uint32_t num_cs;
-     memset(&sd->data[17], 0, 47);
+     void (*i2c_init)(AspeedBoardState *bmc);
--    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
++    uint32_t ram;
-+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
+ } AspeedBoardConfig;
  #define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/block-backend.h"
  #include "hw/loader.h"
  #include "qemu/error-report.h"
 +#include "qemu/units.h"
  static struct arm_boot_info aspeed_board_binfo = {
      .board_id = -1, /* device-tree-only board */
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->no_parallel = 1;
 +    if (board->ram) {
 +        mc->default_ram_size = board->ram;
 +    }
      amc->board = board;
  }
- static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
+@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .spi_model = "mx25l25635e",
          .num_cs    = 1,
          .i2c_init  = palmetto_bmc_i2c_init,
 +        .ram       = 256 * MiB,
      }, {
          .name      = MACHINE_TYPE_NAME("ast2500-evb"),
          .desc      = "Aspeed AST2500 EVB (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .spi_model = "mx25l25635e",
          .num_cs    = 1,
          .i2c_init  = ast2500_evb_i2c_init,
 +        .ram       = 512 * MiB,
      }, {
          .name      = MACHINE_TYPE_NAME("romulus-bmc"),
          .desc      = "OpenPOWER Romulus BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .spi_model = "mx66l1g45g",
          .num_cs    = 2,
          .i2c_init  = romulus_bmc_i2c_init,
 +        .ram       = 512 * MiB,
      }, {
          .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
          .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
          .spi_model = "mx66l1g45g",
          .num_cs    = 2,
          .i2c_init  = witherspoon_bmc_i2c_init,
 +        .ram       = 512 * MiB,
      },
  };
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+[Qemu-devel] [PULL 07/15] QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Cao Jiaxi <driver1998@foxmail.com>
-All the hard work is already done by vfp_expand_imm, we just need to
+gcc_struct is for x86 only, and it generates an warning on ARM64 Clang/MinGW targets.
 make sure we pick up the correct size.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190503003618.10089-1-driver1998@foxmail.com
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+[PMM: dropped the slirp change as slirp is now a submodule]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 20 +++++++++++++++++---
+ contrib/libvhost-user/libvhost-user.h | 2 +-
-file changed, 17 insertions(+), 3 deletions(-)
+ include/qemu/compiler.h               | 2 +-
  scripts/cocci-macro-file.h            | 7 ++++++-
 files changed, 8 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/contrib/libvhost-user/libvhost-user.h
-+++ b/target/arm/translate-a64.c
++++ b/contrib/libvhost-user/libvhost-user.h
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ typedef struct VhostUserInflight {
- {
+     uint16_t queue_size;
-     int rd = extract32(insn, 0, 5);
+ } VhostUserInflight;
-     int imm8 = extract32(insn, 13, 8);
--    int is_double = extract32(insn, 22, 2);
+-#if defined(_WIN32)
-+    int type = extract32(insn, 22, 2);
++#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
-     uint64_t imm;
+ # define VU_PACKED __attribute__((gcc_struct, packed))
-     TCGv_i64 tcg_res;
+ #else
-+    TCGMemOp sz;
+ # define VU_PACKED __attribute__((packed))
+diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
--    if (is_double > 1) {
+index XXXXXXX..XXXXXXX 100644
-+    switch (type) {
+--- a/include/qemu/compiler.h
-+    case 0:
++++ b/include/qemu/compiler.h
-+        sz = MO_32;
+@@ -XXX,XX +XXX,XX @@
-+        break;
-+    case 1:
+ #define QEMU_SENTINEL __attribute__((sentinel))
-+        sz = MO_64;
-+        break;
+-#if defined(_WIN32)
-+    case 3:
++#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
-+        sz = MO_16;
+ # define QEMU_PACKED __attribute__((gcc_struct, packed))
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+ #else
-+            break;
+ # define QEMU_PACKED __attribute__((packed))
-+        }
+diff --git a/scripts/cocci-macro-file.h b/scripts/cocci-macro-file.h
-+        /* fallthru */
+index XXXXXXX..XXXXXXX 100644
-+    default:
+--- a/scripts/cocci-macro-file.h
-         unallocated_encoding(s);
++++ b/scripts/cocci-macro-file.h
-         return;
+@@ -XXX,XX +XXX,XX @@
-     }
+ #define QEMU_NORETURN __attribute__ ((__noreturn__))
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+ #define QEMU_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
-         return;
+ #define QEMU_SENTINEL __attribute__((sentinel))
-     }
+-#define QEMU_PACKED __attribute__((gcc_struct, packed))
++
--    imm = vfp_expand_imm(MO_32 + is_double, imm8);
++#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
-+    imm = vfp_expand_imm(sz, imm8);
++# define QEMU_PACKED __attribute__((gcc_struct, packed))
++#else
-     tcg_res = tcg_const_i64(imm);
++# define QEMU_PACKED __attribute__((packed))
-     write_fp_dreg(s, rd, tcg_res);
++#endif
  #define cat(x,y) x ## y
  #define cat2(x,y) cat(x,y)
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+[Qemu-devel] [PULL 08/15] qga: Fix mingw compilation warnings on enum conversion
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Cao Jiaxi <driver1998@foxmail.com>
-No sense in emitting code after the exception.
+The win2qemu[] is supposed to be the conversion table to convert between
 STORAGE_BUS_TYPE in Windows SDK and GuestDiskBusType in qga.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+But it was incorrectly written that it forces to set a GuestDiskBusType
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+value to STORAGE_BUS_TYPE, which generates an enum conversion warning in clang.
-Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Suggested-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20190503003650.10137-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ qga/commands-win32.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/qga/commands-win32.c b/qga/commands-win32.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/qga/commands-win32.c
-+++ b/target/arm/translate-a64.c
++++ b/qga/commands-win32.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ void qmp_guest_file_flush(int64_t handle, Error **errp)
-         default:
-             /* all other sf/type/rmode combinations are invalid */
+ #ifdef CONFIG_QGA_NTDDSCSI
-             unallocated_encoding(s);
--            break;
+-static STORAGE_BUS_TYPE win2qemu[] = {
-+            return;
++static GuestDiskBusType win2qemu[] = {
-         }
+     [BusTypeUnknown] = GUEST_DISK_BUS_TYPE_UNKNOWN,
+     [BusTypeScsi] = GUEST_DISK_BUS_TYPE_SCSI,
-         if (!fp_access_check(s)) {
+     [BusTypeAtapi] = GUEST_DISK_BUS_TYPE_IDE,
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+[Qemu-devel] [PULL 09/15] util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Cao Jiaxi <driver1998@foxmail.com>
-Reported by Coverity (CID1390635). We ensure this for uint_to_float
+Windows ARM64 uses LLP64 model, which breaks current assumptions.
 later on so we might as well mirror that.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20190503003707.10185-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- fpu/softfloat.c | 2 +-
+ util/cacheinfo.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/util/cacheinfo.c b/util/cacheinfo.c
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/util/cacheinfo.c
-+++ b/fpu/softfloat.c
++++ b/util/cacheinfo.c
-@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
+ static void arch_cache_info(int *isize, int *dsize)
  static FloatParts int_to_float(int64_t a, float_status *status)
  {
--    FloatParts r;
+     if (*isize == 0 || *dsize == 0) {
-+    FloatParts r = {};
+-        unsigned long ctr;
-     if (a == 0) {
++        uint64_t ctr;
-         r.cls = float_class_zero;
-         r.sign = false;
+         /* The real cache geometry is in CCSIDR_EL1/CLIDR_EL1/CSSELR_EL1,
             but (at least under Linux) these are marked protected by the
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+[Qemu-devel] [PULL 10/15] osdep: Fix mingw compilation regarding stdio formats
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Cao Jiaxi <driver1998@foxmail.com>
-Cc: qemu-stable@nongnu.org
+I encountered the following compilation error on mingw:
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+/mnt/d/qemu/include/qemu/osdep.h:97:9: error: '__USE_MINGW_ANSI_STDIO' macro redefined [-Werror,-Wmacro-redefined]
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+ #define __USE_MINGW_ANSI_STDIO 1
-Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
+        ^
 /mnt/d/llvm-mingw/aarch64-w64-mingw32/include/_mingw.h:433:9: note: previous definition is here
  #define __USE_MINGW_ANSI_STDIO 0      /* was not defined so it should be 0 */
 It turns out that __USE_MINGW_ANSI_STDIO must be set before any
 system headers are included, not just before stdio.h.
 Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Message-id: 20190503003719.10233-1-driver1998@foxmail.com
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 17 +++++++++++++++--
+ include/qemu/osdep.h | 10 +++++-----
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/qemu/osdep.h
-+++ b/target/arm/translate-a64.c
++++ b/include/qemu/osdep.h
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
-     bool sf = extract32(insn, 31, 1);
+ #endif
-     bool itof;
+ #endif
--    if (sbit || (type > 1)
++/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
--        || (!sf && scale < 32)) {
++#ifdef __MINGW32__
-+    if (sbit || (!sf && scale < 32)) {
++#define __USE_MINGW_ANSI_STDIO 1
-+        unallocated_encoding(s);
++#endif
 +        return;
 +    }
 +
-+    switch (type) {
+ #include <stdarg.h>
-+    case 0: /* float32 */
+ #include <stddef.h>
-+    case 1: /* float64 */
+ #include <stdbool.h>
-+        break;
+ #include <stdint.h>
-+    case 3: /* float16 */
+ #include <sys/types.h>
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+ #include <stdlib.h>
-+            break;
+-
-+        }
+-/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
-+        /* fallthru */
+-#ifdef __MINGW32__
-+    default:
+-#define __USE_MINGW_ANSI_STDIO 1
-         unallocated_encoding(s);
+-#endif
-         return;
+ #include <stdio.h>
-     }
  #include <string.h>
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+[Qemu-devel] [PULL 11/15] hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
-From: Richard Henderson <richard.henderson@linaro.org>
+Rule R_CQRV says that if two pending interrupts have the same
 group priority then ties are broken by looking at the subpriority.
 We had a comment describing this but had forgotten to actually
 implement the subpriority comparison. Correct the omission.
-Adding the fp16 moves to/from general registers.
+(The further tie break rules of "lowest exception number" and
 "secure before non-secure" are handled implicitly by the order
 in which we iterate through the exceptions in the loops.)
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190430131439.25251-2-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 21 +++++++++++++++++++++
+ hw/intc/armv7m_nvic.c | 9 +++++++--
-file changed, 21 insertions(+)
+file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/intc/armv7m_nvic.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+     int active_prio = NVIC_NOEXC_PRIO;
-             clear_vec_high(s, true, rd);
+     int pend_irq = 0;
-             break;
+     bool pending_is_s_banked = false;
-+        case 3:
++    int pend_subprio = 0;
-+            /* 16 bit */
-+            tmp = tcg_temp_new_i64();
+     /* R_CQRV: precedence is by:
-+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+      *  - lowest group priority; if both the same then
-+            write_fp_dreg(s, rd, tmp);
+@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-+            tcg_temp_free_i64(tmp);
+     for (i = 1; i < s->num_irq; i++) {
-+            break;
+         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
-+        default:
+             VecInfo *vec;
-+            g_assert_not_reached();
+-            int prio;
-         }
++            int prio, subprio;
-     } else {
+             bool targets_secure;
-         TCGv_i64 tcg_rd = cpu_reg(s, rd);
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+             if (bank == M_REG_S) {
-             /* 64 bits from top half */
+@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
-             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
+             }
-             break;
-+        case 3:
+             prio = exc_group_prio(s, vec->prio, targets_secure);
-+            /* 16 bit */
+-            if (vec->enabled && vec->pending && prio < pend_prio) {
-+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
++            subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
-+            break;
++            if (vec->enabled && vec->pending &&
-+        default:
++                ((prio < pend_prio) ||
-+            g_assert_not_reached();
++                 (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
-         }
+                 pend_prio = prio;
-     }
++                pend_subprio = subprio;
- }
+                 pend_irq = i;
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+                 pending_is_s_banked = (bank == M_REG_S);
-         case 0xa: /* 64 bit */
+             }
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
+[Qemu-devel] [PULL 12/15] hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
-From: Richard Henderson <richard.henderson@linaro.org>
+The non-secure versions of the BFAR and BFSR registers are
 supposed to be RAZ/WI if AICR.BFHFNMINS == 0; we were
 incorrectly allowing NS code to access the real values.
-We missed all of the scalar fp16 fma operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190430131439.25251-3-peter.maydell@linaro.org
 ---
  hw/intc/armv7m_nvic.c | 27 ++++++++++++++++++++++++---
 file changed, 24 insertions(+), 3 deletions(-)
-Cc: qemu-stable@nongnu.org
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 file changed, 48 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/intc/armv7m_nvic.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-     tcg_temp_free_i64(tcg_res);
+         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
- }
