Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[PULL 00/27] target-arm queue
-The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
+arm queue: big stuff here is my MVE codegen optimisation,
 and Alex's Apple Silicon hvf support.
-  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
+-- PMM
 The following changes since commit 7adb961995a3744f51396502b33ad04a56a317c3:
   Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210916' into staging (2021-09-19 18:53:29 +0100)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210920
-for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
+for you to fetch changes up to 1dc5a60bfe406bc1122d68cbdefda38d23134b27:
-  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
+  target/arm: Optimize MVE 1op-immediate insns (2021-09-20 14:18:01 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix coverity nit in int_to_float code
+ * Optimize codegen for MVE when predication not active
- * Don't set Invalid for float-to-int(MAXINT)
+ * hvf: Add Apple Silicon support
- * Fix fp_status_f16 tininess before rounding
+ * hw/intc: Set GIC maintenance interrupt level to only 0 or 1
- * Add various missing insns from the v8.2-FP16 extension
+ * Fix mishandling of MVE FPSCR.LTPSIZE reset for usermode emulator
- * Fix sqrt_f16 exception raising
+ * elf2dmp: Fix coverity nits
  * sdcard: Correct CRC16 offset in sd_function_switch()
  * tcg: Optionally log FPU state in TCG -d cpu logging
 ----------------------------------------------------------------
-Alex Bennée (5):
+Alexander Graf (7):
-      fpu/softfloat: int_to_float ensure r fully initialised
+      arm: Move PMC register definitions to internals.h
-      target/arm: Implement FCMP for fp16
+      hvf: Add execute to dirty log permission bitmap
-      target/arm: Implement FCSEL for fp16
+      hvf: Introduce hvf_arch_init() callback
-      target/arm: Implement FMOV (immediate) for fp16
+      hvf: Add Apple Silicon support
-      target/arm: Fix sqrt_f16 exception raising
+      hvf: arm: Implement PSCI handling
       arm: Add Hypervisor.framework build target
       hvf: arm: Add rudimentary PMC support
-Peter Maydell (3):
+Peter Collingbourne (1):
-      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+      arm/hvf: Add a WFI handler
       target/arm: Fix fp_status_f16 tininess before rounding
       tcg: Optionally log FPU state in TCG -d cpu logging
-Philippe Mathieu-Daudé (1):
+Peter Maydell (18):
-      sdcard: Correct CRC16 offset in sd_function_switch()
+      elf2dmp: Check curl_easy_setopt() return value
       elf2dmp: Fail cleanly if PDB file specifies zero block_size
       target/arm: Don't skip M-profile reset entirely in user mode
       target/arm: Always clear exclusive monitor on reset
       target/arm: Consolidate ifdef blocks in reset
       hvf: arm: Implement -cpu host
       target/arm: Avoid goto_tb if we're trying to exit to the main loop
       target/arm: Enforce that FPDSCR.LTPSIZE is 4 on inbound migration
       target/arm: Add TB flag for "MVE insns not predicated"
       target/arm: Optimize MVE logic ops
       target/arm: Optimize MVE arithmetic ops
       target/arm: Optimize MVE VNEG, VABS
       target/arm: Optimize MVE VDUP
       target/arm: Optimize MVE VMVN
       target/arm: Optimize MVE VSHL, VSHR immediate forms
       target/arm: Optimize MVE VSHLL and VMOVL
       target/arm: Optimize MVE VSLI and VSRI
       target/arm: Optimize MVE 1op-immediate insns
-Richard Henderson (7):
+Shashi Mallela (1):
-      target/arm: Implement FMOV (general) for fp16
+      hw/intc: Set GIC maintenance interrupt level to only 0 or 1
       target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
       target/arm: Implement FCVT (scalar, integer) for fp16
       target/arm: Implement FCVT (scalar, fixed-point) for fp16
       target/arm: Introduce and use read_fp_hreg
       target/arm: Implement FP data-processing (2 source) for fp16
       target/arm: Implement FP data-processing (3 source) for fp16
- include/qemu/log.h         |   1 +
+ meson.build                   |    8 +
- target/arm/helper-a64.h    |   2 +
+ include/sysemu/hvf_int.h      |   12 +-
- target/arm/helper.h        |   6 +
+ target/arm/cpu.h              |    6 +-
- accel/tcg/cpu-exec.c       |   9 +-
+ target/arm/hvf_arm.h          |   18 +
- fpu/softfloat.c            |   6 +-
+ target/arm/internals.h        |   44 ++
- hw/sd/sd.c                 |   2 +-
+ target/arm/kvm_arm.h          |    2 -
- target/arm/cpu.c           |   2 +
+ target/arm/translate.h        |    2 +
- target/arm/helper-a64.c    |  10 ++
+ accel/hvf/hvf-accel-ops.c     |   21 +-
- target/arm/helper.c        |  38 +++-
+ contrib/elf2dmp/download.c    |   22 +-
- target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
+ contrib/elf2dmp/pdb.c         |    4 +
- util/log.c                 |   2 +
+ hw/intc/arm_gicv3_cpuif.c     |    5 +-
-files changed, 428 insertions(+), 71 deletions(-)
+ target/arm/cpu.c              |   56 +-
  target/arm/helper.c           |   77 ++-
  target/arm/hvf/hvf.c          | 1278 +++++++++++++++++++++++++++++++++++++++++
  target/arm/machine.c          |   13 +
  target/arm/translate-m-nocp.c |    8 +-
  target/arm/translate-mve.c    |  310 +++++++---
  target/arm/translate-vfp.c    |   33 +-
  target/arm/translate.c        |   42 +-
  target/i386/hvf/hvf.c         |   10 +
  MAINTAINERS                   |    5 +
  target/arm/hvf/meson.build    |    3 +
  target/arm/hvf/trace-events   |   11 +
  target/arm/meson.build        |    2 +
 files changed, 1824 insertions(+), 168 deletions(-)
  create mode 100644 target/arm/hvf_arm.h
  create mode 100644 target/arm/hvf/hvf.c
  create mode 100644 target/arm/hvf/meson.build
  create mode 100644 target/arm/hvf/trace-events

-[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
+[PULL 01/27] elf2dmp: Check curl_easy_setopt() return value
-From: Alex Bennée <alex.bennee@linaro.org>
+Coverity points out that we aren't checking the return value
 from curl_easy_setopt().
-These were missed out from the rest of the half-precision work.
+Fixes: Coverity CID 1458895
+Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20210910170656.366592-2-philmd@redhat.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
 [rth: Fix erroneous check vs type]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
+ contrib/elf2dmp/download.c | 22 ++++++++++------------
-file changed, 25 insertions(+), 6 deletions(-)
+file changed, 10 insertions(+), 12 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/contrib/elf2dmp/download.c b/contrib/elf2dmp/download.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/contrib/elf2dmp/download.c
-+++ b/target/arm/translate-a64.c
++++ b/contrib/elf2dmp/download.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ int download_url(const char *name, const char *url)
-     unsigned int mos, type, rm, cond, rn, rd;
+         goto out_curl;
      TCGv_i64 t_true, t_false, t_zero;
      DisasCompare64 c;
 +    TCGMemOp sz;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      rd = extract32(insn, 0, 5);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        sz = MO_32;
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
-         return;
+-    curl_easy_setopt(curl, CURLOPT_URL, url);
 -    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL);
 -    curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
 -    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
 -    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0);
 -
 -    if (curl_easy_perform(curl) != CURLE_OK) {
 -        err = 1;
 -        fclose(file);
 +    if (curl_easy_setopt(curl, CURLOPT_URL, url) != CURLE_OK
 +            || curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL) != CURLE_OK
 +            || curl_easy_setopt(curl, CURLOPT_WRITEDATA, file) != CURLE_OK
 +            || curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1) != CURLE_OK
 +            || curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK
 +            || curl_easy_perform(curl) != CURLE_OK) {
          unlink(name);
 -        goto out_curl;
 +        fclose(file);
 +        err = 1;
 +    } else {
 +        err = fclose(file);
      }
--    /* Zero extend sreg inputs to 64 bits now.  */
+-    err = fclose(file);
-+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
+-
-     t_true = tcg_temp_new_i64();
+ out_curl:
-     t_false = tcg_temp_new_i64();
+     curl_easy_cleanup(curl);
--    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
 -    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
 +    read_vec_element(s, t_true, rn, 0, sz);
 +    read_vec_element(s, t_false, rm, 0, sz);
      a64_test_cc(&c, cond);
      t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.17.0
+.20.1

-New patch
+[PULL 02/27] elf2dmp: Fail cleanly if PDB file specifies zero block_size
+Coverity points out that if the PDB file we're trying to read
+has a header specifying a block_size of zero then we will
+end up trying to divide by zero in pdb_ds_read_file().
+Check for this and fail cleanly instead.
+Fixes: Coverity CID 1458869
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
+Message-id: 20210910170656.366592-3-philmd@redhat.com
+Message-Id: <20210901143910.17112-3-peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+---
+ contrib/elf2dmp/pdb.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/elf2dmp/pdb.c
++++ b/contrib/elf2dmp/pdb.c
+@@ -XXX,XX +XXX,XX @@ out_symbols:
+ static int pdb_reader_ds_init(struct pdb_reader *r, PDB_DS_HEADER *hdr)
+ {
++    if (hdr->block_size == 0) {
++        return 1;
++    }
++
+     memset(r->file_used, 0, sizeof(r->file_used));
+     r->ds.header = hdr;
+     r->ds.toc = pdb_ds_read(hdr, (uint32_t *)((uint8_t *)hdr +
+--
+.20.1

-New patch
+[PULL 03/27] target/arm: Don't skip M-profile reset entirely in user mode
+Currently all of the M-profile specific code in arm_cpu_reset() is
+inside a !defined(CONFIG_USER_ONLY) ifdef block.  This is
+unintentional: it happened because originally the only
+M-profile-specific handling was the setup of the initial SP and PC
+from the vector table, which is system-emulation only.  But then we
+added a lot of other M-profile setup to the same "if (ARM_FEATURE_M)"
+code block without noticing that it was all inside a not-user-mode
+ifdef.  This has generally been harmless, but with the addition of
+v8.1M low-overhead-loop support we ran into a problem: the reset of
+FPSCR.LTPSIZE to 4 was only being done for system emulation mode, so
+if a user-mode guest tried to execute the LE instruction it would
+incorrectly take a UsageFault.
+Adjust the ifdefs so only the really system-emulation specific parts
+are covered.  Because this means we now run some reset code that sets
+up initial values in the FPCCR and similar FPU related registers,
+explicitly set up the registers controlling FPU context handling in
+user-emulation mode so that the FPU works by design and not by
+chance.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/613
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210914120725.24992-2-peter.maydell@linaro.org
+---
+ target/arm/cpu.c | 19 +++++++++++++++++++
+file changed, 19 insertions(+)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+         env->uncached_cpsr = ARM_CPU_MODE_SVC;
+     }
+     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
++#endif
+     if (arm_feature(env, ARM_FEATURE_M)) {
++#ifndef CONFIG_USER_ONLY
+         uint32_t initial_msp; /* Loaded from 0x0 */
+         uint32_t initial_pc; /* Loaded from 0x4 */
+         uint8_t *rom;
+         uint32_t vecbase;
++#endif
+         if (cpu_isar_feature(aa32_lob, cpu)) {
+             /*
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
+                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
+         }
++
++#ifndef CONFIG_USER_ONLY
+         /* Unlike A/R profile, M profile defines the reset LR value */
+         env->regs[14] = 0xffffffff;
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+         env->regs[13] = initial_msp & 0xFFFFFFFC;
+         env->regs[15] = initial_pc & ~1;
+         env->thumb = initial_pc & 1;
++#else
++        /*
++         * For user mode we run non-secure and with access to the FPU.
++         * The FPU context is active (ie does not need further setup)
++         * and is owned by non-secure.
++         */
++        env->v7m.secure = false;
++        env->v7m.nsacr = 0xcff;
++        env->v7m.cpacr[M_REG_NS] = 0xf0ffff;
++        env->v7m.fpccr[M_REG_S] &=
++            ~(R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK);
++        env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
++#endif
+     }
++#ifndef CONFIG_USER_ONLY
+     /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
+      * executing as AArch32 then check if highvecs are enabled and
+      * adjust the PC accordingly.
+--
+.20.1

-New patch
+[PULL 04/27] target/arm: Always clear exclusive monitor on reset
+There's no particular reason why the exclusive monitor should
+be only cleared on reset in system emulation mode. It doesn't
+hurt if it isn't cleared in user mode, but we might as well
+reduce the amount of code we have that's inside an ifdef.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210914120725.24992-3-peter.maydell@linaro.org
+---
+ target/arm/cpu.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+         env->regs[15] = 0xFFFF0000;
+     }
++    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
++#endif
++
+     /* M profile requires that reset clears the exclusive monitor;
+      * A profile does not, but clearing it makes more sense than having it
+      * set with an exclusive access on address zero.
+      */
+     arm_clear_exclusive(env);
+-    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
+-#endif
+-
+     if (arm_feature(env, ARM_FEATURE_PMSA)) {
+         if (cpu->pmsav7_dregion > 0) {
+             if (arm_feature(env, ARM_FEATURE_V8)) {
+--
+.20.1