+             goto bad_offset;
 +/* Floating-point data-processing (3 source) - half precision */
 +static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
 +                                int rd, int rn, int rm, int ra)
 +{
 +    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
 +    TCGv_i32 tcg_res = tcg_temp_new_i32();
 +    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
 +    tcg_op3 = read_fp_hreg(s, ra);
 +
 +    /* These are fused multiply-add, and must be done as one
 +     * floating point operation with no rounding between the
 +     * multiplication and addition steps.
 +     * NB that doing the negations here as separate steps is
 +     * correct : an input NaN should come out with its sign bit
 +     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
 +    if (o0 != o1) {
 +        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +    }
 +
 +    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
  /* Floating point data-processing (3 source)
   *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
   * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
          }
-         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
++        if (!attrs.secure &&
-         break;
++            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
-+    case 3:
++            return 0;
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++        }
-+            unallocated_encoding(s);
+         return cpu->env.v7m.bfar;
      case 0xd3c: /* Aux Fault Status.  */
          /* TODO: Implement fault status registers.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
              goto bad_offset;
          }
 +        if (!attrs.secure &&
 +            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
 +            return;
 +        }
-+        if (!fp_access_check(s)) {
+         cpu->env.v7m.bfar = value;
-+            return;
+         return;
      case 0xd3c: /* Aux Fault Status.  */
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
              val = 0;
              break;
          };
 -        /* The BFSR bits [15:8] are shared between security states
 -         * and we store them in the NS copy
 +        /*
 +         * The BFSR bits [15:8] are shared between security states
 +         * and we store them in the NS copy. They are RAZ/WI for
 +         * NS code if AIRCR.BFHFNMINS is 0.
           */
          val = s->cpu->env.v7m.cfsr[attrs.secure];
 -        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
 +        if (!attrs.secure &&
 +            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
 +            val &= ~R_V7M_CFSR_BFSR_MASK;
 +        } else {
 +            val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
 +        }
-+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+         val = extract32(val, (offset - 0xd28) * 8, size * 8);
-+        break;
+         break;
-     default:
+     case 0xfe0 ... 0xfff: /* ID.  */
-         unallocated_encoding(s);
+@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
-     }
+          */
          value <<= ((offset - 0xd28) * 8);
 +        if (!attrs.secure &&
 +            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
 +            /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
 +            value &= ~R_V7M_CFSR_BFSR_MASK;
 +        }
 +
          s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
          if (attrs.secure) {
              /* The BFSR bits [15:8] are shared between security states
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
+[Qemu-devel] [PULL 13/15] hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
-Usually the logging of the CPU state produced by -d cpu is sufficient
+The M-profile architecture specifies that the DebugMonitor exception
-to diagnose problems, but sometimes you want to see the state of
+should be initially disabled, not enabled. It should be controlled
-the floating point registers as well. We don't want to enable that
+by the DEMCR register's MON_EN bit, but we don't implement that
-by default as it adds a lot of extra data to the log; instead,
+register yet (like most of the debug architecture for M-profile).
-allow it to be optionally enabled via -d fpu.
 Note that BKPT instructions will still work, because they
 will be escalated to HardFault.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
+Message-id: 20190430131439.25251-4-peter.maydell@linaro.org
 ---
- include/qemu/log.h   | 1 +
+ hw/intc/armv7m_nvic.c | 4 +++-
- accel/tcg/cpu-exec.c | 9 ++++++---
+file changed, 3 insertions(+), 1 deletion(-)
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/log.h b/include/qemu/log.h
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/log.h
+--- a/hw/intc/armv7m_nvic.c
-+++ b/include/qemu/log.h
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
+@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
- #define CPU_LOG_PAGE       (1 << 14)
+      * the System Handler Control register
- /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
+      */
- #define CPU_LOG_TB_OP_IND  (1 << 16)
+     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
-+#define CPU_LOG_TB_FPU     (1 << 17)
+-    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
+     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
- /* Lock output for a series of related logs.  Since this is not needed
+     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
-  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
++    /* DebugMonitor is enabled via DEMCR.MON_EN */
-index XXXXXXX..XXXXXXX 100644
++    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
---- a/accel/tcg/cpu-exec.c
++
-+++ b/accel/tcg/cpu-exec.c
+     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
-@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
+     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
-     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
+     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
          && qemu_log_in_addr_range(itb->pc)) {
          qemu_log_lock();
 +        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
  #endif /* DEBUG_DISAS */
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+[Qemu-devel] [PULL 14/15] target/arm: Implement XPSR GE bits
-From: Richard Henderson <richard.henderson@linaro.org>
+In the M-profile architecture, if the CPU implements the DSP extension
 then the XPSR has GE bits, in the same way as the A-profile CPSR. When
 we added DSP extension support we forgot to add support for reading
 and writing the GE bits, which are stored in env->GE. We did put in
 the code to add XPSR_GE to the mask of bits to update in the v7m_msr
 helper, but forgot it in v7m_mrs. We also must not allow the XPSR we
 pull off the stack on exception return to set the nonexistent GE bits.
 Correct these errors:
  * read and write env->GE in xpsr_read() and xpsr_write()
  * only set GE bits on exception return if DSP present
  * read GE bits for MRS if DSP present
-We missed all of the scalar fp16 binary operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190430131439.25251-5-peter.maydell@linaro.org
 ---
  target/arm/cpu.h    |  4 ++++
  target/arm/helper.c | 12 ++++++++++--
 files changed, 14 insertions(+), 2 deletions(-)
-Cc: qemu-stable@nongnu.org
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 file changed, 65 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/cpu.h
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t xpsr_read(CPUARMState *env)
-     tcg_temp_free_i64(tcg_res);
+         | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
          | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
          | ((env->condexec_bits & 0xfc) << 8)
 +        | (env->GE << 16)
          | env->v7m.exception;
  }
-+/* Floating-point data-processing (2 source) - half precision */
+@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
-+static void handle_fp_2src_half(DisasContext *s, int opcode,
+     if (mask & XPSR_Q) {
-+                                int rd, int rn, int rm)
+         env->QF = ((val & XPSR_Q) != 0);
-+{
+     }
-+    TCGv_i32 tcg_op1;
++    if (mask & XPSR_GE) {
-+    TCGv_i32 tcg_op2;
++        env->GE = (val & XPSR_GE) >> 16;
-+    TCGv_i32 tcg_res;
++    }
-+    TCGv_ptr fpst;
+     if (mask & XPSR_T) {
          env->thumb = ((val & XPSR_T) != 0);
      }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
  {
      CPUARMState *env = &cpu->env;
      uint32_t excret;
 -    uint32_t xpsr;
 +    uint32_t xpsr, xpsr_mask;
      bool ufault = false;
      bool sfault = false;
      bool return_to_sp_process;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          }
          *frame_sp_p = frameptr;
      }
 +
-+    tcg_res = tcg_temp_new_i32();
++    xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
-+    fpst = get_fpstatus_ptr(true);
++    if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
-+    tcg_op1 = read_fp_hreg(s, rn);
++        xpsr_mask &= ~XPSR_GE;
 +    tcg_op2 = read_fp_hreg(s, rm);
 +
 +    switch (opcode) {
 +    case 0x0: /* FMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x1: /* FDIV */
 +        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x2: /* FADD */
 +        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x3: /* FSUB */
 +        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
-+
+     /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
-+    write_fp_sreg(s, rd, tcg_res);
+-    xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA));
-+
++    xpsr_write(env, xpsr, xpsr_mask);
-+    tcg_temp_free_ptr(fpst);
-+    tcg_temp_free_i32(tcg_op1);
+     if (env->v7m.secure) {
-+    tcg_temp_free_i32(tcg_op2);
+         bool sfpa = xpsr & XPSR_SFPA;
-+    tcg_temp_free_i32(tcg_res);
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
 +}
 +
  /* Floating point data-processing (2 source)
   *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
   * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
          }
-         handle_fp_2src_double(s, opcode, rd, rn, rm);
+         if (!(reg & 4)) {
-         break;
+             mask |= XPSR_NZCV | XPSR_Q; /* APSR */
-+    case 3:
++            if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++                mask |= XPSR_GE;
-+            unallocated_encoding(s);
++            }
-+            return;
+         }
-+        }
+         /* EPSR reads as zero */
-+        if (!fp_access_check(s)) {
+         return xpsr_read(env) & mask;
 +            return;
 +        }
 +        handle_fp_2src_half(s, opcode, rd, rn, rm);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+[Qemu-devel] [PULL 15/15] target/arm: Stop using variable length array in dc_zva
-In float-to-integer conversion, if the floating point input
+Currently the dc_zva helper function uses a variable length
-converts exactly to the largest or smallest integer that
+array. In fact we know (as the comment above remarks) that
-fits in to the result type, this is not an overflow.
+the length of this array is bounded because the architecture
-In this situation we were producing the correct result value,
+limits the block size and QEMU limits the target page size.
-but were incorrectly setting the Invalid flag.
+Use a fixed array size and assert that we don't run off it.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Fix the boundary case to take the right half of the if()
-statements.
-This fixes a regression from 2.11 introduced by the softfloat
-refactoring.
-Cc: qemu-stable@nongnu.org
-Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190503120448.13385-1-peter.maydell@linaro.org
 ---
- fpu/softfloat.c | 4 ++--
+ target/arm/helper.c | 8 ++++++--
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/target/arm/helper.c
-+++ b/fpu/softfloat.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+@@ -XXX,XX +XXX,XX @@
-             r = UINT64_MAX;
+ #include "qemu/osdep.h"
-         }
++#include "qemu/units.h"
-         if (p.sign) {
+ #include "target/arm/idau.h"
--            if (r < -(uint64_t) min) {
+ #include "trace.h"
-+            if (r <= -(uint64_t) min) {
+ #include "cpu.h"
-                 return -r;
+@@ -XXX,XX +XXX,XX @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
-             } else {
+          * We know that in fact for any v8 CPU the page size is at least 4K
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
+          * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
-                 return min;
+          * 1K as an artefact of legacy v5 subpage support being present in the
-             }
+-         * same QEMU executable.
-         } else {
++         * same QEMU executable. So in practice the hostaddr[] array has
--            if (r < max) {
++         * two entries, given the current setting of TARGET_PAGE_BITS_MIN.
-+            if (r <= max) {
+          */
-                 return r;
+         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
-             } else {
+-        void *hostaddr[maxidx];
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
++        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
          int try, i;
          unsigned mmu_idx = cpu_mmu_index(env, false);
          TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 +        assert(maxidx <= ARRAY_SIZE(hostaddr));
 +
          for (try = 0; try < 2; try++) {
              for (i = 0; i < maxidx; i++) {
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+Deleted patch
-In commit d81ce0ef2c4f105 we added an extra float_status field
-fp_status_fp16 for Arm, but forgot to initialize it correctly
-by setting it to float_tininess_before_rounding. This currently
-will only cause problems for the new V8_FP16 feature, since the
-float-to-float conversion code doesn't use it yet. The effect
-would be that we failed to set the Underflow IEEE exception flag
-in all the cases where we should.
-Add the missing initialization.
-Fixes: d81ce0ef2c4f105
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
----
- target/arm/cpu.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-                               &env->vfp.fp_status);
-     set_float_detect_tininess(float_tininess_before_rounding,
-                               &env->vfp.standard_fp_status);
-+    set_float_detect_tininess(float_tininess_before_rounding,
-+                              &env->vfp.fp_status_f16);
- #ifndef CONFIG_USER_ONLY
-     if (kvm_enabled()) {
-         kvm_arm_reset_vcpu(cpu);
---
-.17.0

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0

A mixed bag, all bug fixes or similar small stuff.

thanks
-- PMM

The following changes since commit 19eb2d4e736dc895f31fbd6b520e514f10cc08e0:

Merge remote-tracking branch 'remotes/thibault/tags/samuel-thibault' into staging (2019-05-07 10:43:32 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190507

for you to fetch changes up to 63159601fb3e396b28da14cbb71e50ed3f5a0331:

target/arm: Stop using variable length array in dc_zva (2019-05-07 12:55:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * Stop using variable length array in dc_zva
 * Implement M-profile XPSR GE bits
 * Don't enable ARMV7M_EXCP_DEBUG from reset
 * armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
 * armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
 * fix various minor issues to allow building for Windows-on-ARM64
 * aspeed: Set SDRAM size
 * Allow system registers for KVM guests to be changed by QEMU code
 * raspi: Diagnose requests for too much RAM
 * virt: Support firmware configuration with -blockdev

----------------------------------------------------------------
Cao Jiaxi (4):
      QEMU_PACKED: Remove gcc_struct attribute in Windows non x86 targets
      qga: Fix mingw compilation warnings on enum conversion
      util/cacheinfo: Use uint64_t on LLP64 model to satisfy Windows ARM64
      osdep: Fix mingw compilation regarding stdio formats