-[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+[PULL 05/27] target/arm: Consolidate ifdef blocks in reset
-In commit d81ce0ef2c4f105 we added an extra float_status field
+Move an ifndef CONFIG_USER_ONLY code block up in arm_cpu_reset() so
-fp_status_fp16 for Arm, but forgot to initialize it correctly
+it can be merged with another earlier one.
 by setting it to float_tininess_before_rounding. This currently
 will only cause problems for the new V8_FP16 feature, since the
 float-to-float conversion code doesn't use it yet. The effect
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-Add the missing initialization.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Fixes: d81ce0ef2c4f105
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20210914120725.24992-4-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
- target/arm/cpu.c | 2 ++
+ target/arm/cpu.c | 22 ++++++++++------------
-file changed, 2 insertions(+)
+file changed, 10 insertions(+), 12 deletions(-)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
-                               &env->vfp.fp_status);
+         env->uncached_cpsr = ARM_CPU_MODE_SVC;
-     set_float_detect_tininess(float_tininess_before_rounding,
+     }
-                               &env->vfp.standard_fp_status);
+     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
-+    set_float_detect_tininess(float_tininess_before_rounding,
++
-+                              &env->vfp.fp_status_f16);
++    /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
- #ifndef CONFIG_USER_ONLY
++     * executing as AArch32 then check if highvecs are enabled and
-     if (kvm_enabled()) {
++     * adjust the PC accordingly.
-         kvm_arm_reset_vcpu(cpu);
++     */
 +    if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
 +        env->regs[15] = 0xFFFF0000;
 +    }
 +
 +    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
  #endif
      if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
  #endif
      }
 -#ifndef CONFIG_USER_ONLY
 -    /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
 -     * executing as AArch32 then check if highvecs are enabled and
 -     * adjust the PC accordingly.
 -     */
 -    if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
 -        env->regs[15] = 0xFFFF0000;
 -    }
 -
 -    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 -#endif
 -
      /* M profile requires that reset clears the exclusive monitor;
       * A profile does not, but clearing it makes more sense than having it
       * set with an exclusive access on address zero.
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+[PULL 06/27] hw/intc: Set GIC maintenance interrupt level to only 0 or 1
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Shashi Mallela <shashi.mallela@linaro.org>
-Adding the fp16 moves to/from general registers.
+During sbsa acs level 3 testing, it is seen that the GIC maintenance
 interrupts are not triggered and the related test cases fail.  This
 is because we were incorrectly passing the value of the MISR register
 (from maintenance_interrupt_state()) to qemu_set_irq() as the level
 argument, whereas the device on the other end of this irq line
 expects a 0/1 value.
-Cc: qemu-stable@nongnu.org
+Fix the logic to pass a 0/1 level indication, rather than a
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+/not-0 value.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
+Fixes: c5fc89b36c0 ("hw/intc/arm_gicv3: Implement gicv3_cpuif_virt_update()")
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210915205809.59068-1-shashi.mallela@linaro.org
 [PMM: tweaked commit message; collapsed nested if()s into one]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 21 +++++++++++++++++++++
+ hw/intc/arm_gicv3_cpuif.c | 5 +++--
-file changed, 21 insertions(+)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+@@ -XXX,XX +XXX,XX @@ static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
              tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
              clear_vec_high(s, true, rd);
              break;
 +        case 3:
 +            /* 16 bit */
 +            tmp = tcg_temp_new_i64();
 +            tcg_gen_ext16u_i64(tmp, tcg_rn);
 +            write_fp_dreg(s, rd, tmp);
 +            tcg_temp_free_i64(tmp);
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
- }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+-    if (cs->ich_hcr_el2 & ICH_HCR_EL2_EN) {
-         case 0xa: /* 64 bit */
+-        maintlevel = maintenance_interrupt_state(cs);
-         case 0xd: /* 64 bit to top half of quad */
++    if ((cs->ich_hcr_el2 & ICH_HCR_EL2_EN) &&
-             break;
++        maintenance_interrupt_state(cs) != 0) {
-+        case 0x6: /* 16-bit float, 32-bit int */
++        maintlevel = 1;
-+        case 0xe: /* 16-bit float, 64-bit int */
+     }
-+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
-+                break;
+     trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+[PULL 07/27] arm: Move PMC register definitions to internals.h
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alexander Graf <agraf@csgraf.de>
-No sense in emitting code after the exception.
+We will need PMC register definitions in accel specific code later.
 Move all constant definitions to common arm headers so we can reuse
 them.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210916155404.86958-2-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ target/arm/internals.h | 44 ++++++++++++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/helper.c    | 44 ------------------------------------------
 files changed, 44 insertions(+), 44 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/internals.h
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ enum MVEECIState {
-         default:
+     /* All other values reserved */
-             /* all other sf/type/rmode combinations are invalid */
+ };
-             unallocated_encoding(s);
--            break;
++/* Definitions for the PMU registers */
-+            return;
++#define PMCRN_MASK  0xf800
-         }
++#define PMCRN_SHIFT 11
++#define PMCRLC  0x40
-         if (!fp_access_check(s)) {
++#define PMCRDP  0x20
 +#define PMCRX   0x10
 +#define PMCRD   0x8
 +#define PMCRC   0x4
 +#define PMCRP   0x2
 +#define PMCRE   0x1
 +/*
 + * Mask of PMCR bits writeable by guest (not including WO bits like C, P,
 + * which can be written as 1 to trigger behaviour but which stay RAZ).
 + */
 +#define PMCR_WRITEABLE_MASK (PMCRLC | PMCRDP | PMCRX | PMCRD | PMCRE)
 +
 +#define PMXEVTYPER_P          0x80000000
 +#define PMXEVTYPER_U          0x40000000
 +#define PMXEVTYPER_NSK        0x20000000
 +#define PMXEVTYPER_NSU        0x10000000
 +#define PMXEVTYPER_NSH        0x08000000
 +#define PMXEVTYPER_M          0x04000000
 +#define PMXEVTYPER_MT         0x02000000
 +#define PMXEVTYPER_EVTCOUNT   0x0000ffff
 +#define PMXEVTYPER_MASK       (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
 +                               PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
 +                               PMXEVTYPER_M | PMXEVTYPER_MT | \
 +                               PMXEVTYPER_EVTCOUNT)
 +
 +#define PMCCFILTR             0xf8000000
 +#define PMCCFILTR_M           PMXEVTYPER_M
 +#define PMCCFILTR_EL0         (PMCCFILTR | PMCCFILTR_M)
 +
 +static inline uint32_t pmu_num_counters(CPUARMState *env)
 +{
 +  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
 +}
 +
 +/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
 +static inline uint64_t pmu_counter_mask(CPUARMState *env)
 +{
 +  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
 +}
 +
  #endif
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
      REGINFO_SENTINEL
  };
 -/* Definitions for the PMU registers */
 -#define PMCRN_MASK  0xf800
 -#define PMCRN_SHIFT 11
 -#define PMCRLC  0x40
 -#define PMCRDP  0x20
 -#define PMCRX   0x10
 -#define PMCRD   0x8
 -#define PMCRC   0x4
 -#define PMCRP   0x2
 -#define PMCRE   0x1
 -/*
 - * Mask of PMCR bits writeable by guest (not including WO bits like C, P,
 - * which can be written as 1 to trigger behaviour but which stay RAZ).
 - */
 -#define PMCR_WRITEABLE_MASK (PMCRLC | PMCRDP | PMCRX | PMCRD | PMCRE)
 -
 -#define PMXEVTYPER_P          0x80000000
 -#define PMXEVTYPER_U          0x40000000
 -#define PMXEVTYPER_NSK        0x20000000
 -#define PMXEVTYPER_NSU        0x10000000
 -#define PMXEVTYPER_NSH        0x08000000
 -#define PMXEVTYPER_M          0x04000000
 -#define PMXEVTYPER_MT         0x02000000
 -#define PMXEVTYPER_EVTCOUNT   0x0000ffff
 -#define PMXEVTYPER_MASK       (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
 -                               PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
 -                               PMXEVTYPER_M | PMXEVTYPER_MT | \
 -                               PMXEVTYPER_EVTCOUNT)
 -
 -#define PMCCFILTR             0xf8000000
 -#define PMCCFILTR_M           PMXEVTYPER_M
 -#define PMCCFILTR_EL0         (PMCCFILTR | PMCCFILTR_M)
 -
 -static inline uint32_t pmu_num_counters(CPUARMState *env)
 -{
 -  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
 -}
 -
 -/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
 -static inline uint64_t pmu_counter_mask(CPUARMState *env)
 -{
 -  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
 -}
 -
  typedef struct pm_event {
      uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
      /* If the event is supported on this CPU (used to generate PMCEID[01]) */
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+[PULL 08/27] hvf: Add execute to dirty log permission bitmap
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Alexander Graf <agraf@csgraf.de>
-Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+Hvf's permission bitmap during and after dirty logging does not include
 the HV_MEMORY_EXEC permission. At least on Apple Silicon, this leads to
 instruction faults once dirty logging was enabled.
-  The block length is predefined to 512 bits
+Add the bit to make it work properly.
-and "4.10.2 SD Status":
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
   The SD Status contains status bits that are related to the SD Memory Card
   proprietary features and may be used for future application-specific usage.
   The size of the SD Status is one data block of 512 bit. The content of this
   register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
 Thus the 16-bit CRC goes at offset 64.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210916155404.86958-3-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 2 +-
+ accel/hvf/hvf-accel-ops.c | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/accel/hvf/hvf-accel-ops.c
-+++ b/hw/sd/sd.c
++++ b/accel/hvf/hvf-accel-ops.c
-@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+@@ -XXX,XX +XXX,XX @@ static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
-         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+     if (on) {
          slot->flags |= HVF_SLOT_LOG;
          hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
 -                      HV_MEMORY_READ);
 +                      HV_MEMORY_READ | HV_MEMORY_EXEC);
      /* stop tracking region*/
      } else {
          slot->flags &= ~HVF_SLOT_LOG;
          hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
 -                      HV_MEMORY_READ | HV_MEMORY_WRITE);
 +                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
      }
-     memset(&sd->data[17], 0, 47);
--    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
-+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
  }
- static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
+[PULL 09/27] hvf: Introduce hvf_arch_init() callback
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alexander Graf <agraf@csgraf.de>
-We missed all of the scalar fp16 fma operations.
+We will need to install a migration helper for the ARM hvf backend.
 Let's introduce an arch callback for the overall hvf init chain to
 do so.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210916155404.86958-4-agraf@csgraf.de
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
+ include/sysemu/hvf_int.h  | 1 +
-file changed, 48 insertions(+)
+ accel/hvf/hvf-accel-ops.c | 3 ++-
  target/i386/hvf/hvf.c     | 5 +++++
 files changed, 8 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/sysemu/hvf_int.h
-+++ b/target/arm/translate-a64.c
++++ b/include/sysemu/hvf_int.h
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
+@@ -XXX,XX +XXX,XX @@ struct hvf_vcpu_state {
-     tcg_temp_free_i64(tcg_res);
+ };
  void assert_hvf_ok(hv_return_t ret);
 +int hvf_arch_init(void);
  int hvf_arch_init_vcpu(CPUState *cpu);
  void hvf_arch_vcpu_destroy(CPUState *cpu);
  int hvf_vcpu_exec(CPUState *);
 diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/hvf/hvf-accel-ops.c
 +++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
      hvf_state = s;
      memory_listener_register(&hvf_memory_listener, &address_space_memory);
 -    return 0;
 +
 +    return hvf_arch_init();
  }
-+/* Floating-point data-processing (3 source) - half precision */
+ static void hvf_accel_class_init(ObjectClass *oc, void *data)
-+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
-+                                int rd, int rn, int rm, int ra)
+index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static inline bool apic_bus_freq_is_known(CPUX86State *env)
      return env->apic_bus_freq != 0;
  }
 +int hvf_arch_init(void)
 +{
-+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
++    return 0;
 +    TCGv_i32 tcg_res = tcg_temp_new_i32();
 +    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
 +    tcg_op3 = read_fp_hreg(s, ra);
 +
 +    /* These are fused multiply-add, and must be done as one
 +     * floating point operation with no rounding between the
 +     * multiplication and addition steps.
 +     * NB that doing the negations here as separate steps is
 +     * correct : an input NaN should come out with its sign bit
 +     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
 +    if (o0 != o1) {
 +        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
 +    }
 +
 +    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- /* Floating point data-processing (3 source)
+ int hvf_arch_init_vcpu(CPUState *cpu)
-  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
+ {
-  * +---+---+---+-----------+------+----+------+----+------+------+------+
+     X86CPU *x86cpu = X86_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
          }
          handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
          break;
 +    case 3:
 +        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        if (!fp_access_check(s)) {
 +            return;
 +        }
 +        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
 +        break;
      default:
          unallocated_encoding(s);
      }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+[PULL 10/27] hvf: Add Apple Silicon support
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alexander Graf <agraf@csgraf.de>
-Cc: qemu-stable@nongnu.org
+With Apple Silicon available to the masses, it's a good time to add support
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+for driving its virtualization extensions from QEMU.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+This patch adds all necessary architecture specific code to get basic VMs
-Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
+working, including save/restore.
 Known limitations:
   - WFI handling is missing (follows in later patch)
   - No watchpoint/breakpoint support
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210916155404.86958-5-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 17 +++++++++++++++--
+ meson.build                 |   1 +
-file changed, 15 insertions(+), 2 deletions(-)
+ include/sysemu/hvf_int.h    |  10 +-
  accel/hvf/hvf-accel-ops.c   |   9 +
  target/arm/hvf/hvf.c        | 794 ++++++++++++++++++++++++++++++++++++
  target/i386/hvf/hvf.c       |   5 +
  MAINTAINERS                 |   5 +
  target/arm/hvf/trace-events |  10 +
 files changed, 833 insertions(+), 1 deletion(-)
  create mode 100644 target/arm/hvf/hvf.c
  create mode 100644 target/arm/hvf/trace-events
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/meson.build
-+++ b/target/arm/translate-a64.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ if have_system or have_user
-     bool sf = extract32(insn, 31, 1);
+     'accel/tcg',
-     bool itof;
+     'hw/core',
+     'target/arm',
--    if (sbit || (type > 1)
++    'target/arm/hvf',
--        || (!sf && scale < 32)) {
+     'target/hppa',
-+    if (sbit || (!sf && scale < 32)) {
+     'target/i386',
-+        unallocated_encoding(s);
+     'target/i386/kvm',
 diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/sysemu/hvf_int.h
 +++ b/include/sysemu/hvf_int.h
@@ -XXX,XX +XXX,XX @@
  #ifndef HVF_INT_H
  #define HVF_INT_H
 +#ifdef __aarch64__
 +#include <Hypervisor/Hypervisor.h>
 +#else
  #include <Hypervisor/hv.h>
 +#endif
  /* hvf_slot flags */
  #define HVF_SLOT_LOG (1 << 0)
@@ -XXX,XX +XXX,XX @@ struct HVFState {
      int num_slots;
      hvf_vcpu_caps *hvf_caps;
 +    uint64_t vtimer_offset;
  };
  extern HVFState *hvf_state;
  struct hvf_vcpu_state {
 -    int fd;
 +    uint64_t fd;
 +    void *exit;
 +    bool vtimer_masked;
  };
  void assert_hvf_ok(hv_return_t ret);
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *);
  hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
  int hvf_put_registers(CPUState *);
  int hvf_get_registers(CPUState *);
 +void hvf_kick_vcpu_thread(CPUState *cpu);
  #endif
 diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/hvf/hvf-accel-ops.c
 +++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
  HVFState *hvf_state;
 +#ifdef __aarch64__
 +#define HV_VM_DEFAULT NULL
 +#endif
 +
  /* Memory slots */
  hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
@@ -XXX,XX +XXX,XX @@ static int hvf_init_vcpu(CPUState *cpu)
      pthread_sigmask(SIG_BLOCK, NULL, &set);
      sigdelset(&set, SIG_IPI);
 +#ifdef __aarch64__
 +    r = hv_vcpu_create(&cpu->hvf->fd, (hv_vcpu_exit_t **)&cpu->hvf->exit, NULL);
 +#else
      r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf->fd, HV_VCPU_DEFAULT);
 +#endif
      cpu->vcpu_dirty = 1;
      assert_hvf_ok(r);
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
      AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
      ops->create_vcpu_thread = hvf_start_vcpu_thread;
 +    ops->kick_vcpu_thread = hvf_kick_vcpu_thread;
      ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
      ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU Hypervisor.framework support for Apple Silicon
 +
 + * Copyright 2020 Alexander Graf <agraf@csgraf.de>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu-common.h"
 +#include "qemu/error-report.h"
 +
 +#include "sysemu/runstate.h"
 +#include "sysemu/hvf.h"
 +#include "sysemu/hvf_int.h"
 +#include "sysemu/hw_accel.h"
 +
 +#include <mach/mach_time.h>
 +
 +#include "exec/address-spaces.h"
 +#include "hw/irq.h"
 +#include "qemu/main-loop.h"
 +#include "sysemu/cpus.h"
 +#include "target/arm/cpu.h"
 +#include "target/arm/internals.h"
 +#include "trace/trace-target_arm_hvf.h"
 +#include "migration/vmstate.h"
 +
 +#define HVF_SYSREG(crn, crm, op0, op1, op2) \
 +        ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
 +#define PL1_WRITE_MASK 0x4
 +
 +#define SYSREG(op0, op1, crn, crm, op2) \
 +    ((op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (crm << 1))
 +#define SYSREG_MASK           SYSREG(0x3, 0x7, 0xf, 0xf, 0x7)
 +#define SYSREG_OSLAR_EL1      SYSREG(2, 0, 1, 0, 4)
 +#define SYSREG_OSLSR_EL1      SYSREG(2, 0, 1, 1, 4)
 +#define SYSREG_OSDLR_EL1      SYSREG(2, 0, 1, 3, 4)
 +#define SYSREG_CNTPCT_EL0     SYSREG(3, 3, 14, 0, 1)
 +
 +#define WFX_IS_WFE (1 << 0)
 +
 +#define TMR_CTL_ENABLE  (1 << 0)
 +#define TMR_CTL_IMASK   (1 << 1)
 +#define TMR_CTL_ISTATUS (1 << 2)
 +
 +typedef struct HVFVTimer {
 +    /* Vtimer value during migration and paused state */
 +    uint64_t vtimer_val;
 +} HVFVTimer;
 +
 +static HVFVTimer vtimer;
 +
 +struct hvf_reg_match {
 +    int reg;
 +    uint64_t offset;
 +};
 +
 +static const struct hvf_reg_match hvf_reg_match[] = {
 +    { HV_REG_X0,   offsetof(CPUARMState, xregs[0]) },
 +    { HV_REG_X1,   offsetof(CPUARMState, xregs[1]) },
 +    { HV_REG_X2,   offsetof(CPUARMState, xregs[2]) },
 +    { HV_REG_X3,   offsetof(CPUARMState, xregs[3]) },
 +    { HV_REG_X4,   offsetof(CPUARMState, xregs[4]) },
 +    { HV_REG_X5,   offsetof(CPUARMState, xregs[5]) },
 +    { HV_REG_X6,   offsetof(CPUARMState, xregs[6]) },
 +    { HV_REG_X7,   offsetof(CPUARMState, xregs[7]) },
 +    { HV_REG_X8,   offsetof(CPUARMState, xregs[8]) },
 +    { HV_REG_X9,   offsetof(CPUARMState, xregs[9]) },
 +    { HV_REG_X10,  offsetof(CPUARMState, xregs[10]) },
 +    { HV_REG_X11,  offsetof(CPUARMState, xregs[11]) },
 +    { HV_REG_X12,  offsetof(CPUARMState, xregs[12]) },
 +    { HV_REG_X13,  offsetof(CPUARMState, xregs[13]) },
 +    { HV_REG_X14,  offsetof(CPUARMState, xregs[14]) },
 +    { HV_REG_X15,  offsetof(CPUARMState, xregs[15]) },
 +    { HV_REG_X16,  offsetof(CPUARMState, xregs[16]) },
 +    { HV_REG_X17,  offsetof(CPUARMState, xregs[17]) },
 +    { HV_REG_X18,  offsetof(CPUARMState, xregs[18]) },
 +    { HV_REG_X19,  offsetof(CPUARMState, xregs[19]) },
 +    { HV_REG_X20,  offsetof(CPUARMState, xregs[20]) },
 +    { HV_REG_X21,  offsetof(CPUARMState, xregs[21]) },
 +    { HV_REG_X22,  offsetof(CPUARMState, xregs[22]) },
 +    { HV_REG_X23,  offsetof(CPUARMState, xregs[23]) },
 +    { HV_REG_X24,  offsetof(CPUARMState, xregs[24]) },
 +    { HV_REG_X25,  offsetof(CPUARMState, xregs[25]) },
 +    { HV_REG_X26,  offsetof(CPUARMState, xregs[26]) },
 +    { HV_REG_X27,  offsetof(CPUARMState, xregs[27]) },
 +    { HV_REG_X28,  offsetof(CPUARMState, xregs[28]) },
 +    { HV_REG_X29,  offsetof(CPUARMState, xregs[29]) },
 +    { HV_REG_X30,  offsetof(CPUARMState, xregs[30]) },
 +    { HV_REG_PC,   offsetof(CPUARMState, pc) },
 +};
 +
 +static const struct hvf_reg_match hvf_fpreg_match[] = {
 +    { HV_SIMD_FP_REG_Q0,  offsetof(CPUARMState, vfp.zregs[0]) },
 +    { HV_SIMD_FP_REG_Q1,  offsetof(CPUARMState, vfp.zregs[1]) },
 +    { HV_SIMD_FP_REG_Q2,  offsetof(CPUARMState, vfp.zregs[2]) },
 +    { HV_SIMD_FP_REG_Q3,  offsetof(CPUARMState, vfp.zregs[3]) },
 +    { HV_SIMD_FP_REG_Q4,  offsetof(CPUARMState, vfp.zregs[4]) },
 +    { HV_SIMD_FP_REG_Q5,  offsetof(CPUARMState, vfp.zregs[5]) },
 +    { HV_SIMD_FP_REG_Q6,  offsetof(CPUARMState, vfp.zregs[6]) },
 +    { HV_SIMD_FP_REG_Q7,  offsetof(CPUARMState, vfp.zregs[7]) },
 +    { HV_SIMD_FP_REG_Q8,  offsetof(CPUARMState, vfp.zregs[8]) },
 +    { HV_SIMD_FP_REG_Q9,  offsetof(CPUARMState, vfp.zregs[9]) },
 +    { HV_SIMD_FP_REG_Q10, offsetof(CPUARMState, vfp.zregs[10]) },
 +    { HV_SIMD_FP_REG_Q11, offsetof(CPUARMState, vfp.zregs[11]) },
 +    { HV_SIMD_FP_REG_Q12, offsetof(CPUARMState, vfp.zregs[12]) },
 +    { HV_SIMD_FP_REG_Q13, offsetof(CPUARMState, vfp.zregs[13]) },
 +    { HV_SIMD_FP_REG_Q14, offsetof(CPUARMState, vfp.zregs[14]) },
 +    { HV_SIMD_FP_REG_Q15, offsetof(CPUARMState, vfp.zregs[15]) },
 +    { HV_SIMD_FP_REG_Q16, offsetof(CPUARMState, vfp.zregs[16]) },
 +    { HV_SIMD_FP_REG_Q17, offsetof(CPUARMState, vfp.zregs[17]) },
 +    { HV_SIMD_FP_REG_Q18, offsetof(CPUARMState, vfp.zregs[18]) },
 +    { HV_SIMD_FP_REG_Q19, offsetof(CPUARMState, vfp.zregs[19]) },
 +    { HV_SIMD_FP_REG_Q20, offsetof(CPUARMState, vfp.zregs[20]) },
 +    { HV_SIMD_FP_REG_Q21, offsetof(CPUARMState, vfp.zregs[21]) },
 +    { HV_SIMD_FP_REG_Q22, offsetof(CPUARMState, vfp.zregs[22]) },
 +    { HV_SIMD_FP_REG_Q23, offsetof(CPUARMState, vfp.zregs[23]) },
 +    { HV_SIMD_FP_REG_Q24, offsetof(CPUARMState, vfp.zregs[24]) },
 +    { HV_SIMD_FP_REG_Q25, offsetof(CPUARMState, vfp.zregs[25]) },
 +    { HV_SIMD_FP_REG_Q26, offsetof(CPUARMState, vfp.zregs[26]) },
 +    { HV_SIMD_FP_REG_Q27, offsetof(CPUARMState, vfp.zregs[27]) },
 +    { HV_SIMD_FP_REG_Q28, offsetof(CPUARMState, vfp.zregs[28]) },
 +    { HV_SIMD_FP_REG_Q29, offsetof(CPUARMState, vfp.zregs[29]) },
 +    { HV_SIMD_FP_REG_Q30, offsetof(CPUARMState, vfp.zregs[30]) },
 +    { HV_SIMD_FP_REG_Q31, offsetof(CPUARMState, vfp.zregs[31]) },
 +};
 +
 +struct hvf_sreg_match {
 +    int reg;
 +    uint32_t key;
 +    uint32_t cp_idx;
 +};
 +
 +static struct hvf_sreg_match hvf_sreg_match[] = {
 +    { HV_SYS_REG_DBGBVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 7) },
 +
 +    { HV_SYS_REG_DBGBVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 4) },
 +    { HV_SYS_REG_DBGBCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 5) },
 +    { HV_SYS_REG_DBGWVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 6) },
 +    { HV_SYS_REG_DBGWCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 7) },
 +
 +#ifdef SYNC_NO_RAW_REGS
 +    /*
 +     * The registers below are manually synced on init because they are
 +     * marked as NO_RAW. We still list them to make number space sync easier.
 +     */
 +    { HV_SYS_REG_MDCCINT_EL1, HVF_SYSREG(0, 2, 2, 0, 0) },
 +    { HV_SYS_REG_MIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 0) },
 +    { HV_SYS_REG_MPIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 5) },
 +    { HV_SYS_REG_ID_AA64PFR0_EL1, HVF_SYSREG(0, 4, 3, 0, 0) },
 +#endif
 +    { HV_SYS_REG_ID_AA64PFR1_EL1, HVF_SYSREG(0, 4, 3, 0, 2) },
 +    { HV_SYS_REG_ID_AA64DFR0_EL1, HVF_SYSREG(0, 5, 3, 0, 0) },
 +    { HV_SYS_REG_ID_AA64DFR1_EL1, HVF_SYSREG(0, 5, 3, 0, 1) },
 +    { HV_SYS_REG_ID_AA64ISAR0_EL1, HVF_SYSREG(0, 6, 3, 0, 0) },
 +    { HV_SYS_REG_ID_AA64ISAR1_EL1, HVF_SYSREG(0, 6, 3, 0, 1) },
 +#ifdef SYNC_NO_MMFR0
 +    /* We keep the hardware MMFR0 around. HW limits are there anyway */
 +    { HV_SYS_REG_ID_AA64MMFR0_EL1, HVF_SYSREG(0, 7, 3, 0, 0) },
 +#endif
 +    { HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) },
 +    { HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) },
 +
 +    { HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) },
 +    { HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) },
 +    { HV_SYS_REG_CPACR_EL1, HVF_SYSREG(1, 0, 3, 0, 2) },
 +    { HV_SYS_REG_TTBR0_EL1, HVF_SYSREG(2, 0, 3, 0, 0) },
 +    { HV_SYS_REG_TTBR1_EL1, HVF_SYSREG(2, 0, 3, 0, 1) },
 +    { HV_SYS_REG_TCR_EL1, HVF_SYSREG(2, 0, 3, 0, 2) },
 +
 +    { HV_SYS_REG_APIAKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 0) },
 +    { HV_SYS_REG_APIAKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 1) },
 +    { HV_SYS_REG_APIBKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 2) },
 +    { HV_SYS_REG_APIBKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 3) },
 +    { HV_SYS_REG_APDAKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 0) },
 +    { HV_SYS_REG_APDAKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 1) },
 +    { HV_SYS_REG_APDBKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 2) },
 +    { HV_SYS_REG_APDBKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 3) },
 +    { HV_SYS_REG_APGAKEYLO_EL1, HVF_SYSREG(2, 3, 3, 0, 0) },
 +    { HV_SYS_REG_APGAKEYHI_EL1, HVF_SYSREG(2, 3, 3, 0, 1) },
 +
 +    { HV_SYS_REG_SPSR_EL1, HVF_SYSREG(4, 0, 3, 0, 0) },
 +    { HV_SYS_REG_ELR_EL1, HVF_SYSREG(4, 0, 3, 0, 1) },
 +    { HV_SYS_REG_SP_EL0, HVF_SYSREG(4, 1, 3, 0, 0) },
 +    { HV_SYS_REG_AFSR0_EL1, HVF_SYSREG(5, 1, 3, 0, 0) },
 +    { HV_SYS_REG_AFSR1_EL1, HVF_SYSREG(5, 1, 3, 0, 1) },
 +    { HV_SYS_REG_ESR_EL1, HVF_SYSREG(5, 2, 3, 0, 0) },
 +    { HV_SYS_REG_FAR_EL1, HVF_SYSREG(6, 0, 3, 0, 0) },
 +    { HV_SYS_REG_PAR_EL1, HVF_SYSREG(7, 4, 3, 0, 0) },
 +    { HV_SYS_REG_MAIR_EL1, HVF_SYSREG(10, 2, 3, 0, 0) },
 +    { HV_SYS_REG_AMAIR_EL1, HVF_SYSREG(10, 3, 3, 0, 0) },
 +    { HV_SYS_REG_VBAR_EL1, HVF_SYSREG(12, 0, 3, 0, 0) },
 +    { HV_SYS_REG_CONTEXTIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 1) },
 +    { HV_SYS_REG_TPIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 4) },
 +    { HV_SYS_REG_CNTKCTL_EL1, HVF_SYSREG(14, 1, 3, 0, 0) },
 +    { HV_SYS_REG_CSSELR_EL1, HVF_SYSREG(0, 0, 3, 2, 0) },
 +    { HV_SYS_REG_TPIDR_EL0, HVF_SYSREG(13, 0, 3, 3, 2) },
 +    { HV_SYS_REG_TPIDRRO_EL0, HVF_SYSREG(13, 0, 3, 3, 3) },
 +    { HV_SYS_REG_CNTV_CTL_EL0, HVF_SYSREG(14, 3, 3, 3, 1) },
 +    { HV_SYS_REG_CNTV_CVAL_EL0, HVF_SYSREG(14, 3, 3, 3, 2) },
 +    { HV_SYS_REG_SP_EL1, HVF_SYSREG(4, 1, 3, 4, 0) },
 +};
 +
 +int hvf_get_registers(CPUState *cpu)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +    hv_return_t ret;
 +    uint64_t val;
 +    hv_simd_fp_uchar16_t fpval;
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
 +        ret = hv_vcpu_get_reg(cpu->hvf->fd, hvf_reg_match[i].reg, &val);
 +        *(uint64_t *)((void *)env + hvf_reg_match[i].offset) = val;
 +        assert_hvf_ok(ret);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
 +        ret = hv_vcpu_get_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
 +                                      &fpval);
 +        memcpy((void *)env + hvf_fpreg_match[i].offset, &fpval, sizeof(fpval));
 +        assert_hvf_ok(ret);
 +    }
 +
 +    val = 0;
 +    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPCR, &val);
 +    assert_hvf_ok(ret);
 +    vfp_set_fpcr(env, val);
 +
 +    val = 0;
 +    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPSR, &val);
 +    assert_hvf_ok(ret);
 +    vfp_set_fpsr(env, val);
 +
 +    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_CPSR, &val);
 +    assert_hvf_ok(ret);
 +    pstate_write(env, val);
 +
 +    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
 +        if (hvf_sreg_match[i].cp_idx == -1) {
 +            continue;
 +        }
 +
 +        ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, &val);
 +        assert_hvf_ok(ret);
 +
 +        arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
 +    }
 +    assert(write_list_to_cpustate(arm_cpu));
 +
 +    aarch64_restore_sp(env, arm_current_el(env));
 +
 +    return 0;
 +}
 +
 +int hvf_put_registers(CPUState *cpu)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +    hv_return_t ret;
 +    uint64_t val;
 +    hv_simd_fp_uchar16_t fpval;
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
 +        val = *(uint64_t *)((void *)env + hvf_reg_match[i].offset);
 +        ret = hv_vcpu_set_reg(cpu->hvf->fd, hvf_reg_match[i].reg, val);
 +        assert_hvf_ok(ret);
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
 +        memcpy(&fpval, (void *)env + hvf_fpreg_match[i].offset, sizeof(fpval));
 +        ret = hv_vcpu_set_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
 +                                      fpval);
 +        assert_hvf_ok(ret);
 +    }
 +
 +    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPCR, vfp_get_fpcr(env));
 +    assert_hvf_ok(ret);
 +
 +    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPSR, vfp_get_fpsr(env));
 +    assert_hvf_ok(ret);
 +
 +    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_CPSR, pstate_read(env));
 +    assert_hvf_ok(ret);
 +
 +    aarch64_save_sp(env, arm_current_el(env));
 +
 +    assert(write_cpustate_to_list(arm_cpu, false));
 +    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
 +        if (hvf_sreg_match[i].cp_idx == -1) {
 +            continue;
 +        }
 +
 +        val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx];
 +        ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, val);
 +        assert_hvf_ok(ret);
 +    }
 +
 +    ret = hv_vcpu_set_vtimer_offset(cpu->hvf->fd, hvf_state->vtimer_offset);
 +    assert_hvf_ok(ret);
 +
 +    return 0;
 +}
 +
 +static void flush_cpu_state(CPUState *cpu)
 +{
 +    if (cpu->vcpu_dirty) {
 +        hvf_put_registers(cpu);
 +        cpu->vcpu_dirty = false;
 +    }
 +}
 +
 +static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val)
 +{
 +    hv_return_t r;
 +
 +    flush_cpu_state(cpu);
 +
 +    if (rt < 31) {
 +        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_X0 + rt, val);
 +        assert_hvf_ok(r);
 +    }
 +}
 +
 +static uint64_t hvf_get_reg(CPUState *cpu, int rt)
 +{
 +    uint64_t val = 0;
 +    hv_return_t r;
 +
 +    flush_cpu_state(cpu);
 +
 +    if (rt < 31) {
 +        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_X0 + rt, &val);
 +        assert_hvf_ok(r);
 +    }
 +
 +    return val;
 +}
 +
 +void hvf_arch_vcpu_destroy(CPUState *cpu)
 +{
 +}
 +
 +int hvf_arch_init_vcpu(CPUState *cpu)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +    uint32_t sregs_match_len = ARRAY_SIZE(hvf_sreg_match);
 +    uint32_t sregs_cnt = 0;
 +    uint64_t pfr;
 +    hv_return_t ret;
 +    int i;
 +
 +    env->aarch64 = 1;
 +    asm volatile("mrs %0, cntfrq_el0" : "=r"(arm_cpu->gt_cntfrq_hz));
 +
 +    /* Allocate enough space for our sysreg sync */
 +    arm_cpu->cpreg_indexes = g_renew(uint64_t, arm_cpu->cpreg_indexes,
 +                                     sregs_match_len);
 +    arm_cpu->cpreg_values = g_renew(uint64_t, arm_cpu->cpreg_values,
 +                                    sregs_match_len);
 +    arm_cpu->cpreg_vmstate_indexes = g_renew(uint64_t,
 +                                             arm_cpu->cpreg_vmstate_indexes,
 +                                             sregs_match_len);
 +    arm_cpu->cpreg_vmstate_values = g_renew(uint64_t,
 +                                            arm_cpu->cpreg_vmstate_values,
 +                                            sregs_match_len);
 +
 +    memset(arm_cpu->cpreg_values, 0, sregs_match_len * sizeof(uint64_t));
 +
 +    /* Populate cp list for all known sysregs */
 +    for (i = 0; i < sregs_match_len; i++) {
 +        const ARMCPRegInfo *ri;
 +        uint32_t key = hvf_sreg_match[i].key;
 +
 +        ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key);
 +        if (ri) {
 +            assert(!(ri->type & ARM_CP_NO_RAW));
 +            hvf_sreg_match[i].cp_idx = sregs_cnt;
 +            arm_cpu->cpreg_indexes[sregs_cnt++] = cpreg_to_kvm_id(key);
 +        } else {
 +            hvf_sreg_match[i].cp_idx = -1;
 +        }
 +    }
 +    arm_cpu->cpreg_array_len = sregs_cnt;
 +    arm_cpu->cpreg_vmstate_array_len = sregs_cnt;
 +
 +    assert(write_cpustate_to_list(arm_cpu, false));
 +
 +    /* Set CP_NO_RAW system registers on init */
 +    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MIDR_EL1,
 +                              arm_cpu->midr);
 +    assert_hvf_ok(ret);
 +
 +    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MPIDR_EL1,
 +                              arm_cpu->mp_affinity);
 +    assert_hvf_ok(ret);
 +
 +    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, &pfr);
 +    assert_hvf_ok(ret);
 +    pfr |= env->gicv3state ? (1 << 24) : 0;
 +    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, pfr);
 +    assert_hvf_ok(ret);
 +
 +    /* We're limited to underlying hardware caps, override internal versions */
 +    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
 +                              &arm_cpu->isar.id_aa64mmfr0);
 +    assert_hvf_ok(ret);
 +
 +    return 0;
 +}
 +
 +void hvf_kick_vcpu_thread(CPUState *cpu)
 +{
 +    hv_vcpus_exit(&cpu->hvf->fd, 1);
 +}
 +
 +static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
 +                                uint32_t syndrome)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +
 +    cpu->exception_index = excp;
 +    env->exception.target_el = 1;
 +    env->exception.syndrome = syndrome;
 +
 +    arm_cpu_do_interrupt(cpu);
 +}
 +
 +static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +    uint64_t val = 0;
 +
 +    switch (reg) {
 +    case SYSREG_CNTPCT_EL0:
 +        val = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
 +              gt_cntfrq_period_ns(arm_cpu);
 +        break;
 +    case SYSREG_OSLSR_EL1:
 +        val = env->cp15.oslsr_el1;
 +        break;
 +    case SYSREG_OSDLR_EL1:
 +        /* Dummy register */
 +        break;
 +    default:
 +        cpu_synchronize_state(cpu);
 +        trace_hvf_unhandled_sysreg_read(env->pc, reg,
 +                                        (reg >> 20) & 0x3,
 +                                        (reg >> 14) & 0x7,
 +                                        (reg >> 10) & 0xf,
 +                                        (reg >> 1) & 0xf,
 +                                        (reg >> 17) & 0x7);
 +        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        return 1;
 +    }
 +
 +    trace_hvf_sysreg_read(reg,
 +                          (reg >> 20) & 0x3,
 +                          (reg >> 14) & 0x7,
 +                          (reg >> 10) & 0xf,
 +                          (reg >> 1) & 0xf,
 +                          (reg >> 17) & 0x7,
 +                          val);
 +    hvf_set_reg(cpu, rt, val);
 +
 +    return 0;
 +}
 +
 +static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +
 +    trace_hvf_sysreg_write(reg,
 +                           (reg >> 20) & 0x3,
 +                           (reg >> 14) & 0x7,
 +                           (reg >> 10) & 0xf,
 +                           (reg >> 1) & 0xf,
 +                           (reg >> 17) & 0x7,
 +                           val);
 +
 +    switch (reg) {
 +    case SYSREG_OSLAR_EL1:
 +        env->cp15.oslsr_el1 = val & 1;
 +        break;
 +    case SYSREG_OSDLR_EL1:
 +        /* Dummy register */
 +        break;
 +    default:
 +        cpu_synchronize_state(cpu);
 +        trace_hvf_unhandled_sysreg_write(env->pc, reg,
 +                                         (reg >> 20) & 0x3,
 +                                         (reg >> 14) & 0x7,
 +                                         (reg >> 10) & 0xf,
 +                                         (reg >> 1) & 0xf,
 +                                         (reg >> 17) & 0x7);
 +        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        return 1;
 +    }
 +
 +    return 0;
 +}
 +
 +static int hvf_inject_interrupts(CPUState *cpu)
 +{
 +    if (cpu->interrupt_request & CPU_INTERRUPT_FIQ) {
 +        trace_hvf_inject_fiq();
 +        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_FIQ,
 +                                      true);
 +    }
 +
 +    if (cpu->interrupt_request & CPU_INTERRUPT_HARD) {
 +        trace_hvf_inject_irq();
 +        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_IRQ,
 +                                      true);
 +    }
 +
 +    return 0;
 +}
 +
 +static uint64_t hvf_vtimer_val_raw(void)
 +{
 +    /*
 +     * mach_absolute_time() returns the vtimer value without the VM
 +     * offset that we define. Add our own offset on top.
 +     */
 +    return mach_absolute_time() - hvf_state->vtimer_offset;
 +}
 +
 +static void hvf_sync_vtimer(CPUState *cpu)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    hv_return_t r;
 +    uint64_t ctl;
 +    bool irq_state;
 +
 +    if (!cpu->hvf->vtimer_masked) {
 +        /* We will get notified on vtimer changes by hvf, nothing to do */
 +        return;
 +    }
 +
-+    switch (type) {
++    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
-+    case 0: /* float32 */
++    assert_hvf_ok(r);
-+    case 1: /* float64 */
++
-+        break;
++    irq_state = (ctl & (TMR_CTL_ENABLE | TMR_CTL_IMASK | TMR_CTL_ISTATUS)) ==
-+    case 3: /* float16 */
++                (TMR_CTL_ENABLE | TMR_CTL_ISTATUS);
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++    qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], irq_state);
-+            break;
++
 +    if (!irq_state) {
 +        /* Timer no longer asserting, we can unmask it */
 +        hv_vcpu_set_vtimer_mask(cpu->hvf->fd, false);
 +        cpu->hvf->vtimer_masked = false;
 +    }
 +}
 +
 +int hvf_vcpu_exec(CPUState *cpu)
 +{
 +    ARMCPU *arm_cpu = ARM_CPU(cpu);
 +    CPUARMState *env = &arm_cpu->env;
 +    hv_vcpu_exit_t *hvf_exit = cpu->hvf->exit;
 +    hv_return_t r;
 +    bool advance_pc = false;
 +
 +    if (hvf_inject_interrupts(cpu)) {
 +        return EXCP_INTERRUPT;
 +    }
 +
 +    if (cpu->halted) {
 +        return EXCP_HLT;
 +    }
 +
 +    flush_cpu_state(cpu);
 +
 +    qemu_mutex_unlock_iothread();
 +    assert_hvf_ok(hv_vcpu_run(cpu->hvf->fd));
 +
 +    /* handle VMEXIT */
 +    uint64_t exit_reason = hvf_exit->reason;
 +    uint64_t syndrome = hvf_exit->exception.syndrome;
 +    uint32_t ec = syn_get_ec(syndrome);
 +
 +    qemu_mutex_lock_iothread();
 +    switch (exit_reason) {
 +    case HV_EXIT_REASON_EXCEPTION:
 +        /* This is the main one, handle below. */
 +        break;
 +    case HV_EXIT_REASON_VTIMER_ACTIVATED:
 +        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
 +        cpu->hvf->vtimer_masked = true;
 +        return 0;
 +    case HV_EXIT_REASON_CANCELED:
 +        /* we got kicked, no exit to process */
 +        return 0;
 +    default:
 +        assert(0);
 +    }
 +
 +    hvf_sync_vtimer(cpu);
 +
 +    switch (ec) {
 +    case EC_DATAABORT: {
 +        bool isv = syndrome & ARM_EL_ISV;
 +        bool iswrite = (syndrome >> 6) & 1;
 +        bool s1ptw = (syndrome >> 7) & 1;
 +        uint32_t sas = (syndrome >> 22) & 3;
 +        uint32_t len = 1 << sas;
 +        uint32_t srt = (syndrome >> 16) & 0x1f;
 +        uint64_t val = 0;
 +
 +        trace_hvf_data_abort(env->pc, hvf_exit->exception.virtual_address,
 +                             hvf_exit->exception.physical_address, isv,
 +                             iswrite, s1ptw, len, srt);
 +
 +        assert(isv);
 +
 +        if (iswrite) {
 +            val = hvf_get_reg(cpu, srt);
 +            address_space_write(&address_space_memory,
 +                                hvf_exit->exception.physical_address,
 +                                MEMTXATTRS_UNSPECIFIED, &val, len);
 +        } else {
 +            address_space_read(&address_space_memory,
 +                               hvf_exit->exception.physical_address,
 +                               MEMTXATTRS_UNSPECIFIED, &val, len);
 +            hvf_set_reg(cpu, srt, val);
 +        }
-+        /* fallthru */
++
 +        advance_pc = true;
 +        break;
 +    }
 +    case EC_SYSTEMREGISTERTRAP: {
 +        bool isread = (syndrome >> 0) & 1;
 +        uint32_t rt = (syndrome >> 5) & 0x1f;
 +        uint32_t reg = syndrome & SYSREG_MASK;
 +        uint64_t val;
 +        int ret = 0;
 +
 +        if (isread) {
 +            ret = hvf_sysreg_read(cpu, reg, rt);
 +        } else {
 +            val = hvf_get_reg(cpu, rt);
 +            ret = hvf_sysreg_write(cpu, reg, val);
 +        }
 +
 +        advance_pc = !ret;
 +        break;
 +    }
 +    case EC_WFX_TRAP:
 +        advance_pc = true;
 +        break;
 +    case EC_AA64_HVC:
 +        cpu_synchronize_state(cpu);
 +        trace_hvf_unknown_hvc(env->xregs[0]);
 +        /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
 +        env->xregs[0] = -1;
 +        break;
 +    case EC_AA64_SMC:
 +        cpu_synchronize_state(cpu);
 +        trace_hvf_unknown_smc(env->xregs[0]);
 +        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        break;
 +    default:
-         unallocated_encoding(s);
++        cpu_synchronize_state(cpu);
-         return;
++        trace_hvf_exit(syndrome, ec, env->pc);
-     }
++        error_report("0x%llx: unhandled exception ec=0x%x", env->pc, ec);
 +    }
 +
 +    if (advance_pc) {
 +        uint64_t pc;
 +
 +        flush_cpu_state(cpu);
 +
 +        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_PC, &pc);
 +        assert_hvf_ok(r);
 +        pc += 4;
 +        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_PC, pc);
 +        assert_hvf_ok(r);
 +    }
 +
 +    return 0;
 +}
 +
 +static const VMStateDescription vmstate_hvf_vtimer = {
 +    .name = "hvf-vtimer",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT64(vtimer_val, HVFVTimer),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
 +static void hvf_vm_state_change(void *opaque, bool running, RunState state)
 +{
 +    HVFVTimer *s = opaque;
 +
 +    if (running) {
 +        /* Update vtimer offset on all CPUs */
 +        hvf_state->vtimer_offset = mach_absolute_time() - s->vtimer_val;
 +        cpu_synchronize_all_states();
 +    } else {
 +        /* Remember vtimer value on every pause */
 +        s->vtimer_val = hvf_vtimer_val_raw();
 +    }
 +}
 +
 +int hvf_arch_init(void)
 +{
 +    hvf_state->vtimer_offset = mach_absolute_time();
 +    vmstate_register(NULL, 0, &vmstate_hvf_vtimer, &vtimer);
 +    qemu_add_vm_change_state_handler(hvf_vm_state_change, &vtimer);
 +    return 0;
 +}
 diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/hvf/hvf.c
 +++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static inline bool apic_bus_freq_is_known(CPUX86State *env)
      return env->apic_bus_freq != 0;
  }
 +void hvf_kick_vcpu_thread(CPUState *cpu)
 +{
 +    cpus_kick_thread(cpu);
 +}
 +
  int hvf_arch_init(void)
  {
      return 0;
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: accel/accel-*.c
  F: accel/Makefile.objs
  F: accel/stubs/Makefile.objs
 +Apple Silicon HVF CPUs
 +M: Alexander Graf <agraf@csgraf.de>
 +S: Maintained
 +F: target/arm/hvf/
 +
  X86 HVF CPUs
  M: Cameron Esfahani <dirty@apple.com>
  M: Roman Bolshakov <r.bolshakov@yadro.com>
 diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/hvf/trace-events
@@ -XXX,XX +XXX,XX @@
 +hvf_unhandled_sysreg_read(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2) "unhandled sysreg read at pc=0x%"PRIx64": 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d)"
 +hvf_unhandled_sysreg_write(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2) "unhandled sysreg write at pc=0x%"PRIx64": 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d)"
 +hvf_inject_fiq(void) "injecting FIQ"
 +hvf_inject_irq(void) "injecting IRQ"
 +hvf_data_abort(uint64_t pc, uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [pc=0x%"PRIx64" va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
 +hvf_sysreg_read(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg read 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d) = 0x%016"PRIx64
 +hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg write 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d, val=0x%016"PRIx64")"
 +hvf_unknown_hvc(uint64_t x0) "unknown HVC! 0x%016"PRIx64
 +hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
 +hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+[PULL 11/27] arm/hvf: Add a WFI handler
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Peter Collingbourne <pcc@google.com>
-These where missed out from the rest of the half-precision work.
+Sleep on WFI until the VTIMER is due but allow ourselves to be woken
 up on IPI.
-Cc: qemu-stable@nongnu.org
+In this implementation IPI is blocked on the CPU thread at startup and
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+pselect() is used to atomically unblock the signal and begin sleeping.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+The signal is sent unconditionally so there's no need to worry about
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+races between actually sleeping and the "we think we're sleeping"
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+state. It may lead to an extra wakeup but that's better than missing
-Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
+it entirely.
-[rth: Diagnose lack of FP16 before fp_access_check]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Collingbourne <pcc@google.com>
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Message-id: 20210916155404.86958-6-agraf@csgraf.de
 [agraf: Remove unused 'set' variable, always advance PC on WFX trap,
         support vm stop / continue operations and cntv offsets]
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper-a64.h    |  2 +
+ include/sysemu/hvf_int.h  |  1 +
- target/arm/helper-a64.c    | 10 +++++
+ accel/hvf/hvf-accel-ops.c |  5 +--
- target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
+ target/arm/hvf/hvf.c      | 79 +++++++++++++++++++++++++++++++++++++++
-files changed, 83 insertions(+), 17 deletions(-)
+files changed, 82 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
+diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.h
+--- a/include/sysemu/hvf_int.h
-+++ b/target/arm/helper-a64.h
++++ b/include/sysemu/hvf_int.h
@@ -XXX,XX +XXX,XX @@ struct hvf_vcpu_state {
      uint64_t fd;
      void *exit;
      bool vtimer_masked;
 +    sigset_t unblock_ipi_mask;
  };
  void assert_hvf_ok(hv_return_t ret);
 diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/hvf/hvf-accel-ops.c
 +++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static int hvf_init_vcpu(CPUState *cpu)
      cpu->hvf = g_malloc0(sizeof(*cpu->hvf));
      /* init cpu signals */
 -    sigset_t set;
      struct sigaction sigact;
      memset(&sigact, 0, sizeof(sigact));
      sigact.sa_handler = dummy_signal;
      sigaction(SIG_IPI, &sigact, NULL);
 -    pthread_sigmask(SIG_BLOCK, NULL, &set);
 -    sigdelset(&set, SIG_IPI);
 +    pthread_sigmask(SIG_BLOCK, NULL, &cpu->hvf->unblock_ipi_mask);
 +    sigdelset(&cpu->hvf->unblock_ipi_mask, SIG_IPI);
  #ifdef __aarch64__
      r = hv_vcpu_create(&cpu->hvf->fd, (hv_vcpu_exit_t **)&cpu->hvf->exit, NULL);
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
 @@ -XXX,XX +XXX,XX @@
- DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+  * QEMU Hypervisor.framework support for Apple Silicon
- DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
- DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+  * Copyright 2020 Alexander Graf <agraf@csgraf.de>
-+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
++ * Copyright 2020 Google LLC
-+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
+  *
- DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+  * This work is licensed under the terms of the GNU GPL, version 2 or later.
- DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
+  * See the COPYING file in the top-level directory.
- DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
+@@ -XXX,XX +XXX,XX @@ int hvf_arch_init_vcpu(CPUState *cpu)
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
-index XXXXXXX..XXXXXXX 100644
+ void hvf_kick_vcpu_thread(CPUState *cpu)
---- a/target/arm/helper-a64.c
+ {
-+++ b/target/arm/helper-a64.c
++    cpus_kick_thread(cpu);
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
+     hv_vcpus_exit(&cpu->hvf->fd, 1);
      return flags;
  }
-+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+@@ -XXX,XX +XXX,XX @@ static uint64_t hvf_vtimer_val_raw(void)
      return mach_absolute_time() - hvf_state->vtimer_offset;
  }
 +static uint64_t hvf_vtimer_val(void)
 +{
-+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
++    if (!runstate_is_running()) {
 +        /* VM is paused, the vtimer value is in vtimer.vtimer_val */
 +        return vtimer.vtimer_val;
 +    }
 +
 +    return hvf_vtimer_val_raw();
 +}
 +
-+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
++static void hvf_wait_for_ipi(CPUState *cpu, struct timespec *ts)
 +{
-+    return float_rel_to_flags(float16_compare(x, y, fp_status));
++    /*
 +     * Use pselect to sleep so that other threads can IPI us while we're
 +     * sleeping.
 +     */
 +    qatomic_mb_set(&cpu->thread_kicked, false);
 +    qemu_mutex_unlock_iothread();
 +    pselect(0, 0, 0, 0, ts, &cpu->hvf->unblock_ipi_mask);
 +    qemu_mutex_lock_iothread();
 +}
 +
- uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
++static void hvf_wfi(CPUState *cpu)
- {
++{
-     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
++    ARMCPU *arm_cpu = ARM_CPU(cpu);
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
++    struct timespec ts;
-index XXXXXXX..XXXXXXX 100644
++    hv_return_t r;
---- a/target/arm/translate-a64.c
++    uint64_t ctl;
-+++ b/target/arm/translate-a64.c
++    uint64_t cval;
-@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
++    int64_t ticks_to_sleep;
-     }
++    uint64_t seconds;
- }
++    uint64_t nanos;
++    uint32_t cntfrq;
 -static void handle_fp_compare(DisasContext *s, bool is_double,
 +static void handle_fp_compare(DisasContext *s, int size,
                                unsigned int rn, unsigned int rm,
                                bool cmp_with_zero, bool signal_all_nans)
  {
      TCGv_i64 tcg_flags = tcg_temp_new_i64();
 -    TCGv_ptr fpst = get_fpstatus_ptr(false);
 +    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
-+        switch (size) {
++    if (cpu->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ)) {
-+        case MO_32:
++        /* Interrupt pending, no need to wait */
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    switch (type) {
++    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
-+    case 0:
++    assert_hvf_ok(r);
-+        size = MO_32;
++
-+        break;
++    if (!(ctl & 1) || (ctl & 2)) {
-+    case 1:
++        /* Timer disabled or masked, just wait for an IPI. */
-+        size = MO_64;
++        hvf_wait_for_ipi(cpu, NULL);
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
  /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
-+    switch (type) {
++    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval);
-+    case 0:
++    assert_hvf_ok(r);
-+        size = MO_32;
++
-+        break;
++    ticks_to_sleep = cval - hvf_vtimer_val();
-+    case 1:
++    if (ticks_to_sleep < 0) {
-+        size = MO_64;
++        return;
-+        break;
++    }
-+    case 3:
++
-+        size = MO_16;
++    cntfrq = gt_cntfrq_period_ns(arm_cpu);
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++    seconds = muldiv64(ticks_to_sleep, cntfrq, NANOSECONDS_PER_SECOND);
-+            break;
++    ticks_to_sleep -= muldiv64(seconds, NANOSECONDS_PER_SECOND, cntfrq);
 +    nanos = ticks_to_sleep * cntfrq;
 +
 +    /*
 +     * Don't sleep for less than the time a context switch would take,
 +     * so that we can satisfy fast timer requests on the same CPU.
 +     * Measurements on M1 show the sweet spot to be ~2ms.
 +     */
 +    if (!seconds && nanos < (2 * SCALE_MS)) {
 +        return;
 +    }
 +
 +    ts = (struct timespec) { seconds, nanos };
 +    hvf_wait_for_ipi(cpu, &ts);
 +}
 +
  static void hvf_sync_vtimer(CPUState *cpu)
  {
      ARMCPU *arm_cpu = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
      }
      case EC_WFX_TRAP:
          advance_pc = true;
 +        if (!(syndrome & WFX_IS_WFE)) {
 +            hvf_wfi(cpu);
 +        }
-+        /* fallthru */
+         break;
-+    default:
+     case EC_AA64_HVC:
-         unallocated_encoding(s);
+         cpu_synchronize_state(cpu);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
-.17.0
+.20.1

-New patch
+[PULL 12/27] hvf: arm: Implement -cpu host
+Now that we have working system register sync, we push more target CPU
 properties into the virtual machine. That might be useful in some
 situations, but is not the typical case that users want.
 So let's add a -cpu host option that allows them to explicitly pass all
 CPU capabilities of their host CPU into the guest.
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210916155404.86958-7-agraf@csgraf.de
 [PMM: drop unnecessary #include line from .h file]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h     |  2 +
  target/arm/hvf_arm.h | 18 +++++++++
  target/arm/kvm_arm.h |  2 -
  target/arm/cpu.c     | 13 ++++--
  target/arm/hvf/hvf.c | 95 ++++++++++++++++++++++++++++++++++++++++++++
 files changed, 124 insertions(+), 6 deletions(-)
  create mode 100644 target/arm/hvf_arm.h
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
  #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
 +#define TYPE_ARM_HOST_CPU "host-" TYPE_ARM_CPU
 +
  #define cpu_signal_handler cpu_arm_signal_handler
  #define cpu_list arm_cpu_list
 diff --git a/target/arm/hvf_arm.h b/target/arm/hvf_arm.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/hvf_arm.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU Hypervisor.framework (HVF) support -- ARM specifics
 + *
 + * Copyright (c) 2021 Alexander Graf
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + *
 + */
 +
 +#ifndef QEMU_HVF_ARM_H
 +#define QEMU_HVF_ARM_H
 +
 +#include "cpu.h"
 +
 +void hvf_arm_set_cpu_features_from_host(struct ARMCPU *cpu);
 +
 +#endif
 diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
   */
  void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
 -#define TYPE_ARM_HOST_CPU "host-" TYPE_ARM_CPU
 -
  /**
   * ARMHostCPUFeatures: information about the host CPU (identified
   * by asking the host kernel)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/tcg.h"
  #include "sysemu/hw_accel.h"
  #include "kvm_arm.h"
 +#include "hvf_arm.h"
  #include "disas/capstone.h"
  #include "fpu/softfloat.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
       * this is the first point where we can report it.
       */
      if (cpu->host_cpu_probe_failed) {
 -        if (!kvm_enabled()) {
 -            error_setg(errp, "The 'host' CPU type can only be used with KVM");
 +        if (!kvm_enabled() && !hvf_enabled()) {
 +            error_setg(errp, "The 'host' CPU type can only be used with KVM or HVF");
          } else {
              error_setg(errp, "Failed to retrieve host CPU features");
          }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
  #endif /* CONFIG_TCG */
  }
 -#ifdef CONFIG_KVM
 +#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
  static void arm_host_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 +#ifdef CONFIG_KVM
      kvm_arm_set_cpu_features_from_host(cpu);
      if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
          aarch64_add_sve_properties(obj);
      }
 +#else
 +    hvf_arm_set_cpu_features_from_host(cpu);
 +#endif
      arm_cpu_post_init(obj);
  }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_register_types(void)
  {
      type_register_static(&arm_cpu_type_info);
 -#ifdef CONFIG_KVM
 +#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
      type_register_static(&host_arm_cpu_type_info);
  #endif
  }
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/hvf.h"
  #include "sysemu/hvf_int.h"
  #include "sysemu/hw_accel.h"
 +#include "hvf_arm.h"
  #include <mach/mach_time.h>
@@ -XXX,XX +XXX,XX @@ typedef struct HVFVTimer {
  static HVFVTimer vtimer;
 +typedef struct ARMHostCPUFeatures {
 +    ARMISARegisters isar;
 +    uint64_t features;
 +    uint64_t midr;
 +    uint32_t reset_sctlr;
 +    const char *dtb_compatible;
 +} ARMHostCPUFeatures;
 +
 +static ARMHostCPUFeatures arm_host_cpu_features;
 +
  struct hvf_reg_match {
      int reg;
      uint64_t offset;
@@ -XXX,XX +XXX,XX @@ static uint64_t hvf_get_reg(CPUState *cpu, int rt)
      return val;
  }
 +static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 +{
 +    ARMISARegisters host_isar = {};
 +    const struct isar_regs {
 +        int reg;
 +        uint64_t *val;
 +    } regs[] = {
 +        { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.id_aa64pfr0 },
 +        { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.id_aa64pfr1 },
 +        { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
 +        { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
 +        { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.id_aa64isar0 },
 +        { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.id_aa64isar1 },
 +        { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
 +        { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },
 +        { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 },
 +    };
 +    hv_vcpu_t fd;
 +    hv_return_t r = HV_SUCCESS;
 +    hv_vcpu_exit_t *exit;
 +    int i;
 +
 +    ahcf->dtb_compatible = "arm,arm-v8";
 +    ahcf->features = (1ULL << ARM_FEATURE_V8) |
 +                     (1ULL << ARM_FEATURE_NEON) |
 +                     (1ULL << ARM_FEATURE_AARCH64) |
 +                     (1ULL << ARM_FEATURE_PMU) |
 +                     (1ULL << ARM_FEATURE_GENERIC_TIMER);
 +
 +    /* We set up a small vcpu to extract host registers */
 +
 +    if (hv_vcpu_create(&fd, &exit, NULL) != HV_SUCCESS) {
 +        return false;
 +    }
 +
 +    for (i = 0; i < ARRAY_SIZE(regs); i++) {
 +        r |= hv_vcpu_get_sys_reg(fd, regs[i].reg, regs[i].val);
 +    }
 +    r |= hv_vcpu_get_sys_reg(fd, HV_SYS_REG_MIDR_EL1, &ahcf->midr);
 +    r |= hv_vcpu_destroy(fd);
 +
 +    ahcf->isar = host_isar;
 +
 +    /*
 +     * A scratch vCPU returns SCTLR 0, so let's fill our default with the M1
 +     * boot SCTLR from https://github.com/AsahiLinux/m1n1/issues/97
 +     */
 +    ahcf->reset_sctlr = 0x30100180;
 +    /*
 +     * SPAN is disabled by default when SCTLR.SPAN=1. To improve compatibility,
 +     * let's disable it on boot and then allow guest software to turn it on by
 +     * setting it to 0.
 +     */
 +    ahcf->reset_sctlr |= 0x00800000;
 +
 +    /* Make sure we don't advertise AArch32 support for EL0/EL1 */
 +    if ((host_isar.id_aa64pfr0 & 0xff) != 0x11) {
 +        return false;
 +    }
 +
 +    return r == HV_SUCCESS;
 +}
 +
 +void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu)
 +{
 +    if (!arm_host_cpu_features.dtb_compatible) {
 +        if (!hvf_enabled() ||
 +            !hvf_arm_get_host_cpu_features(&arm_host_cpu_features)) {
 +            /*
 +             * We can't report this error yet, so flag that we need to
 +             * in arm_cpu_realizefn().
 +             */
 +            cpu->host_cpu_probe_failed = true;
 +            return;
 +        }
 +    }
 +
 +    cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
 +    cpu->isar = arm_host_cpu_features.isar;
 +    cpu->env.features = arm_host_cpu_features.features;
 +    cpu->midr = arm_host_cpu_features.midr;
 +    cpu->reset_sctlr = arm_host_cpu_features.reset_sctlr;
 +}
 +
  void hvf_arch_vcpu_destroy(CPUState *cpu)
  {
  }
 --
 .20.1