Joel Stanley (1):
      arm: aspeed: Set SDRAM size

Markus Armbruster (3):
      pc: Rearrange pc_system_firmware_init()'s legacy -drive loop
      pflash_cfi01: New pflash_cfi01_legacy_drive()
      hw/arm/virt: Support firmware configuration with -blockdev

Peter Maydell (7):
      hw/arm/raspi: Diagnose requests for too much RAM
      arm: Allow system registers for KVM guests to be changed by QEMU code
      hw/arm/armv7m_nvic: Check subpriority in nvic_recompute_state_secure()
      hw/intc/armv7m_nvic: NS BFAR and BFSR are RAZ/WI if BFHFNMINS == 0
      hw/intc/armv7m_nvic: Don't enable ARMV7M_EXCP_DEBUG from reset
      target/arm: Implement XPSR GE bits
      target/arm: Stop using variable length array in dc_zva

From: Markus Armbruster <armbru@redhat.com>

The loop does two things: map legacy -drive to properties, and collect
all the backends for use after the loop.  The next patch will factor
out the former for reuse in hw/arm/virt.c.  To make that easier,
rearrange the loop so it does the first thing first, and the second
thing second.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190416091348.26075-2-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/pc_sysfw.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 
     /* Map legacy -drive if=pflash to machine properties */
     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
-        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
         pflash_drv = drive_get(IF_PFLASH, 0, i);
-        if (!pflash_drv) {
-            continue;
+        if (pflash_drv) {
+            loc_push_none(&loc);
+            qemu_opts_loc_restore(pflash_drv->opts);
+            if (pflash_cfi01_get_blk(pcms->flash[i])) {
+                error_report("clashes with -machine");
+                exit(1);
+            }
+            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
+                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
+            loc_pop(&loc);
         }
-        loc_push_none(&loc);
-        qemu_opts_loc_restore(pflash_drv->opts);
-        if (pflash_blk[i]) {
-            error_report("clashes with -machine");
-            exit(1);
-        }
-        pflash_blk[i] = blk_by_legacy_dinfo(pflash_drv);
-        qdev_prop_set_drive(DEVICE(pcms->flash[i]),
-                            "drive", pflash_blk[i], &error_fatal);
-        loc_pop(&loc);
+        pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
     }
 
     /* Reject gaps */
-- 
2.20.1

From: Markus Armbruster <armbru@redhat.com>

Factored out of pc_system_firmware_init() so the next commit can reuse
it in hw/arm/virt.c.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190416091348.26075-3-armbru@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/block/flash.h |  1 +
 hw/block/pflash_cfi01.c  | 28 ++++++++++++++++++++++++++++
 hw/i386/pc_sysfw.c       | 16 ++--------------
 3 files changed, 31 insertions(+), 14 deletions(-)

diff --git a/include/hw/block/flash.h b/include/hw/block/flash.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/block/flash.h
+++ b/include/hw/block/flash.h
@@ -XXX,XX +XXX,XX @@ PFlashCFI01 *pflash_cfi01_register(hwaddr base,
                                    int be);
 BlockBackend *pflash_cfi01_get_blk(PFlashCFI01 *fl);
 MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl);
+void pflash_cfi01_legacy_drive(PFlashCFI01 *dev, DriveInfo *dinfo);
 
 /* pflash_cfi02.c */
 
diff --git a/hw/block/pflash_cfi01.c b/hw/block/pflash_cfi01.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/pflash_cfi01.c
+++ b/hw/block/pflash_cfi01.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
+#include "qemu/error-report.h"
 #include "qemu/host-utils.h"
 #include "qemu/log.h"
+#include "qemu/option.h"
 #include "hw/sysbus.h"
+#include "sysemu/blockdev.h"
 #include "sysemu/sysemu.h"
 #include "trace.h"
 
@@ -XXX,XX +XXX,XX @@ MemoryRegion *pflash_cfi01_get_memory(PFlashCFI01 *fl)
     return &fl->mem;
 }
 
+/*
+ * Handle -drive if=pflash for machines that use properties.
+ * If @dinfo is null, do nothing.
+ * Else if @fl's property "drive" is already set, fatal error.
+ * Else set it to the BlockBackend with @dinfo.
+ */
+void pflash_cfi01_legacy_drive(PFlashCFI01 *fl, DriveInfo *dinfo)
+{
+    Location loc;
+
+    if (!dinfo) {
+        return;
+    }
+
+    loc_push_none(&loc);
+    qemu_opts_loc_restore(dinfo->opts);
+    if (fl->blk) {
+        error_report("clashes with -machine");
+        exit(1);
+    }
+    qdev_prop_set_drive(DEVICE(fl), "drive",
+                        blk_by_legacy_dinfo(dinfo), &error_fatal);
+    loc_pop(&loc);
+}
+
 static void postload_update_cb(void *opaque, int running, RunState state)
 {
     PFlashCFI01 *pfl = opaque;
diff --git a/hw/i386/pc_sysfw.c b/hw/i386/pc_sysfw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc_sysfw.c
+++ b/hw/i386/pc_sysfw.c
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 {
     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
     int i;
-    DriveInfo *pflash_drv;
     BlockBackend *pflash_blk[ARRAY_SIZE(pcms->flash)];
-    Location loc;
 
     if (!pcmc->pci_enabled) {
         old_pc_system_rom_init(rom_memory, true);
@@ -XXX,XX +XXX,XX @@ void pc_system_firmware_init(PCMachineState *pcms,
 
     /* Map legacy -drive if=pflash to machine properties */
     for (i = 0; i < ARRAY_SIZE(pcms->flash); i++) {
-        pflash_drv = drive_get(IF_PFLASH, 0, i);
-        if (pflash_drv) {
-            loc_push_none(&loc);
-            qemu_opts_loc_restore(pflash_drv->opts);
-            if (pflash_cfi01_get_blk(pcms->flash[i])) {
-                error_report("clashes with -machine");
-                exit(1);
-            }
-            qdev_prop_set_drive(DEVICE(pcms->flash[i]), "drive",
-                                blk_by_legacy_dinfo(pflash_drv), &error_fatal);
-            loc_pop(&loc);
-        }
+        pflash_cfi01_legacy_drive(pcms->flash[i],
+                                  drive_get(IF_PFLASH, 0, i));
         pflash_blk[i] = pflash_cfi01_get_blk(pcms->flash[i]);
     }
 
-- 
2.20.1

From: Markus Armbruster <armbru@redhat.com>

The ARM virt machines put firmware in flash memory.  To configure it,
you use -drive if=pflash,unit=0,... and optionally -drive
if=pflash,unit=1,...

Why two -drive?  This permits setting up one part of the flash memory
read-only, and the other part read/write.  It also makes upgrading
firmware on the host easier.  Below the hood, we get two separate
flash devices, because we were too lazy to improve our flash device
models to support sector protection.

The problem at hand is to do the same with -blockdev somehow, as one
more step towards deprecating -drive.

We recently solved this problem for x86 PC machines, in commit
ebc29e1beab.  See the commit message for design rationale.

This commit solves it for ARM virt basically the same way: new machine
properties pflash0, pflash1 forward to the onboard flash devices'
properties.  Requires creating the onboard devices in the
.instance_init() method virt_instance_init().  The existing code to
pick up drives defined with -drive if=pflash is replaced by code to
desugar into the machine properties.

There are a few behavioral differences, though:

* The flash devices are always present (x86: only present if
  configured)

* Flash base addresses and sizes are fixed (x86: sizes depend on
  images, mapped back to back below a fixed address)

* -bios configures contents of first pflash (x86: -bios configures ROM
   contents)

* -bios is rejected when first pflash is also configured with -machine
   pflash0=... (x86: bios is silently ignored then)

* -machine pflash1=... does not require -machine pflash0=... (x86: it
   does).

The actual code is a bit simpler than for x86 mostly due to the first
two differences.

Before the patch, all the action is in create_flash(), called from the
machine's .init() method machvirt_init():

main()
        machine_run_board_init()
            machvirt_init()
                create_flash()
                    create_one_flash() for flash[0]
                        create
                        configure
                            includes obeying -drive if=pflash,unit=0
                        realize
                        map
                        fall back to -bios
                    create_one_flash() for flash[1]
                        create
                        configure
                            includes obeying -drive if=pflash,unit=1
                        realize
                        map
                    update FDT

To make the machine properties work, we need to move device creation
to its .instance_init() method virt_instance_init().

Another complication is machvirt_init()'s computation of
@firmware_loaded: it predicts what create_flash() will do.  Instead of
predicting what create_flash()'s replacement virt_firmware_init() will
do, I decided to have virt_firmware_init() return what it did.
Requires calling it a bit earlier.