-[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+[PULL 13/27] hvf: arm: Implement PSCI handling
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Alexander Graf <agraf@csgraf.de>
-We missed all of the scalar fp16 binary operations.
+We need to handle PSCI calls. Most of the TCG code works for us,
+but we can simplify it to only handle aa64 mode and we need to
-Cc: qemu-stable@nongnu.org
+handle SUSPEND differently.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+This patch takes the TCG code as template and duplicates it in HVF.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
+To tell the guest that we support PSCI 0.2 now, update the check in
 arm_cpu_initfn() as well.
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Reviewed-by: Sergio Lopez <slp@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210916155404.86958-8-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
+ target/arm/cpu.c            |   4 +-
-file changed, 65 insertions(+)
+ target/arm/hvf/hvf.c        | 141 ++++++++++++++++++++++++++++++++++--
+ target/arm/hvf/trace-events |   1 +
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+files changed, 139 insertions(+), 7 deletions(-)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/cpu.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
-     tcg_temp_free_i64(tcg_res);
+     cpu->psci_version = 1; /* By default assume PSCI v0.1 */
      cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
 -    if (tcg_enabled()) {
 -        cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
 +    if (tcg_enabled() || hvf_enabled()) {
 +        cpu->psci_version = 2; /* TCG and HVF implement PSCI 0.2 */
      }
  }
-+/* Floating-point data-processing (2 source) - half precision */
+diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
-+static void handle_fp_2src_half(DisasContext *s, int opcode,
+index XXXXXXX..XXXXXXX 100644
-+                                int rd, int rn, int rm)
+--- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "qemu/main-loop.h"
  #include "sysemu/cpus.h"
 +#include "arm-powerctl.h"
  #include "target/arm/cpu.h"
  #include "target/arm/internals.h"
  #include "trace/trace-target_arm_hvf.h"
@@ -XXX,XX +XXX,XX @@
  #define TMR_CTL_IMASK   (1 << 1)
  #define TMR_CTL_ISTATUS (1 << 2)
 +static void hvf_wfi(CPUState *cpu);
 +
  typedef struct HVFVTimer {
      /* Vtimer value during migration and paused state */
      uint64_t vtimer_val;
@@ -XXX,XX +XXX,XX @@ static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
      arm_cpu_do_interrupt(cpu);
  }
 +static void hvf_psci_cpu_off(ARMCPU *arm_cpu)
 +{
-+    TCGv_i32 tcg_op1;
++    int32_t ret = arm_set_cpu_off(arm_cpu->mp_affinity);
-+    TCGv_i32 tcg_op2;
++    assert(ret == QEMU_ARM_POWERCTL_RET_SUCCESS);
-+    TCGv_i32 tcg_res;
++}
-+    TCGv_ptr fpst;
++
-+
++/*
-+    tcg_res = tcg_temp_new_i32();
++ * Handle a PSCI call.
-+    fpst = get_fpstatus_ptr(true);
++ *
-+    tcg_op1 = read_fp_hreg(s, rn);
++ * Returns 0 on success
-+    tcg_op2 = read_fp_hreg(s, rm);
++ *         -1 when the PSCI call is unknown,
-+
++ */
-+    switch (opcode) {
++static bool hvf_handle_psci_call(CPUState *cpu)
-+    case 0x0: /* FMUL */
++{
-+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
++    ARMCPU *arm_cpu = ARM_CPU(cpu);
-+        break;
++    CPUARMState *env = &arm_cpu->env;
-+    case 0x1: /* FDIV */
++    uint64_t param[4] = {
-+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
++        env->xregs[0],
-+        break;
++        env->xregs[1],
-+    case 0x2: /* FADD */
++        env->xregs[2],
-+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
++        env->xregs[3]
-+        break;
++    };
-+    case 0x3: /* FSUB */
++    uint64_t context_id, mpidr;
-+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
++    bool target_aarch64 = true;
-+        break;
++    CPUState *target_cpu_state;
-+    case 0x4: /* FMAX */
++    ARMCPU *target_cpu;
-+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
++    target_ulong entry;
-+        break;
++    int target_el = 1;
-+    case 0x5: /* FMIN */
++    int32_t ret = 0;
-+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
++
-+        break;
++    trace_hvf_psci_call(param[0], param[1], param[2], param[3],
-+    case 0x6: /* FMAXNM */
++                        arm_cpu->mp_affinity);
-+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
++
-+        break;
++    switch (param[0]) {
-+    case 0x7: /* FMINNM */
++    case QEMU_PSCI_0_2_FN_PSCI_VERSION:
-+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
++        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
 +        break;
-+    case 0x8: /* FNMUL */
++    case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
-+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
++        ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
-+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
++        break;
 +    case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
 +    case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
 +        mpidr = param[1];
 +
 +        switch (param[2]) {
 +        case 0:
 +            target_cpu_state = arm_get_cpu_by_id(mpidr);
 +            if (!target_cpu_state) {
 +                ret = QEMU_PSCI_RET_INVALID_PARAMS;
 +                break;
 +            }
 +            target_cpu = ARM_CPU(target_cpu_state);
 +
 +            ret = target_cpu->power_state;
 +            break;
 +        default:
 +            /* Everything above affinity level 0 is always on. */
 +            ret = 0;
 +        }
 +        break;
 +    case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
 +        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +        /*
 +         * QEMU reset and shutdown are async requests, but PSCI
 +         * mandates that we never return from the reset/shutdown
 +         * call, so power the CPU off now so it doesn't execute
 +         * anything further.
 +         */
 +        hvf_psci_cpu_off(arm_cpu);
 +        break;
 +    case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
 +        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +        hvf_psci_cpu_off(arm_cpu);
 +        break;
 +    case QEMU_PSCI_0_1_FN_CPU_ON:
 +    case QEMU_PSCI_0_2_FN_CPU_ON:
 +    case QEMU_PSCI_0_2_FN64_CPU_ON:
 +        mpidr = param[1];
 +        entry = param[2];
 +        context_id = param[3];
 +        ret = arm_set_cpu_on(mpidr, entry, context_id,
 +                             target_el, target_aarch64);
 +        break;
 +    case QEMU_PSCI_0_1_FN_CPU_OFF:
 +    case QEMU_PSCI_0_2_FN_CPU_OFF:
 +        hvf_psci_cpu_off(arm_cpu);
 +        break;
 +    case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
 +    case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
 +    case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
 +        /* Affinity levels are not supported in QEMU */
 +        if (param[1] & 0xfffe0000) {
 +            ret = QEMU_PSCI_RET_INVALID_PARAMS;
 +            break;
 +        }
 +        /* Powerdown is not supported, we always go into WFI */
 +        env->xregs[0] = 0;
 +        hvf_wfi(cpu);
 +        break;
 +    case QEMU_PSCI_0_1_FN_MIGRATE:
 +    case QEMU_PSCI_0_2_FN_MIGRATE:
 +        ret = QEMU_PSCI_RET_NOT_SUPPORTED;
 +        break;
 +    default:
-+        g_assert_not_reached();
++        return false;
 +    }
 +
-+    write_fp_sreg(s, rd, tcg_res);
++    env->xregs[0] = ret;
-+
++    return true;
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- /* Floating point data-processing (2 source)
+ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
-  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
+ {
-  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
+     ARMCPU *arm_cpu = ARM_CPU(cpu);
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
          }
          handle_fp_2src_double(s, opcode, rd, rn, rm);
          break;
-+    case 3:
+     case EC_AA64_HVC:
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+         cpu_synchronize_state(cpu);
-+            unallocated_encoding(s);
+-        trace_hvf_unknown_hvc(env->xregs[0]);
-+            return;
+-        /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
-+        }
+-        env->xregs[0] = -1;
-+        if (!fp_access_check(s)) {
++        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
-+            return;
++            if (!hvf_handle_psci_call(cpu)) {
-+        }
++                trace_hvf_unknown_hvc(env->xregs[0]);
-+        handle_fp_2src_half(s, opcode, rd, rn, rm);
++                /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
-+        break;
++                env->xregs[0] = -1;
 +            }
 +        } else {
 +            trace_hvf_unknown_hvc(env->xregs[0]);
 +            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        }
          break;
      case EC_AA64_SMC:
          cpu_synchronize_state(cpu);
 -        trace_hvf_unknown_smc(env->xregs[0]);
 -        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) {
 +            advance_pc = true;
 +
 +            if (!hvf_handle_psci_call(cpu)) {
 +                trace_hvf_unknown_smc(env->xregs[0]);
 +                /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
 +                env->xregs[0] = -1;
 +            }
 +        } else {
 +            trace_hvf_unknown_smc(env->xregs[0]);
 +            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
 +        }
          break;
      default:
-         unallocated_encoding(s);
+         cpu_synchronize_state(cpu);
-     }
+diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/trace-events
 +++ b/target/arm/hvf/trace-events
@@ -XXX,XX +XXX,XX @@ hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_
  hvf_unknown_hvc(uint64_t x0) "unknown HVC! 0x%016"PRIx64
  hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
  hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
 +hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpu=0x%x"
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+[PULL 14/27] arm: Add Hypervisor.framework build target
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Alexander Graf <agraf@csgraf.de>
-We are meant to explicitly pass fpst, not cpu_env.
+Now that we have all logic in place that we need to handle Hypervisor.framework
 on Apple Silicon systems, let's add CONFIG_HVF for aarch64 as well so that we
 can build it.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Roman Bolshakov <r.bolshakov@yadro.com> (x86 only)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Sergio Lopez <slp@redhat.com>
-Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
+Message-id: 20210916155404.86958-9-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 3 ++-
+ meson.build                | 7 +++++++
-file changed, 2 insertions(+), 1 deletion(-)
+ target/arm/hvf/meson.build | 3 +++
  target/arm/meson.build     | 2 ++
 files changed, 12 insertions(+)
  create mode 100644 target/arm/hvf/meson.build
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/meson.build
-+++ b/target/arm/translate-a64.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+@@ -XXX,XX +XXX,XX @@ else
-         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
+ endif
-         break;
-     case 0x3: /* FSQRT */
+ accelerator_targets = { 'CONFIG_KVM': kvm_targets }
--        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
++
-+        fpst = get_fpstatus_ptr(true);
++if cpu in ['aarch64']
-+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
++  accelerator_targets += {
-         break;
++    'CONFIG_HVF': ['aarch64-softmmu']
-     case 0x8: /* FRINTN */
++  }
-     case 0x9: /* FRINTP */
++endif
 +
  if cpu in ['x86', 'x86_64', 'arm', 'aarch64']
    # i386 emulator provides xenpv machine type for multiple architectures
    accelerator_targets += {
 diff --git a/target/arm/hvf/meson.build b/target/arm/hvf/meson.build
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
 +arm_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
 +  'hvf.c',
 +))
 diff --git a/target/arm/meson.build b/target/arm/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/meson.build
 +++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
    'psci.c',
  ))
 +subdir('hvf')
 +
  target_arch += {'arm': arm_ss}
  target_softmmu_arch += {'arm': arm_softmmu_ss}
 --
-.17.0
+.20.1

-New patch
+[PULL 15/27] hvf: arm: Add rudimentary PMC support
+From: Alexander Graf <agraf@csgraf.de>
 We can expose cycle counters on the PMU easily. To be as compatible as
 possible, let's do so, but make sure we don't expose any other architectural
 counters that we can not model yet.
 This allows OSs to work that require PMU support.
 Signed-off-by: Alexander Graf <agraf@csgraf.de>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20210916155404.86958-10-agraf@csgraf.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/hvf/hvf.c | 179 +++++++++++++++++++++++++++++++++++++++++++
 file changed, 179 insertions(+)
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  #define SYSREG_OSLSR_EL1      SYSREG(2, 0, 1, 1, 4)
  #define SYSREG_OSDLR_EL1      SYSREG(2, 0, 1, 3, 4)
  #define SYSREG_CNTPCT_EL0     SYSREG(3, 3, 14, 0, 1)
 +#define SYSREG_PMCR_EL0       SYSREG(3, 3, 9, 12, 0)
 +#define SYSREG_PMUSERENR_EL0  SYSREG(3, 3, 9, 14, 0)
 +#define SYSREG_PMCNTENSET_EL0 SYSREG(3, 3, 9, 12, 1)
 +#define SYSREG_PMCNTENCLR_EL0 SYSREG(3, 3, 9, 12, 2)
 +#define SYSREG_PMINTENCLR_EL1 SYSREG(3, 0, 9, 14, 2)
 +#define SYSREG_PMOVSCLR_EL0   SYSREG(3, 3, 9, 12, 3)
 +#define SYSREG_PMSWINC_EL0    SYSREG(3, 3, 9, 12, 4)
 +#define SYSREG_PMSELR_EL0     SYSREG(3, 3, 9, 12, 5)
 +#define SYSREG_PMCEID0_EL0    SYSREG(3, 3, 9, 12, 6)
 +#define SYSREG_PMCEID1_EL0    SYSREG(3, 3, 9, 12, 7)
 +#define SYSREG_PMCCNTR_EL0    SYSREG(3, 3, 9, 13, 0)
 +#define SYSREG_PMCCFILTR_EL0  SYSREG(3, 3, 14, 15, 7)
  #define WFX_IS_WFE (1 << 0)
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
          val = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
                gt_cntfrq_period_ns(arm_cpu);
          break;
 +    case SYSREG_PMCR_EL0:
 +        val = env->cp15.c9_pmcr;
 +        break;
 +    case SYSREG_PMCCNTR_EL0:
 +        pmu_op_start(env);
 +        val = env->cp15.c15_ccnt;
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMCNTENCLR_EL0:
 +        val = env->cp15.c9_pmcnten;
 +        break;
 +    case SYSREG_PMOVSCLR_EL0:
 +        val = env->cp15.c9_pmovsr;
 +        break;
 +    case SYSREG_PMSELR_EL0:
 +        val = env->cp15.c9_pmselr;
 +        break;
 +    case SYSREG_PMINTENCLR_EL1:
 +        val = env->cp15.c9_pminten;
 +        break;
 +    case SYSREG_PMCCFILTR_EL0:
 +        val = env->cp15.pmccfiltr_el0;
 +        break;
 +    case SYSREG_PMCNTENSET_EL0:
 +        val = env->cp15.c9_pmcnten;
 +        break;
 +    case SYSREG_PMUSERENR_EL0:
 +        val = env->cp15.c9_pmuserenr;
 +        break;
 +    case SYSREG_PMCEID0_EL0:
 +    case SYSREG_PMCEID1_EL0:
 +        /* We can't really count anything yet, declare all events invalid */
 +        val = 0;
 +        break;
      case SYSREG_OSLSR_EL1:
          val = env->cp15.oslsr_el1;
          break;
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
      return 0;
  }
 +static void pmu_update_irq(CPUARMState *env)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +    qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
 +            (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
 +}
 +
 +static bool pmu_event_supported(uint16_t number)
 +{
 +    return false;
 +}
 +
 +/* Returns true if the counter (pass 31 for PMCCNTR) should count events using
 + * the current EL, security state, and register configuration.
 + */
 +static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
 +{
 +    uint64_t filter;
 +    bool enabled, filtered = true;
 +    int el = arm_current_el(env);
 +
 +    enabled = (env->cp15.c9_pmcr & PMCRE) &&
 +              (env->cp15.c9_pmcnten & (1 << counter));
 +
 +    if (counter == 31) {
 +        filter = env->cp15.pmccfiltr_el0;
 +    } else {
 +        filter = env->cp15.c14_pmevtyper[counter];
 +    }
 +
 +    if (el == 0) {
 +        filtered = filter & PMXEVTYPER_U;
 +    } else if (el == 1) {
 +        filtered = filter & PMXEVTYPER_P;
 +    }
 +
 +    if (counter != 31) {
 +        /*
 +         * If not checking PMCCNTR, ensure the counter is setup to an event we
 +         * support
 +         */
 +        uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
 +        if (!pmu_event_supported(event)) {
 +            return false;
 +        }
 +    }
 +
 +    return enabled && !filtered;
 +}
 +
 +static void pmswinc_write(CPUARMState *env, uint64_t value)
 +{
 +    unsigned int i;
 +    for (i = 0; i < pmu_num_counters(env); i++) {
 +        /* Increment a counter's count iff: */
 +        if ((value & (1 << i)) && /* counter's bit is set */
 +                /* counter is enabled and not filtered */
 +                pmu_counter_enabled(env, i) &&
 +                /* counter is SW_INCR */
 +                (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
 +            /*
 +             * Detect if this write causes an overflow since we can't predict
 +             * PMSWINC overflows like we can for other events
 +             */
 +            uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
 +
 +            if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) {
 +                env->cp15.c9_pmovsr |= (1 << i);
 +                pmu_update_irq(env);
 +            }
 +
 +            env->cp15.c14_pmevcntr[i] = new_pmswinc;
 +        }
 +    }
 +}
 +
  static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
  {
      ARMCPU *arm_cpu = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
                             val);
      switch (reg) {
 +    case SYSREG_PMCCNTR_EL0:
 +        pmu_op_start(env);
 +        env->cp15.c15_ccnt = val;
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMCR_EL0:
 +        pmu_op_start(env);
 +
 +        if (val & PMCRC) {
 +            /* The counter has been reset */
 +            env->cp15.c15_ccnt = 0;
 +        }
 +
 +        if (val & PMCRP) {
 +            unsigned int i;
 +            for (i = 0; i < pmu_num_counters(env); i++) {
 +                env->cp15.c14_pmevcntr[i] = 0;
 +            }
 +        }
 +
 +        env->cp15.c9_pmcr &= ~PMCR_WRITEABLE_MASK;
 +        env->cp15.c9_pmcr |= (val & PMCR_WRITEABLE_MASK);
 +
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMUSERENR_EL0:
 +        env->cp15.c9_pmuserenr = val & 0xf;
 +        break;
 +    case SYSREG_PMCNTENSET_EL0:
 +        env->cp15.c9_pmcnten |= (val & pmu_counter_mask(env));
 +        break;
 +    case SYSREG_PMCNTENCLR_EL0:
 +        env->cp15.c9_pmcnten &= ~(val & pmu_counter_mask(env));
 +        break;
 +    case SYSREG_PMINTENCLR_EL1:
 +        pmu_op_start(env);
 +        env->cp15.c9_pminten |= val;
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMOVSCLR_EL0:
 +        pmu_op_start(env);
 +        env->cp15.c9_pmovsr &= ~val;
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMSWINC_EL0:
 +        pmu_op_start(env);
 +        pmswinc_write(env, val);
 +        pmu_op_finish(env);
 +        break;
 +    case SYSREG_PMSELR_EL0:
 +        env->cp15.c9_pmselr = val & 0x1f;
 +        break;
 +    case SYSREG_PMCCFILTR_EL0:
 +        pmu_op_start(env);
 +        env->cp15.pmccfiltr_el0 = val & PMCCFILTR_EL0;
 +        pmu_op_finish(env);
 +        break;
      case SYSREG_OSLAR_EL1:
          env->cp15.oslsr_el1 = val & 1;
          break;
 --
 .20.1