Resulting call tree:

main()
        current_machine = object_new()
            ...
                virt_instance_init()
                    virt_flash_create()
                        virt_flash_create1() for flash[0]
                            create
                            configure: set defaults
                            become child of machine [NEW]
                            add machine prop pflash0 as alias for drive [NEW]
                        virt_flash_create1() for flash[1]
                            create
                            configure: set defaults
                            become child of machine [NEW]
                            add machine prop pflash1 as alias for drive [NEW]
        for all machine props from the command line: machine_set_property()
            ...
                property_set_alias() for machine props pflash0, pflash1
                    ...
                        set_drive() for cfi.pflash01 prop drive
                            this is how -machine pflash0=... etc set
        machine_run_board_init(current_machine);
            virt_firmware_init()
                pflash_cfi01_legacy_drive()
                    legacy -drive if=pflash,unit=0 and =1 [NEW]
                virt_flash_map()
                    virt_flash_map1() for flash[0]
                        configure: num-blocks
                        realize
                        map
                    virt_flash_map1() for flash[1]
                        configure: num-blocks
                        realize
                        map
                fall back to -bios
            virt_flash_fdt()
                update FDT

You have László to thank for making me explain this in detail.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Message-id: 20190416091348.26075-4-armbru@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |   2 +
 hw/arm/virt.c         | 202 +++++++++++++++++++++++++++---------------
 2 files changed, 132 insertions(+), 72 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/notify.h"
 #include "hw/boards.h"
 #include "hw/arm/arm.h"
+#include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
 
@@ -XXX,XX +XXX,XX @@ typedef struct {
     Notifier machine_done;
     DeviceState *platform_bus_dev;
     FWCfgState *fw_cfg;
+    PFlashCFI01 *flash[2];
     bool secure;
     bool highmem;
     bool highmem_ecam;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ static void create_virtio_devices(const VirtMachineState *vms, qemu_irq *pic)
     }
 }
 
-static void create_one_flash(const char *name, hwaddr flashbase,
-                             hwaddr flashsize, const char *file,
-                             MemoryRegion *sysmem)
+#define VIRT_FLASH_SECTOR_SIZE (256 * KiB)
+
+static PFlashCFI01 *virt_flash_create1(VirtMachineState *vms,
+                                        const char *name,
+                                        const char *alias_prop_name)
 {
-    /* Create and map a single flash device. We use the same
-     * parameters as the flash devices on the Versatile Express board.
+    /*
+     * Create a single flash device.  We use the same parameters as
+     * the flash devices on the Versatile Express board.
      */
-    DriveInfo *dinfo = drive_get_next(IF_PFLASH);
     DeviceState *dev = qdev_create(NULL, TYPE_PFLASH_CFI01);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    const uint64_t sectorlength = 256 * 1024;
 
-    if (dinfo) {
-        qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo),
-                            &error_abort);
-    }
-
-    qdev_prop_set_uint32(dev, "num-blocks", flashsize / sectorlength);
-    qdev_prop_set_uint64(dev, "sector-length", sectorlength);
+    qdev_prop_set_uint64(dev, "sector-length", VIRT_FLASH_SECTOR_SIZE);
     qdev_prop_set_uint8(dev, "width", 4);
     qdev_prop_set_uint8(dev, "device-width", 2);
     qdev_prop_set_bit(dev, "big-endian", false);
@@ -XXX,XX +XXX,XX @@ static void create_one_flash(const char *name, hwaddr flashbase,
     qdev_prop_set_uint16(dev, "id2", 0x00);
     qdev_prop_set_uint16(dev, "id3", 0x00);
     qdev_prop_set_string(dev, "name", name);
-    qdev_init_nofail(dev);
-
-    memory_region_add_subregion(sysmem, flashbase,
-                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
-
-    if (file) {
-        char *fn;
-        int image_size;
-
-        if (drive_get(IF_PFLASH, 0, 0)) {
-            error_report("The contents of the first flash device may be "
-                         "specified with -bios or with -drive if=pflash... "
-                         "but you cannot use both options at once");
-            exit(1);
-        }
-        fn = qemu_find_file(QEMU_FILE_TYPE_BIOS, file);
-        if (!fn) {
-            error_report("Could not find ROM image '%s'", file);
-            exit(1);
-        }
-        image_size = load_image_mr(fn, sysbus_mmio_get_region(sbd, 0));
-        g_free(fn);
-        if (image_size < 0) {
-            error_report("Could not load ROM image '%s'", file);
-            exit(1);
-        }
-    }
+    object_property_add_child(OBJECT(vms), name, OBJECT(dev),
+                              &error_abort);
+    object_property_add_alias(OBJECT(vms), alias_prop_name,
+                              OBJECT(dev), "drive", &error_abort);
+    return PFLASH_CFI01(dev);
 }
 
-static void create_flash(const VirtMachineState *vms,
-                         MemoryRegion *sysmem,
-                         MemoryRegion *secure_sysmem)
+static void virt_flash_create(VirtMachineState *vms)
 {
-    /* Create two flash devices to fill the VIRT_FLASH space in the memmap.
-     * Any file passed via -bios goes in the first of these.
+    vms->flash[0] = virt_flash_create1(vms, "virt.flash0", "pflash0");
+    vms->flash[1] = virt_flash_create1(vms, "virt.flash1", "pflash1");
+}
+
+static void virt_flash_map1(PFlashCFI01 *flash,
+                            hwaddr base, hwaddr size,
+                            MemoryRegion *sysmem)
+{
+    DeviceState *dev = DEVICE(flash);
+
+    assert(size % VIRT_FLASH_SECTOR_SIZE == 0);
+    assert(size / VIRT_FLASH_SECTOR_SIZE <= UINT32_MAX);
+    qdev_prop_set_uint32(dev, "num-blocks", size / VIRT_FLASH_SECTOR_SIZE);
+    qdev_init_nofail(dev);
+
+    memory_region_add_subregion(sysmem, base,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
+                                                       0));
+}
+
+static void virt_flash_map(VirtMachineState *vms,
+                           MemoryRegion *sysmem,
+                           MemoryRegion *secure_sysmem)
+{
+    /*
+     * Map two flash devices to fill the VIRT_FLASH space in the memmap.
      * sysmem is the system memory space. secure_sysmem is the secure view
      * of the system, and the first flash device should be made visible only
      * there. The second flash device is visible to both secure and nonsecure.
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
      */
     hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
     hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
-    char *nodename;
 
-    create_one_flash("virt.flash0", flashbase, flashsize,
-                     bios_name, secure_sysmem);
-    create_one_flash("virt.flash1", flashbase + flashsize, flashsize,
-                     NULL, sysmem);
+    virt_flash_map1(vms->flash[0], flashbase, flashsize,
+                    secure_sysmem);
+    virt_flash_map1(vms->flash[1], flashbase + flashsize, flashsize,
+                    sysmem);
+}
+
+static void virt_flash_fdt(VirtMachineState *vms,
+                           MemoryRegion *sysmem,
+                           MemoryRegion *secure_sysmem)
+{
+    hwaddr flashsize = vms->memmap[VIRT_FLASH].size / 2;
+    hwaddr flashbase = vms->memmap[VIRT_FLASH].base;
+    char *nodename;
 
     if (sysmem == secure_sysmem) {
         /* Report both flash devices as a single node in the DT */
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
         qemu_fdt_setprop_cell(vms->fdt, nodename, "bank-width", 4);
         g_free(nodename);
     } else {
-        /* Report the devices as separate nodes so we can mark one as
+        /*
+         * Report the devices as separate nodes so we can mark one as
          * only visible to the secure world.
          */
         nodename = g_strdup_printf("/secflash@%" PRIx64, flashbase);
@@ -XXX,XX +XXX,XX @@ static void create_flash(const VirtMachineState *vms,
     }
 }
 
+static bool virt_firmware_init(VirtMachineState *vms,
+                               MemoryRegion *sysmem,
+                               MemoryRegion *secure_sysmem)
+{
+    int i;
+    BlockBackend *pflash_blk0;
+
+    /* Map legacy -drive if=pflash to machine properties */
+    for (i = 0; i < ARRAY_SIZE(vms->flash); i++) {
+        pflash_cfi01_legacy_drive(vms->flash[i],
+                                  drive_get(IF_PFLASH, 0, i));
+    }
+
+    virt_flash_map(vms, sysmem, secure_sysmem);
+
+    pflash_blk0 = pflash_cfi01_get_blk(vms->flash[0]);
+
+    if (bios_name) {
+        char *fname;
+        MemoryRegion *mr;
+        int image_size;
+
+        if (pflash_blk0) {
+            error_report("The contents of the first flash device may be "
+                         "specified with -bios or with -drive if=pflash... "
+                         "but you cannot use both options at once");
+            exit(1);
+        }
+
+        /* Fall back to -bios */
+
+        fname = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+        if (!fname) {
+            error_report("Could not find ROM image '%s'", bios_name);
+            exit(1);
+        }
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(vms->flash[0]), 0);
+        image_size = load_image_mr(fname, mr);
+        g_free(fname);
+        if (image_size < 0) {
+            error_report("Could not load ROM image '%s'", bios_name);
+            exit(1);
+        }
+    }
+
+    return pflash_blk0 || bios_name;
+}
+
 static FWCfgState *create_fw_cfg(const VirtMachineState *vms, AddressSpace *as)
 {
     hwaddr base = vms->memmap[VIRT_FW_CFG].base;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     MemoryRegion *secure_sysmem = NULL;
     int n, virt_max_cpus;
     MemoryRegion *ram = g_new(MemoryRegion, 1);
-    bool firmware_loaded = bios_name || drive_get(IF_PFLASH, 0, 0);
+    bool firmware_loaded;
     bool aarch64 = true;
 