-New patch
+[PULL 16/27] target/arm: Avoid goto_tb if we're trying to exit to the main loop
+Currently gen_jmp_tb() assumes that if it is called then the jump it
+is handling is the only reason that we might be trying to end the TB,
+so it will use goto_tb if it can.  This is usually the case: mostly
+"we did something that means we must end the TB" happens on a
+non-branch instruction.  However, there are cases where we decide
+early in handling an instruction that we need to end the TB and
+return to the main loop, and then the insn is a complex one that
+involves gen_jmp_tb().  For instance, for M-profile FP instructions,
+in gen_preserve_fp_state() which is called from vfp_access_check() we
+want to force an exit to the main loop if lazy state preservation is
+active and we are in icount mode.
+Make gen_jmp_tb() look at the current value of is_jmp, and only use
+goto_tb if the previous is_jmp was DISAS_NEXT or DISAS_TOO_MANY.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-2-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 34 +++++++++++++++++++++++++++++++++-
+file changed, 33 insertions(+), 1 deletion(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
+         /* An indirect jump so that we still trigger the debug exception.  */
+         gen_set_pc_im(s, dest);
+         s->base.is_jmp = DISAS_JUMP;
+-    } else {
++        return;
++    }
++    switch (s->base.is_jmp) {
++    case DISAS_NEXT:
++    case DISAS_TOO_MANY:
++    case DISAS_NORETURN:
++        /*
++         * The normal case: just go to the destination TB.
++         * NB: NORETURN happens if we generate code like
++         *    gen_brcondi(l);
++         *    gen_jmp();
++         *    gen_set_label(l);
++         *    gen_jmp();
++         * on the second call to gen_jmp().
++         */
+         gen_goto_tb(s, tbno, dest);
++        break;
++    case DISAS_UPDATE_NOCHAIN:
++    case DISAS_UPDATE_EXIT:
++        /*
++         * We already decided we're leaving the TB for some other reason.
++         * Avoid using goto_tb so we really do exit back to the main loop
++         * and don't chain to another TB.
++         */
++        gen_set_pc_im(s, dest);
++        gen_goto_ptr();
++        s->base.is_jmp = DISAS_NORETURN;
++        break;
++    default:
++        /*
++         * We shouldn't be emitting code for a jump and also have
++         * is_jmp set to one of the special cases like DISAS_SWI.
++         */
++        g_assert_not_reached();
+     }
+ }
+--
+.20.1

-New patch
+[PULL 17/27] target/arm: Enforce that FPDSCR.LTPSIZE is 4 on inbound migration
+Architecturally, for an M-profile CPU with the LOB feature the
+LTPSIZE field in FPDSCR is always constant 4.  QEMU's implementation
+enforces this everywhere, except that we don't check that it is true
+in incoming migration data.
+We're going to add come in gen_update_fp_context() which relies on
+the "always 4" property.  Since this is TCG-only, we don't actually
+need to be robust to bogus incoming migration data, and the effect of
+it being wrong would be wrong code generation rather than a QEMU
+crash; but if it did ever happen somehow it would be very difficult
+to track down the cause.  Add a check so that we fail the inbound
+migration if the FPDSCR.LTPSIZE value is incorrect.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-3-peter.maydell@linaro.org
+---
+ target/arm/machine.c | 13 +++++++++++++
+file changed, 13 insertions(+)
+diff --git a/target/arm/machine.c b/target/arm/machine.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/machine.c
++++ b/target/arm/machine.c
+@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
+     hw_breakpoint_update_all(cpu);
+     hw_watchpoint_update_all(cpu);
++    /*
++     * TCG gen_update_fp_context() relies on the invariant that
++     * FPDSCR.LTPSIZE is constant 4 for M-profile with the LOB extension;
++     * forbid bogus incoming data with some other value.
++     */
++    if (arm_feature(env, ARM_FEATURE_M) && cpu_isar_feature(aa32_lob, cpu)) {
++        if (extract32(env->v7m.fpdscr[M_REG_NS],
++                      FPCR_LTPSIZE_SHIFT, FPCR_LTPSIZE_LENGTH) != 4 ||
++            extract32(env->v7m.fpdscr[M_REG_S],
++                      FPCR_LTPSIZE_SHIFT, FPCR_LTPSIZE_LENGTH) != 4) {
++            return -1;
++        }
++    }
+     if (!kvm_enabled()) {
+         pmu_op_finish(&cpu->env);
+     }
+--
+.20.1