     /*
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
+    if (vms->secure) {
+        if (kvm_enabled()) {
+            error_report("mach-virt: KVM does not support Security extensions");
+            exit(1);
+        }
+
+        /*
+         * The Secure view of the world is the same as the NonSecure,
+         * but with a few extra devices. Create it as a container region
+         * containing the system memory at low priority; any secure-only
+         * devices go in at higher priority and take precedence.
+         */
+        secure_sysmem = g_new(MemoryRegion, 1);
+        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
+                           UINT64_MAX);
+        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
+    }
+
+    firmware_loaded = virt_firmware_init(vms, sysmem,
+                                         secure_sysmem ?: sysmem);
+
     /* If we have an EL3 boot ROM then the assumption is that it will
      * implement PSCI itself, so disable QEMU's internal implementation
      * so it doesn't get in the way. Instead of starting secondary
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         exit(1);
     }
 
-    if (vms->secure) {
-        if (kvm_enabled()) {
-            error_report("mach-virt: KVM does not support Security extensions");
-            exit(1);
-        }
-
-        /* The Secure view of the world is the same as the NonSecure,
-         * but with a few extra devices. Create it as a container region
-         * containing the system memory at low priority; any secure-only
-         * devices go in at higher priority and take precedence.
-         */
-        secure_sysmem = g_new(MemoryRegion, 1);
-        memory_region_init(secure_sysmem, OBJECT(machine), "secure-memory",
-                           UINT64_MAX);
-        memory_region_add_subregion_overlap(secure_sysmem, 0, sysmem, -1);
-    }
-
     create_fdt(vms);
 
     possible_cpus = mc->possible_cpu_arch_ids(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
                                     &machine->device_memory->mr);
     }
 
-    create_flash(vms, sysmem, secure_sysmem ? secure_sysmem : sysmem);
+    virt_flash_fdt(vms, sysmem, secure_sysmem);
 
     create_gic(vms, pic);
 
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
                                     NULL);
 
     vms->irqmap = a15irqmap;
+
+    virt_flash_create(vms);
 }
 
 static const TypeInfo virt_machine_info = {
-- 
2.20.1

The Raspberry Pi boards have a physical memory map which does
not allow for more than 1GB of RAM. Currently if the user tries
to ask for more then we fail in a confusing way:

$ qemu-system-aarch64 --machine raspi3 -m 8G
Unexpected error in visit_type_uintN() at qapi/qapi-visit-core.c:164:
qemu-system-aarch64: Parameter 'vcram-base' expects uint32_t
Aborted (core dumped)

Catch this earlier and diagnose it with a more friendly message:
$ qemu-system-aarch64 --machine raspi3 -m 8G
qemu-system-aarch64: Requested ram size is too large for this machine: maximum is 1GB

Fixes: https://bugs.launchpad.net/qemu/+bug/1794187
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
---
 hw/arm/raspi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
+    if (machine->ram_size > 1 * GiB) {
+        error_report("Requested ram size is too large for this machine: "
+                     "maximum is 1GB");
+        exit(1);
+    }
+
     object_initialize(&s->soc, sizeof(s->soc),
                       version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
-- 
2.20.1

At the moment the Arm implementations of kvm_arch_{get,put}_registers()
don't support having QEMU change the values of system registers
(aka coprocessor registers for AArch32). This is because although
kvm_arch_get_registers() calls write_list_to_cpustate() to
update the CPU state struct fields (so QEMU code can read the
values in the usual way), kvm_arch_put_registers() does not
call write_cpustate_to_list(), meaning that any changes to
the CPU state struct fields will not be passed back to KVM.

The rationale for this design is documented in a comment in the
AArch32 kvm_arch_put_registers() -- writing the values in the
cpregs list into the CPU state struct is "lossy" because the
write of a register might not succeed, and so if we blindly
copy the CPU state values back again we will incorrectly
change register values for the guest. The assumption was that
no QEMU code would need to write to the registers.

However, when we implemented debug support for KVM guests, we
broke that assumption: the code to handle "set the guest up
to take a breakpoint exception" does so by updating various
guest registers including ESR_EL1.

Support this by making kvm_arch_put_registers() synchronize
CPU state back into the list. We sync only those registers
where the initial write succeeds, which should be sufficient.

This commit is the same as commit 823e1b3818f9b10b824ddc which we
had to revert in commit 942f99c825fc94c8b1a4, except that the bug
which was preventing EDK2 guest firmware running has been fixed:
kvm_arm_reset_vcpu() now calls write_list_to_cpustate().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Eric Auger <eric.auger@redhat.com>
---
 target/arm/cpu.h     |  9 ++++++++-
 target/arm/helper.c  | 27 +++++++++++++++++++++++++--
 target/arm/kvm.c     |  8 ++++++++
 target/arm/kvm32.c   | 20 ++------------------
 target/arm/kvm64.c   |  2 ++
 target/arm/machine.c |  2 +-
 6 files changed, 46 insertions(+), 22 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_list_to_cpustate(ARMCPU *cpu);
 /**
  * write_cpustate_to_list:
  * @cpu: ARMCPU
+ * @kvm_sync: true if this is for syncing back to KVM
  *
  * For each register listed in the ARMCPU cpreg_indexes list, write
  * its value from the ARMCPUState structure into the cpreg_values list.
  * This is used to copy info from TCG's working data structures into
  * KVM or for outbound migration.
  *
+ * @kvm_sync is true if we are doing this in order to sync the
+ * register state back to KVM. In this case we will only update
+ * values in the list if the previous list->cpustate sync actually
+ * successfully wrote the CPU state. Otherwise we will keep the value
+ * that is in the list.
+ *
  * Returns: true if all register values were read correctly,
  * false if some register was unknown or could not be read.
  * Note that we do not stop early on failure -- we will attempt
  * reading all registers in the list.
  */
-bool write_cpustate_to_list(ARMCPU *cpu);
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 
 #define ARM_CPUID_TI915T      0x54029152
 #define ARM_CPUID_TI925T      0x54029252
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool raw_accessors_invalid(const ARMCPRegInfo *ri)
     return true;
 }
 
-bool write_cpustate_to_list(ARMCPU *cpu)
+bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync)
 {
     /* Write the coprocessor state from cpu->env to the (index,value) list. */
     int i;
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
     for (i = 0; i < cpu->cpreg_array_len; i++) {
         uint32_t regidx = kvm_to_cpreg_id(cpu->cpreg_indexes[i]);
         const ARMCPRegInfo *ri;
+        uint64_t newval;
 
         ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
         if (!ri) {
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu)
         if (ri->type & ARM_CP_NO_RAW) {
             continue;
         }
-        cpu->cpreg_values[i] = read_raw_cp_reg(&cpu->env, ri);
+
+        newval = read_raw_cp_reg(&cpu->env, ri);
+        if (kvm_sync) {
+            /*
+             * Only sync if the previous list->cpustate sync succeeded.
+             * Rather than tracking the success/failure state for every
+             * item in the list, we just recheck "does the raw write we must
+             * have made in write_list_to_cpustate() read back OK" here.
+             */
+            uint64_t oldval = cpu->cpreg_values[i];
+
+            if (oldval == newval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, oldval);
+            if (read_raw_cp_reg(&cpu->env, ri) != oldval) {
+                continue;
+            }
+
+            write_raw_cp_reg(&cpu->env, ri, newval);
+        }
+        cpu->cpreg_values[i] = newval;
     }
     return ok;
 }
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ void kvm_arm_reset_vcpu(ARMCPU *cpu)
         fprintf(stderr, "write_kvmstate_to_list failed\n");
         abort();
     }
+    /*
+     * Sync the reset values also into the CPUState. This is necessary
+     * because the next thing we do will be a kvm_arch_put_registers()
+     * which will update the list values from the CPUState before copying
+     * the list values back to KVM. It's OK to ignore failure returns here
+     * for the same reason we do so in kvm_arch_get_registers().
+     */
+    write_list_to_cpustate(cpu);
 }
 
 /*
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
-    /* Note that we do not call write_cpustate_to_list()
-     * here, so we are only writing the tuple list back to
-     * KVM. This is safe because nothing can change the
-     * CPUARMState cp15 fields (in particular gdb accesses cannot)
-     * and so there are no changes to sync. In fact syncing would
-     * be wrong at this point: for a constant register where TCG and
-     * KVM disagree about its value, the preceding write_list_to_cpustate()
-     * would not have had any effect on the CPUARMState value (since the
-     * register is read-only), and a write_cpustate_to_list() here would
-     * then try to write the TCG value back into KVM -- this would either
-     * fail or incorrectly change the value the guest sees.
-     *
-     * If we ever want to allow the user to modify cp15 registers via
-     * the gdb stub, we would need to be more clever here (for instance
-     * tracking the set of registers kvm_arch_get_registers() successfully
-     * managed to update the CPUARMState with, and only allowing those
-     * to be written back up into the kernel).
-     */
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         return ret;
     }
 
+    write_cpustate_to_list(cpu, true);
+
     if (!write_list_to_kvmstate(cpu, level)) {
         return EINVAL;
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
             abort();
         }
     } else {
-        if (!write_cpustate_to_list(cpu)) {
+        if (!write_cpustate_to_list(cpu, false)) {
             /* This should never fail. */
             abort();
         }
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

We currently use Qemu's default of 128MB. As we know how much ram each
machine ships with, make it easier on users by setting a default.

It can still be overridden with -m on the command line.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190503022958.1394-1-joel@jms.id.au
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed.h | 1 +
 hw/arm/aspeed.c         | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedBoardConfig {
     const char *spi_model;
     uint32_t num_cs;
     void (*i2c_init)(AspeedBoardState *bmc);
+    uint32_t ram;
 } AspeedBoardConfig;
 
 #define TYPE_ASPEED_MACHINE       MACHINE_TYPE_NAME("aspeed")
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/block-backend.h"
 #include "hw/loader.h"
 #include "qemu/error-report.h"
+#include "qemu/units.h"
 
 static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_class_init(ObjectClass *oc, void *data)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->no_parallel = 1;
+    if (board->ram) {
+        mc->default_ram_size = board->ram;
+    }
     amc->board = board;
 }
 
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
         .i2c_init  = palmetto_bmc_i2c_init,
+        .ram       = 256 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("ast2500-evb"),
         .desc      = "Aspeed AST2500 EVB (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx25l25635e",
         .num_cs    = 1,
         .i2c_init  = ast2500_evb_i2c_init,
+        .ram       = 512 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("romulus-bmc"),
         .desc      = "OpenPOWER Romulus BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
         .i2c_init  = romulus_bmc_i2c_init,
+        .ram       = 512 * MiB,
     }, {
         .name      = MACHINE_TYPE_NAME("witherspoon-bmc"),
         .desc      = "OpenPOWER Witherspoon BMC (ARM1176)",
@@ -XXX,XX +XXX,XX @@ static const AspeedBoardConfig aspeed_boards[] = {
         .spi_model = "mx66l1g45g",
         .num_cs    = 2,
         .i2c_init  = witherspoon_bmc_i2c_init,
+        .ram       = 512 * MiB,
     },
 };
 
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

gcc_struct is for x86 only, and it generates an warning on ARM64 Clang/MinGW targets.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003618.10089-1-driver1998@foxmail.com
[PMM: dropped the slirp change as slirp is now a submodule]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/libvhost-user/libvhost-user.h | 2 +-
 include/qemu/compiler.h               | 2 +-
 scripts/cocci-macro-file.h            | 7 ++++++-
 3 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/libvhost-user.h
+++ b/contrib/libvhost-user/libvhost-user.h
@@ -XXX,XX +XXX,XX @@ typedef struct VhostUserInflight {
     uint16_t queue_size;
 } VhostUserInflight;
 
-#if defined(_WIN32)
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define VU_PACKED __attribute__((gcc_struct, packed))
 #else
 # define VU_PACKED __attribute__((packed))
diff --git a/include/qemu/compiler.h b/include/qemu/compiler.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/compiler.h
+++ b/include/qemu/compiler.h
@@ -XXX,XX +XXX,XX @@
 
 #define QEMU_SENTINEL __attribute__((sentinel))
 
-#if defined(_WIN32)
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
 # define QEMU_PACKED __attribute__((gcc_struct, packed))
 #else
 # define QEMU_PACKED __attribute__((packed))
diff --git a/scripts/cocci-macro-file.h b/scripts/cocci-macro-file.h
index XXXXXXX..XXXXXXX 100644
--- a/scripts/cocci-macro-file.h
+++ b/scripts/cocci-macro-file.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_NORETURN __attribute__ ((__noreturn__))
 #define QEMU_WARN_UNUSED_RESULT __attribute__((warn_unused_result))
 #define QEMU_SENTINEL __attribute__((sentinel))
-#define QEMU_PACKED __attribute__((gcc_struct, packed))
+
+#if defined(_WIN32) && (defined(__x86_64__) || defined(__i386__))
+# define QEMU_PACKED __attribute__((gcc_struct, packed))
+#else
+# define QEMU_PACKED __attribute__((packed))
+#endif
 
 #define cat(x,y) x ## y
 #define cat2(x,y) cat(x,y)
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

The win2qemu[] is supposed to be the conversion table to convert between
STORAGE_BUS_TYPE in Windows SDK and GuestDiskBusType in qga.

But it was incorrectly written that it forces to set a GuestDiskBusType
value to STORAGE_BUS_TYPE, which generates an enum conversion warning in clang.

Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003650.10137-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qga/commands-win32.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -XXX,XX +XXX,XX @@ void qmp_guest_file_flush(int64_t handle, Error **errp)
 
 #ifdef CONFIG_QGA_NTDDSCSI
 
-static STORAGE_BUS_TYPE win2qemu[] = {
+static GuestDiskBusType win2qemu[] = {
     [BusTypeUnknown] = GUEST_DISK_BUS_TYPE_UNKNOWN,
     [BusTypeScsi] = GUEST_DISK_BUS_TYPE_SCSI,
     [BusTypeAtapi] = GUEST_DISK_BUS_TYPE_IDE,
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

Windows ARM64 uses LLP64 model, which breaks current assumptions.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20190503003707.10185-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cacheinfo.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/util/cacheinfo.c b/util/cacheinfo.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheinfo.c
+++ b/util/cacheinfo.c
@@ -XXX,XX +XXX,XX @@ static void sys_cache_info(int *isize, int *dsize)
 static void arch_cache_info(int *isize, int *dsize)
 {
     if (*isize == 0 || *dsize == 0) {
-        unsigned long ctr;
+        uint64_t ctr;
 
         /* The real cache geometry is in CCSIDR_EL1/CLIDR_EL1/CSSELR_EL1,
            but (at least under Linux) these are marked protected by the
-- 
2.20.1

From: Cao Jiaxi <driver1998@foxmail.com>

I encountered the following compilation error on mingw:

/mnt/d/qemu/include/qemu/osdep.h:97:9: error: '__USE_MINGW_ANSI_STDIO' macro redefined [-Werror,-Wmacro-redefined]
 #define __USE_MINGW_ANSI_STDIO 1
        ^
/mnt/d/llvm-mingw/aarch64-w64-mingw32/include/_mingw.h:433:9: note: previous definition is here
 #define __USE_MINGW_ANSI_STDIO 0      /* was not defined so it should be 0 */

It turns out that __USE_MINGW_ANSI_STDIO must be set before any
system headers are included, not just before stdio.h.

Signed-off-by: Cao Jiaxi <driver1998@foxmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Message-id: 20190503003719.10233-1-driver1998@foxmail.com
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/osdep.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ extern int daemon(int, int);
 #endif
 #endif
 
+/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
+#ifdef __MINGW32__
+#define __USE_MINGW_ANSI_STDIO 1
+#endif
+
 #include <stdarg.h>
 #include <stddef.h>
 #include <stdbool.h>
 #include <stdint.h>
 #include <sys/types.h>
 #include <stdlib.h>
-
-/* enable C99/POSIX format strings (needs mingw32-runtime 3.15 or later) */
-#ifdef __MINGW32__
-#define __USE_MINGW_ANSI_STDIO 1
-#endif
 #include <stdio.h>
 
 #include <string.h>
-- 
2.20.1

Rule R_CQRV says that if two pending interrupts have the same
group priority then ties are broken by looking at the subpriority.
We had a comment describing this but had forgotten to actually
implement the subpriority comparison. Correct the omission.