-New patch
+[PULL 18/27] target/arm: Add TB flag for "MVE insns not predicated"
+Our current codegen for MVE always calls out to helper functions,
 because some byte lanes might be predicated.  The common case is that
 in fact there is no predication active and all lanes should be
 updated together, so we can produce better code by detecting that and
 using the TCG generic vector infrastructure.
 Add a TB flag that is set when we can guarantee that there is no
 active MVE predication, and a bool in the DisasContext.  Subsequent
 patches will use this flag to generate improved code for some
 instructions.
 In most cases when the predication state changes we simply end the TB
 after that instruction.  For the code called from vfp_access_check()
 that handles lazy state preservation and creating a new FP context,
 we can usually avoid having to try to end the TB because luckily the
 new value of the flag following the register changes in those
 sequences doesn't depend on any runtime decisions.  We do have to end
 the TB if the guest has enabled lazy FP state preservation but not
 automatic state preservation, but this is an odd corner case that is
 not going to be common in real-world code.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210913095440.13462-4-peter.maydell@linaro.org
 ---
  target/arm/cpu.h              |  4 +++-
  target/arm/translate.h        |  2 ++
  target/arm/helper.c           | 33 +++++++++++++++++++++++++++++++++
  target/arm/translate-m-nocp.c |  8 +++++++-
  target/arm/translate-mve.c    | 13 ++++++++++++-
  target/arm/translate-vfp.c    | 33 +++++++++++++++++++++++++++------
  target/arm/translate.c        |  8 ++++++++
 files changed, 92 insertions(+), 9 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef ARMCPU ArchCPU;
   * | TBFLAG_AM32 |          +-----+----------+
   * |             |                |TBFLAG_M32|
   * +-------------+----------------+----------+
 - *  31         23                5 4        0
 + *  31         23                6 5        0
   *
   * Unless otherwise noted, these bits are cached in env->hflags.
   */
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_M32, LSPACT, 2, 1)                 /* Not cached. */
  FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 3, 1)     /* Not cached. */
  /* Set if FPCCR.S does not match current security state */
  FIELD(TBFLAG_M32, FPCCR_S_WRONG, 4, 1)          /* Not cached. */
 +/* Set if MVE insns are definitely not predicated by VPR or LTPSIZE */
 +FIELD(TBFLAG_M32, MVE_NO_PRED, 5, 1)            /* Not cached. */
  /*
   * Bit usage when in AArch64 state
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      bool align_mem;
      /* True if PSTATE.IL is set */
      bool pstate_il;
 +    /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
 +    bool mve_no_pred;
      /*
       * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
       *  < 0, set by the current instruction.
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
  #endif
  }
 +static bool mve_no_pred(CPUARMState *env)
 +{
 +    /*
 +     * Return true if there is definitely no predication of MVE
 +     * instructions by VPR or LTPSIZE. (Returning false even if there
 +     * isn't any predication is OK; generated code will just be
 +     * a little worse.)
 +     * If the CPU does not implement MVE then this TB flag is always 0.
 +     *
 +     * NOTE: if you change this logic, the "recalculate s->mve_no_pred"
 +     * logic in gen_update_fp_context() needs to be updated to match.
 +     *
 +     * We do not include the effect of the ECI bits here -- they are
 +     * tracked in other TB flags. This simplifies the logic for
 +     * "when did we emit code that changes the MVE_NO_PRED TB flag
 +     * and thus need to end the TB?".
 +     */
 +    if (cpu_isar_feature(aa32_mve, env_archcpu(env))) {
 +        return false;
 +    }
 +    if (env->v7m.vpr) {
 +        return false;
 +    }
 +    if (env->v7m.ltpsize < 4) {
 +        return false;
 +    }
 +    return true;
 +}
 +
  void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                            target_ulong *cs_base, uint32_t *pflags)
  {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
              if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
                  DP_TBFLAG_M32(flags, LSPACT, 1);
              }
 +
 +            if (mve_no_pred(env)) {
 +                DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
 +            }
          } else {
              /*
               * Note that XSCALE_CPAR shares bits with VECSTRIDE.
 diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-m-nocp.c
 +++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
      clear_eci_state(s);
 -    /* End the TB, because we have updated FP control bits */
 +    /*
 +     * End the TB, because we have updated FP control bits,
 +     * and possibly VPR or LTPSIZE.
 +     */
      s->base.is_jmp = DISAS_UPDATE_EXIT;
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
          store_cpu_field(control, v7m.control[M_REG_S]);
          tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
          gen_helper_vfp_set_fpscr(cpu_env, tmp);
 +        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
          tcg_temp_free_i32(tmp);
          tcg_temp_free_i32(sfpa);
          break;
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
          }
          tmp = loadfn(s, opaque, true);
          store_cpu_field(tmp, v7m.vpr);
 +        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
          break;
      case ARM_VFP_P0:
      {
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
          tcg_gen_deposit_i32(vpr, vpr, tmp,
                              R_V7M_VPR_P0_SHIFT, R_V7M_VPR_P0_LENGTH);
          store_cpu_field(vpr, v7m.vpr);
 +        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
          tcg_temp_free_i32(tmp);
          break;
      }
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_LOGIC(VORR, gen_helper_mve_vorr)
  DO_LOGIC(VORN, gen_helper_mve_vorn)
  DO_LOGIC(VEOR, gen_helper_mve_veor)
 -DO_LOGIC(VPSEL, gen_helper_mve_vpsel)
 +static bool trans_VPSEL(DisasContext *s, arg_2op *a)
 +{
 +    /* This insn updates predication bits */
 +    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
 +    return do_2op(s, a, gen_helper_mve_vpsel);
 +}
  #define DO_2OP(INSN, FN) \
      static bool trans_##INSN(DisasContext *s, arg_2op *a)       \
@@ -XXX,XX +XXX,XX @@ static bool trans_VPNOT(DisasContext *s, arg_VPNOT *a)
      }
      gen_helper_mve_vpnot(cpu_env);
 +    /* This insn updates predication bits */
 +    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
      mve_update_eci(s);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool do_vcmp(DisasContext *s, arg_vcmp *a, MVEGenCmpFn *fn)
          /* VPT */
          gen_vpst(s, a->mask);
      }
 +    /* This insn updates predication bits */
 +    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
      mve_update_eci(s);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool do_vcmp_scalar(DisasContext *s, arg_vcmp_scalar *a,
          /* VPT */
          gen_vpst(s, a->mask);
      }
 +    /* This insn updates predication bits */
 +    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
      mve_update_eci(s);
      return true;
  }
 diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.c
 +++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static inline long vfp_f16_offset(unsigned reg, bool top)
   * Generate code for M-profile lazy FP state preservation if needed;
   * this corresponds to the pseudocode PreserveFPState() function.
   */
 -static void gen_preserve_fp_state(DisasContext *s)
 +static void gen_preserve_fp_state(DisasContext *s, bool skip_context_update)
  {
      if (s->v7m_lspact) {
          /*
@@ -XXX,XX +XXX,XX @@ static void gen_preserve_fp_state(DisasContext *s)
           * any further FP insns in this TB.
           */
          s->v7m_lspact = false;
 +        /*
 +         * The helper might have zeroed VPR, so we do not know the
 +         * correct value for the MVE_NO_PRED TB flag any more.
 +         * If we're about to create a new fp context then that
 +         * will precisely determine the MVE_NO_PRED value (see
 +         * gen_update_fp_context()). Otherwise, we must:
 +         *  - set s->mve_no_pred to false, so this instruction
 +         *    is generated to use helper functions
 +         *  - end the TB now, without chaining to the next TB
 +         */
 +        if (skip_context_update || !s->v7m_new_fp_ctxt_needed) {
 +            s->mve_no_pred = false;
 +            s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
 +        }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
              TCGv_i32 z32 = tcg_const_i32(0);
              store_cpu_field(z32, v7m.vpr);
          }
 -
          /*
 -         * We don't need to arrange to end the TB, because the only
 -         * parts of FPSCR which we cache in the TB flags are the VECLEN
 -         * and VECSTRIDE, and those don't exist for M-profile.
 +         * We just updated the FPSCR and VPR. Some of this state is cached
 +         * in the MVE_NO_PRED TB flag. We want to avoid having to end the
 +         * TB here, which means we need the new value of the MVE_NO_PRED
 +         * flag to be exactly known here and the same for all executions.
 +         * Luckily FPDSCR.LTPSIZE is always constant 4 and the VPR is
 +         * always set to 0, so the new MVE_NO_PRED flag is always 1
 +         * if and only if we have MVE.
 +         *
 +         * (The other FPSCR state cached in TB flags is VECLEN and VECSTRIDE,
 +         * but those do not exist for M-profile, so are not relevant here.)
           */
 +        s->mve_no_pred = dc_isar_feature(aa32_mve, s);
          if (s->v8m_secure) {
              bits |= R_V7M_CONTROL_SFPA_MASK;
@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
      /* Handle M-profile lazy FP state mechanics */
      /* Trigger lazy-state preservation if necessary */
 -    gen_preserve_fp_state(s);
 +    gen_preserve_fp_state(s, skip_context_update);
      if (!skip_context_update) {
          /* Update ownership of FP context and create new FP context if needed */
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_DLS(DisasContext *s, arg_DLS *a)
          /* DLSTP: set FPSCR.LTPSIZE */
          tmp = tcg_const_i32(a->size);
          store_cpu_field(tmp, v7m.ltpsize);
 +        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
      }
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
          assert(ok);
          tmp = tcg_const_i32(a->size);
          store_cpu_field(tmp, v7m.ltpsize);
 +        /*
 +         * LTPSIZE updated, but MVE_NO_PRED will always be the same thing (0)
 +         * when we take this upcoming exit from this TB, so gen_jmp_tb() is OK.
 +         */
      }
      gen_jmp_tb(s, s->base.pc_next, 1);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCTP(DisasContext *s, arg_VCTP *a)
      gen_helper_mve_vctp(cpu_env, masklen);
      tcg_temp_free_i32(masklen);
      tcg_temp_free_i32(rn_shifted);
 +    /* This insn updates predication bits */
 +    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
      mve_update_eci(s);
      return true;
  }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
          dc->v7m_new_fp_ctxt_needed =
              EX_TBFLAG_M32(tb_flags, NEW_FP_CTXT_NEEDED);
          dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
 +        dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
      } else {
          dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
          dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
 --
 .20.1

-New patch
+[PULL 19/27] target/arm: Optimize MVE logic ops
+When not predicating, implement the MVE bitwise logical insns
+directly using TCG vector operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-5-peter.maydell@linaro.org
+---
+ target/arm/translate-mve.c | 51 +++++++++++++++++++++++++++-----------
+file changed, 36 insertions(+), 15 deletions(-)
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr mve_qreg_ptr(unsigned reg)
+     return ret;
+ }
++static bool mve_no_predication(DisasContext *s)
++{
++    /*
++     * Return true if we are executing the entire MVE instruction
++     * with no predication or partial-execution, and so we can safely
++     * use an inline TCG vector implementation.
++     */
++    return s->eci == 0 && s->mve_no_pred;
++}
++
+ static bool mve_check_qreg_bank(DisasContext *s, int qmask)
+ {
+     /*
+@@ -XXX,XX +XXX,XX @@ static bool trans_VNEG_fp(DisasContext *s, arg_1op *a)
+     return do_1op(s, a, fns[a->size]);
+ }
+-static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn)
++static bool do_2op_vec(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn,
++                       GVecGen3Fn *vecfn)
+ {
+     TCGv_ptr qd, qn, qm;
+@@ -XXX,XX +XXX,XX @@ static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn)
+         return true;
+     }
+-    qd = mve_qreg_ptr(a->qd);
+-    qn = mve_qreg_ptr(a->qn);
+-    qm = mve_qreg_ptr(a->qm);
+-    fn(cpu_env, qd, qn, qm);
+-    tcg_temp_free_ptr(qd);
+-    tcg_temp_free_ptr(qn);
+-    tcg_temp_free_ptr(qm);
++    if (vecfn && mve_no_predication(s)) {
++        vecfn(a->size, mve_qreg_offset(a->qd), mve_qreg_offset(a->qn),
++              mve_qreg_offset(a->qm), 16, 16);
++    } else {
++        qd = mve_qreg_ptr(a->qd);
++        qn = mve_qreg_ptr(a->qn);
++        qm = mve_qreg_ptr(a->qm);
++        fn(cpu_env, qd, qn, qm);
++        tcg_temp_free_ptr(qd);
++        tcg_temp_free_ptr(qn);
++        tcg_temp_free_ptr(qm);
++    }
+     mve_update_eci(s);
+     return true;
+ }
+-#define DO_LOGIC(INSN, HELPER)                                  \
++static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn *fn)
++{
++    return do_2op_vec(s, a, fn, NULL);
++}
++
++#define DO_LOGIC(INSN, HELPER, VECFN)                           \
+     static bool trans_##INSN(DisasContext *s, arg_2op *a)       \
+     {                                                           \
+-        return do_2op(s, a, HELPER);                            \
++        return do_2op_vec(s, a, HELPER, VECFN);                 \
+     }
+-DO_LOGIC(VAND, gen_helper_mve_vand)
+-DO_LOGIC(VBIC, gen_helper_mve_vbic)
+-DO_LOGIC(VORR, gen_helper_mve_vorr)
+-DO_LOGIC(VORN, gen_helper_mve_vorn)
+-DO_LOGIC(VEOR, gen_helper_mve_veor)
++DO_LOGIC(VAND, gen_helper_mve_vand, tcg_gen_gvec_and)
++DO_LOGIC(VBIC, gen_helper_mve_vbic, tcg_gen_gvec_andc)
++DO_LOGIC(VORR, gen_helper_mve_vorr, tcg_gen_gvec_or)
++DO_LOGIC(VORN, gen_helper_mve_vorn, tcg_gen_gvec_orc)
++DO_LOGIC(VEOR, gen_helper_mve_veor, tcg_gen_gvec_xor)
+ static bool trans_VPSEL(DisasContext *s, arg_2op *a)
+ {
+--
+.20.1

-New patch
+[PULL 20/27] target/arm: Optimize MVE arithmetic ops
+Optimize MVE arithmetic ops when we have a TCG
+vector operation we can use.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-6-peter.maydell@linaro.org
+---
+ target/arm/translate-mve.c | 20 +++++++++++---------
+file changed, 11 insertions(+), 9 deletions(-)
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VPSEL(DisasContext *s, arg_2op *a)
+     return do_2op(s, a, gen_helper_mve_vpsel);
+ }
+-#define DO_2OP(INSN, FN) \
++#define DO_2OP_VEC(INSN, FN, VECFN)                             \
+     static bool trans_##INSN(DisasContext *s, arg_2op *a)       \
+     {                                                           \
+         static MVEGenTwoOpFn * const fns[] = {                  \
+@@ -XXX,XX +XXX,XX @@ static bool trans_VPSEL(DisasContext *s, arg_2op *a)
+             gen_helper_mve_##FN##w,                             \
+             NULL,                                               \
+         };                                                      \
+-        return do_2op(s, a, fns[a->size]);                      \
++        return do_2op_vec(s, a, fns[a->size], VECFN);           \
+     }
+-DO_2OP(VADD, vadd)
+-DO_2OP(VSUB, vsub)
+-DO_2OP(VMUL, vmul)
++#define DO_2OP(INSN, FN) DO_2OP_VEC(INSN, FN, NULL)
++
++DO_2OP_VEC(VADD, vadd, tcg_gen_gvec_add)
++DO_2OP_VEC(VSUB, vsub, tcg_gen_gvec_sub)
++DO_2OP_VEC(VMUL, vmul, tcg_gen_gvec_mul)
+ DO_2OP(VMULH_S, vmulhs)
+ DO_2OP(VMULH_U, vmulhu)
+ DO_2OP(VRMULH_S, vrmulhs)
+ DO_2OP(VRMULH_U, vrmulhu)
+-DO_2OP(VMAX_S, vmaxs)
+-DO_2OP(VMAX_U, vmaxu)
+-DO_2OP(VMIN_S, vmins)
+-DO_2OP(VMIN_U, vminu)
++DO_2OP_VEC(VMAX_S, vmaxs, tcg_gen_gvec_smax)
++DO_2OP_VEC(VMAX_U, vmaxu, tcg_gen_gvec_umax)
++DO_2OP_VEC(VMIN_S, vmins, tcg_gen_gvec_smin)
++DO_2OP_VEC(VMIN_U, vminu, tcg_gen_gvec_umin)
+ DO_2OP(VABD_S, vabds)
+ DO_2OP(VABD_U, vabdu)
+ DO_2OP(VHADD_S, vhadds)
+--
+.20.1