(The further tie break rules of "lowest exception number" and
"secure before non-secure" are handled implicitly by the order
in which we iterate through the exceptions in the loops.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-2-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
     int active_prio = NVIC_NOEXC_PRIO;
     int pend_irq = 0;
     bool pending_is_s_banked = false;
+    int pend_subprio = 0;
 
     /* R_CQRV: precedence is by:
      *  - lowest group priority; if both the same then
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
     for (i = 1; i < s->num_irq; i++) {
         for (bank = M_REG_S; bank >= M_REG_NS; bank--) {
             VecInfo *vec;
-            int prio;
+            int prio, subprio;
             bool targets_secure;
 
             if (bank == M_REG_S) {
@@ -XXX,XX +XXX,XX @@ static void nvic_recompute_state_secure(NVICState *s)
             }
 
             prio = exc_group_prio(s, vec->prio, targets_secure);
-            if (vec->enabled && vec->pending && prio < pend_prio) {
+            subprio = vec->prio & ~nvic_gprio_mask(s, targets_secure);
+            if (vec->enabled && vec->pending &&
+                ((prio < pend_prio) ||
+                 (prio == pend_prio && prio >= 0 && subprio < pend_subprio))) {
                 pend_prio = prio;
+                pend_subprio = subprio;
                 pend_irq = i;
                 pending_is_s_banked = (bank == M_REG_S);
             }
-- 
2.20.1

The non-secure versions of the BFAR and BFSR registers are
supposed to be RAZ/WI if AICR.BFHFNMINS == 0; we were
incorrectly allowing NS code to access the real values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-3-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 27 ++++++++++++++++++++++++---
 1 file changed, 24 insertions(+), 3 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            return 0;
+        }
         return cpu->env.v7m.bfar;
     case 0xd3c: /* Aux Fault Status.  */
         /* TODO: Implement fault status registers.  */
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         if (!arm_feature(&cpu->env, ARM_FEATURE_M_MAIN)) {
             goto bad_offset;
         }
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            return;
+        }
         cpu->env.v7m.bfar = value;
         return;
     case 0xd3c: /* Aux Fault Status.  */
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_read(void *opaque, hwaddr addr,
             val = 0;
             break;
         };
-        /* The BFSR bits [15:8] are shared between security states
-         * and we store them in the NS copy
+        /*
+         * The BFSR bits [15:8] are shared between security states
+         * and we store them in the NS copy. They are RAZ/WI for
+         * NS code if AIRCR.BFHFNMINS is 0.
          */
         val = s->cpu->env.v7m.cfsr[attrs.secure];
-        val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            val &= ~R_V7M_CFSR_BFSR_MASK;
+        } else {
+            val |= s->cpu->env.v7m.cfsr[M_REG_NS] & R_V7M_CFSR_BFSR_MASK;
+        }
         val = extract32(val, (offset - 0xd28) * 8, size * 8);
         break;
     case 0xfe0 ... 0xfff: /* ID.  */
@@ -XXX,XX +XXX,XX @@ static MemTxResult nvic_sysreg_write(void *opaque, hwaddr addr,
          */
         value <<= ((offset - 0xd28) * 8);
 
+        if (!attrs.secure &&
+            !(s->cpu->env.v7m.aircr & R_V7M_AIRCR_BFHFNMINS_MASK)) {
+            /* BFSR bits are RAZ/WI for NS if BFHFNMINS is set */
+            value &= ~R_V7M_CFSR_BFSR_MASK;
+        }
+
         s->cpu->env.v7m.cfsr[attrs.secure] &= ~value;
         if (attrs.secure) {
             /* The BFSR bits [15:8] are shared between security states
-- 
2.20.1

The M-profile architecture specifies that the DebugMonitor exception
should be initially disabled, not enabled. It should be controlled
by the DEMCR register's MON_EN bit, but we don't implement that
register yet (like most of the debug architecture for M-profile).

Note that BKPT instructions will still work, because they
will be escalated to HardFault.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-4-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
      * the System Handler Control register
      */
     s->vectors[ARMV7M_EXCP_SVC].enabled = 1;
-    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 1;
     s->vectors[ARMV7M_EXCP_PENDSV].enabled = 1;
     s->vectors[ARMV7M_EXCP_SYSTICK].enabled = 1;
 
+    /* DebugMonitor is enabled via DEMCR.MON_EN */
+    s->vectors[ARMV7M_EXCP_DEBUG].enabled = 0;
+
     resetprio = arm_feature(&s->cpu->env, ARM_FEATURE_V8) ? -4 : -3;
     s->vectors[ARMV7M_EXCP_RESET].prio = resetprio;
     s->vectors[ARMV7M_EXCP_NMI].prio = -2;
-- 
2.20.1

In the M-profile architecture, if the CPU implements the DSP extension
then the XPSR has GE bits, in the same way as the A-profile CPSR. When
we added DSP extension support we forgot to add support for reading
and writing the GE bits, which are stored in env->GE. We did put in
the code to add XPSR_GE to the mask of bits to update in the v7m_msr
helper, but forgot it in v7m_mrs. We also must not allow the XPSR we
pull off the stack on exception return to set the nonexistent GE bits.
Correct these errors:
 * read and write env->GE in xpsr_read() and xpsr_write()
 * only set GE bits on exception return if DSP present
 * read GE bits for MRS if DSP present

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190430131439.25251-5-peter.maydell@linaro.org
---
 target/arm/cpu.h    |  4 ++++
 target/arm/helper.c | 12 ++++++++++--
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t xpsr_read(CPUARMState *env)
         | (env->CF << 29) | ((env->VF & 0x80000000) >> 3) | (env->QF << 27)
         | (env->thumb << 24) | ((env->condexec_bits & 3) << 25)
         | ((env->condexec_bits & 0xfc) << 8)
+        | (env->GE << 16)
         | env->v7m.exception;
 }
 
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
     if (mask & XPSR_Q) {
         env->QF = ((val & XPSR_Q) != 0);
     }
+    if (mask & XPSR_GE) {
+        env->GE = (val & XPSR_GE) >> 16;
+    }
     if (mask & XPSR_T) {
         env->thumb = ((val & XPSR_T) != 0);
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
     uint32_t excret;
-    uint32_t xpsr;
+    uint32_t xpsr, xpsr_mask;
     bool ufault = false;
     bool sfault = false;
     bool return_to_sp_process;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         }
         *frame_sp_p = frameptr;
     }
+
+    xpsr_mask = ~(XPSR_SPREALIGN | XPSR_SFPA);
+    if (!arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
+        xpsr_mask &= ~XPSR_GE;
+    }
     /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
-    xpsr_write(env, xpsr, ~(XPSR_SPREALIGN | XPSR_SFPA));
+    xpsr_write(env, xpsr, xpsr_mask);
 
     if (env->v7m.secure) {
         bool sfpa = xpsr & XPSR_SFPA;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
         }
         if (!(reg & 4)) {
             mask |= XPSR_NZCV | XPSR_Q; /* APSR */
+            if (arm_feature(env, ARM_FEATURE_THUMB_DSP)) {
+                mask |= XPSR_GE;
+            }
         }
         /* EPSR reads as zero */
         return xpsr_read(env) & mask;
-- 
2.20.1

Currently the dc_zva helper function uses a variable length
array. In fact we know (as the comment above remarks) that
the length of this array is bounded because the architecture
limits the block size and QEMU limits the target page size.
Use a fixed array size and assert that we don't run off it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190503120448.13385-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "target/arm/idau.h"
 #include "trace.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
          * We know that in fact for any v8 CPU the page size is at least 4K
          * and the block size must be 2K or less, but TARGET_PAGE_SIZE is only
          * 1K as an artefact of legacy v5 subpage support being present in the
-         * same QEMU executable.
+         * same QEMU executable. So in practice the hostaddr[] array has
+         * two entries, given the current setting of TARGET_PAGE_BITS_MIN.
          */
         int maxidx = DIV_ROUND_UP(blocklen, TARGET_PAGE_SIZE);
-        void *hostaddr[maxidx];
+        void *hostaddr[DIV_ROUND_UP(2 * KiB, 1 << TARGET_PAGE_BITS_MIN)];
         int try, i;
         unsigned mmu_idx = cpu_mmu_index(env, false);
         TCGMemOpIdx oi = make_memop_idx(MO_UB, mmu_idx);
 
+        assert(maxidx <= ARRAY_SIZE(hostaddr));
+
         for (try = 0; try < 2; try++) {
 
             for (i = 0; i < maxidx; i++) {
-- 
2.20.1