-[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+[PULL 21/27] target/arm: Optimize MVE VNEG, VABS
-From: Alex Bennée <alex.bennee@linaro.org>
+Optimize the MVE VNEG and VABS insns by using TCG
 vector ops when possible.
-All the hard work is already done by vfp_expand_imm, we just need to
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-make sure we pick up the correct size.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210913095440.13462-7-peter.maydell@linaro.org
 ---
  target/arm/translate-mve.c | 32 ++++++++++++++++++++++----------
 file changed, 22 insertions(+), 10 deletions(-)
-Cc: qemu-stable@nongnu.org
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 20 +++++++++++++++++---
 file changed, 17 insertions(+), 3 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/translate-mve.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
      return true;
  }
 -static bool do_1op(DisasContext *s, arg_1op *a, MVEGenOneOpFn fn)
 +static bool do_1op_vec(DisasContext *s, arg_1op *a, MVEGenOneOpFn fn,
 +                       GVecGen2Fn vecfn)
  {
-     int rd = extract32(insn, 0, 5);
+     TCGv_ptr qd, qm;
-     int imm8 = extract32(insn, 13, 8);
--    int is_double = extract32(insn, 22, 2);
+@@ -XXX,XX +XXX,XX @@ static bool do_1op(DisasContext *s, arg_1op *a, MVEGenOneOpFn fn)
-+    int type = extract32(insn, 22, 2);
+         return true;
      uint64_t imm;
      TCGv_i64 tcg_res;
 +    TCGMemOp sz;
 -    if (is_double > 1) {
 +    switch (type) {
 +    case 0:
 +        sz = MO_32;
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
-         return;
+-    qd = mve_qreg_ptr(a->qd);
 -    qm = mve_qreg_ptr(a->qm);
 -    fn(cpu_env, qd, qm);
 -    tcg_temp_free_ptr(qd);
 -    tcg_temp_free_ptr(qm);
 +    if (vecfn && mve_no_predication(s)) {
 +        vecfn(a->size, mve_qreg_offset(a->qd), mve_qreg_offset(a->qm), 16, 16);
 +    } else {
 +        qd = mve_qreg_ptr(a->qd);
 +        qm = mve_qreg_ptr(a->qm);
 +        fn(cpu_env, qd, qm);
 +        tcg_temp_free_ptr(qd);
 +        tcg_temp_free_ptr(qm);
 +    }
      mve_update_eci(s);
      return true;
  }
 -#define DO_1OP(INSN, FN)                                        \
 +static bool do_1op(DisasContext *s, arg_1op *a, MVEGenOneOpFn fn)
 +{
 +    return do_1op_vec(s, a, fn, NULL);
 +}
 +
 +#define DO_1OP_VEC(INSN, FN, VECFN)                             \
      static bool trans_##INSN(DisasContext *s, arg_1op *a)       \
      {                                                           \
          static MVEGenOneOpFn * const fns[] = {                  \
@@ -XXX,XX +XXX,XX @@ static bool do_1op(DisasContext *s, arg_1op *a, MVEGenOneOpFn fn)
              gen_helper_mve_##FN##w,                             \
              NULL,                                               \
          };                                                      \
 -        return do_1op(s, a, fns[a->size]);                      \
 +        return do_1op_vec(s, a, fns[a->size], VECFN);           \
      }
--    imm = vfp_expand_imm(MO_32 + is_double, imm8);
++#define DO_1OP(INSN, FN) DO_1OP_VEC(INSN, FN, NULL)
-+    imm = vfp_expand_imm(sz, imm8);
++
+ DO_1OP(VCLZ, vclz)
-     tcg_res = tcg_const_i64(imm);
+ DO_1OP(VCLS, vcls)
-     write_fp_dreg(s, rd, tcg_res);
+-DO_1OP(VABS, vabs)
 -DO_1OP(VNEG, vneg)
 +DO_1OP_VEC(VABS, vabs, tcg_gen_gvec_abs)
 +DO_1OP_VEC(VNEG, vneg, tcg_gen_gvec_neg)
  DO_1OP(VQABS, vqabs)
  DO_1OP(VQNEG, vqneg)
  DO_1OP(VMAXA, vmaxa)
 --
-.17.0
+.20.1

-New patch
+[PULL 22/27] target/arm: Optimize MVE VDUP
+Optimize the MVE VDUP insns by using TCG vector ops when possible.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-8-peter.maydell@linaro.org
+---
+ target/arm/translate-mve.c | 12 ++++++++----
+file changed, 8 insertions(+), 4 deletions(-)
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
+         return true;
+     }
+-    qd = mve_qreg_ptr(a->qd);
+     rt = load_reg(s, a->rt);
+-    tcg_gen_dup_i32(a->size, rt, rt);
+-    gen_helper_mve_vdup(cpu_env, qd, rt);
+-    tcg_temp_free_ptr(qd);
++    if (mve_no_predication(s)) {
++        tcg_gen_gvec_dup_i32(a->size, mve_qreg_offset(a->qd), 16, 16, rt);
++    } else {
++        qd = mve_qreg_ptr(a->qd);
++        tcg_gen_dup_i32(a->size, rt, rt);
++        gen_helper_mve_vdup(cpu_env, qd, rt);
++        tcg_temp_free_ptr(qd);
++    }
+     tcg_temp_free_i32(rt);
+     mve_update_eci(s);
+     return true;
+--
+.20.1

-[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+[PULL 23/27] target/arm: Optimize MVE VMVN
-From: Alex Bennée <alex.bennee@linaro.org>
+Optimize the MVE VMVN insn by using TCG vector ops when possible.
-Reported by Coverity (CID1390635). We ensure this for uint_to_float
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 later on so we might as well mirror that.
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210913095440.13462-9-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- fpu/softfloat.c | 2 +-
+ target/arm/translate-mve.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/target/arm/translate-mve.c
-+++ b/fpu/softfloat.c
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VREV64(DisasContext *s, arg_1op *a)
- static FloatParts int_to_float(int64_t a, float_status *status)
+ static bool trans_VMVN(DisasContext *s, arg_1op *a)
  {
--    FloatParts r;
+-    return do_1op(s, a, gen_helper_mve_vmvn);
-+    FloatParts r = {};
++    return do_1op_vec(s, a, gen_helper_mve_vmvn, tcg_gen_gvec_not);
-     if (a == 0) {
+ }
-         r.cls = float_class_zero;
-         r.sign = false;
+ static bool trans_VABS_fp(DisasContext *s, arg_1op *a)
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+[PULL 24/27] target/arm: Optimize MVE VSHL, VSHR immediate forms
-From: Richard Henderson <richard.henderson@linaro.org>
+Optimize the MVE VSHL and VSHR immediate forms by using TCG vector
 ops when possible.
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-10-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 30 ++++++++++++++----------------
+ target/arm/translate-mve.c | 83 +++++++++++++++++++++++++++++---------
-file changed, 14 insertions(+), 16 deletions(-)
+file changed, 63 insertions(+), 20 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/translate-mve.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
-     return v;
+     return do_1imm(s, a, fn);
  }
-+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+-static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
 -                      bool negateshift)
 +static bool do_2shift_vec(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
 +                          bool negateshift, GVecGen2iFn vecfn)
  {
      TCGv_ptr qd, qm;
      int shift = a->shift;
@@ -XXX,XX +XXX,XX @@ static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
          shift = -shift;
      }
 -    qd = mve_qreg_ptr(a->qd);
 -    qm = mve_qreg_ptr(a->qm);
 -    fn(cpu_env, qd, qm, tcg_constant_i32(shift));
 -    tcg_temp_free_ptr(qd);
 -    tcg_temp_free_ptr(qm);
 +    if (vecfn && mve_no_predication(s)) {
 +        vecfn(a->size, mve_qreg_offset(a->qd), mve_qreg_offset(a->qm),
 +              shift, 16, 16);
 +    } else {
 +        qd = mve_qreg_ptr(a->qd);
 +        qm = mve_qreg_ptr(a->qm);
 +        fn(cpu_env, qd, qm, tcg_constant_i32(shift));
 +        tcg_temp_free_ptr(qd);
 +        tcg_temp_free_ptr(qm);
 +    }
      mve_update_eci(s);
      return true;
  }
 -#define DO_2SHIFT(INSN, FN, NEGATESHIFT)                         \
 -    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
 -    {                                                           \
 -        static MVEGenTwoOpShiftFn * const fns[] = {             \
 -            gen_helper_mve_##FN##b,                             \
 -            gen_helper_mve_##FN##h,                             \
 -            gen_helper_mve_##FN##w,                             \
 -            NULL,                                               \
 -        };                                                      \
 -        return do_2shift(s, a, fns[a->size], NEGATESHIFT);      \
 +static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
 +                      bool negateshift)
 +{
-+    TCGv_i32 v = tcg_temp_new_i32();
++    return do_2shift_vec(s, a, fn, negateshift, NULL);
 +
 +    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
 +    return v;
 +}
 +
- /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
++#define DO_2SHIFT_VEC(INSN, FN, NEGATESHIFT, VECFN)                     \
-  * If SVE is not enabled, then there are only 128 bits in the vector.
++    static bool trans_##INSN(DisasContext *s, arg_2shift *a)            \
-  */
++    {                                                                   \
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
++        static MVEGenTwoOpShiftFn * const fns[] = {                     \
- static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
++            gen_helper_mve_##FN##b,                                     \
- {
++            gen_helper_mve_##FN##h,                                     \
-     TCGv_ptr fpst = NULL;
++            gen_helper_mve_##FN##w,                                     \
--    TCGv_i32 tcg_op = tcg_temp_new_i32();
++            NULL,                                                       \
-+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
++        };                                                              \
-     TCGv_i32 tcg_res = tcg_temp_new_i32();
++        return do_2shift_vec(s, a, fns[a->size], NEGATESHIFT, VECFN);   \
 -    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
      switch (opcode) {
      case 0x0: /* FMOV */
          tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
          tcg_temp_free_i64(tcg_op2);
          tcg_temp_free_i64(tcg_res);
      } else {
 -        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
 -        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
 +        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
          TCGv_i64 tcg_res = tcg_temp_new_i64();
 -        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
-     if (is_scalar) {
+-DO_2SHIFT(VSHLI, vshli_u, false)
--        TCGv_i32 tcg_op = tcg_temp_new_i32();
++#define DO_2SHIFT(INSN, FN, NEGATESHIFT)        \
-+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
++    DO_2SHIFT_VEC(INSN, FN, NEGATESHIFT, NULL)
-         TCGv_i32 tcg_res = tcg_temp_new_i32();
++
++static void do_gvec_shri_s(unsigned vece, uint32_t dofs, uint32_t aofs,
--        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
++                           int64_t shift, uint32_t oprsz, uint32_t maxsz)
--
++{
-         switch (fpop) {
++    /*
-         case 0x1a: /* FCVTNS */
++     * We get here with a negated shift count, and we must handle
-         case 0x1b: /* FCVTMS */
++     * shifts by the element size, which tcg_gen_gvec_sari() does not do.
 +     */
 +    shift = -shift;
 +    if (shift == (8 << vece)) {
 +        shift--;
 +    }
 +    tcg_gen_gvec_sari(vece, dofs, aofs, shift, oprsz, maxsz);
 +}
 +
 +static void do_gvec_shri_u(unsigned vece, uint32_t dofs, uint32_t aofs,
 +                           int64_t shift, uint32_t oprsz, uint32_t maxsz)
 +{
 +    /*
 +     * We get here with a negated shift count, and we must handle
 +     * shifts by the element size, which tcg_gen_gvec_shri() does not do.
 +     */
 +    shift = -shift;
 +    if (shift == (8 << vece)) {
 +        tcg_gen_gvec_dup_imm(vece, dofs, oprsz, maxsz, 0);
 +    } else {
 +        tcg_gen_gvec_shri(vece, dofs, aofs, shift, oprsz, maxsz);
 +    }
 +}
 +
 +DO_2SHIFT_VEC(VSHLI, vshli_u, false, tcg_gen_gvec_shli)
  DO_2SHIFT(VQSHLI_S, vqshli_s, false)
  DO_2SHIFT(VQSHLI_U, vqshli_u, false)
  DO_2SHIFT(VQSHLUI, vqshlui_s, false)
  /* These right shifts use a left-shift helper with negated shift count */
 -DO_2SHIFT(VSHRI_S, vshli_s, true)
 -DO_2SHIFT(VSHRI_U, vshli_u, true)
 +DO_2SHIFT_VEC(VSHRI_S, vshli_s, true, do_gvec_shri_s)
 +DO_2SHIFT_VEC(VSHRI_U, vshli_u, true, do_gvec_shri_u)
  DO_2SHIFT(VRSHRI_S, vrshli_s, true)
  DO_2SHIFT(VRSHRI_U, vrshli_u, true)
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+[PULL 25/27] target/arm: Optimize MVE VSHLL and VMOVL
-From: Richard Henderson <richard.henderson@linaro.org>
+Optimize the MVE VSHLL insns by using TCG vector ops when possible.
 This includes the VMOVL insn, which we handle in mve.decode as "VSHLL
 with zero shift count".
-Cc: qemu-stable@nongnu.org
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210913095440.13462-11-peter.maydell@linaro.org
 ---
- target/arm/helper.h        |  6 +++
+ target/arm/translate-mve.c | 67 +++++++++++++++++++++++++++++++++-----
- target/arm/helper.c        | 38 ++++++++++++++-
+file changed, 59 insertions(+), 8 deletions(-)
  target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 files changed, 122 insertions(+), 18 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/translate-mve.c
-+++ b/target/arm/helper.h
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_SCALAR(VQSHL_U_scalar, vqshli_u)
- DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+ DO_2SHIFT_SCALAR(VQRSHL_S_scalar, vqrshli_s)
- DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
+ DO_2SHIFT_SCALAR(VQRSHL_U_scalar, vqrshli_u)
- DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
-+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+-#define DO_VSHLL(INSN, FN)                                      \
-+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+-    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
-+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+-    {                                                           \
-+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
+-        static MVEGenTwoOpShiftFn * const fns[] = {             \
- DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
+-            gen_helper_mve_##FN##b,                             \
- DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
+-            gen_helper_mve_##FN##h,                             \
- DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
+-        };                                                      \
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
+-        return do_2shift(s, a, fns[a->size], false);            \
- DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
++#define DO_VSHLL(INSN, FN)                                              \
- DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
++    static bool trans_##INSN(DisasContext *s, arg_2shift *a)            \
- DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
++    {                                                                   \
-+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
++        static MVEGenTwoOpShiftFn * const fns[] = {                     \
-+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
++            gen_helper_mve_##FN##b,                                     \
++            gen_helper_mve_##FN##h,                                     \
- DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
++        };                                                              \
- DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
++        return do_2shift_vec(s, a, fns[a->size], false, do_gvec_##FN);  \
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+     }
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
++/*
-+++ b/target/arm/helper.c
++ * For the VSHLL vector helpers, the vece is the size of the input
-@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
++ * (ie MO_8 or MO_16); the helpers want to work in the output size.
- #undef VFP_CONV_FIX_A64
++ * The shift count can be 0..<input size>, inclusive. (0 is VMOVL.)
++ */
- /* Conversion to/from f16 can overflow to infinity before/after scaling.
++static void do_gvec_vshllbs(unsigned vece, uint32_t dofs, uint32_t aofs,
-- * Therefore we convert to f64 (which does not round), scale,
++                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
 - * and then convert f64 to f16 (which may round).
 + * Therefore we convert to f64, scale, and then convert f64 to f16; or
 + * vice versa for conversion to integer.
 + *
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
-+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
++    unsigned ovece = vece + 1;
 +    unsigned ibits = vece == MO_8 ? 8 : 16;
 +    tcg_gen_gvec_shli(ovece, dofs, aofs, ibits, oprsz, maxsz);
 +    tcg_gen_gvec_sari(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
 +}
 +
-+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
++static void do_gvec_vshllbu(unsigned vece, uint32_t dofs, uint32_t aofs,
 +                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
 +{
-+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
++    unsigned ovece = vece + 1;
 +    tcg_gen_gvec_andi(ovece, dofs, aofs,
 +                      ovece == MO_16 ? 0xff : 0xffff, oprsz, maxsz);
 +    tcg_gen_gvec_shli(ovece, dofs, dofs, shift, oprsz, maxsz);
 +}
 +
- static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
++static void do_gvec_vshllts(unsigned vece, uint32_t dofs, uint32_t aofs,
- {
++                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
-+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
++    unsigned ovece = vece + 1;
 +    unsigned ibits = vece == MO_8 ? 8 : 16;
 +    if (shift == 0) {
 +        tcg_gen_gvec_sari(ovece, dofs, aofs, ibits, oprsz, maxsz);
 +    } else {
 +        tcg_gen_gvec_andi(ovece, dofs, aofs,
 +                          ovece == MO_16 ? 0xff00 : 0xffff0000, oprsz, maxsz);
 +        tcg_gen_gvec_sari(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
 +    }
 +}
 +
-+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
++static void do_gvec_vshlltu(unsigned vece, uint32_t dofs, uint32_t aofs,
 +                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
 +{
-+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
++    unsigned ovece = vece + 1;
 +    unsigned ibits = vece == MO_8 ? 8 : 16;
 +    if (shift == 0) {
 +        tcg_gen_gvec_shri(ovece, dofs, aofs, ibits, oprsz, maxsz);
 +    } else {
 +        tcg_gen_gvec_andi(ovece, dofs, aofs,
 +                          ovece == MO_16 ? 0xff00 : 0xffff0000, oprsz, maxsz);
 +        tcg_gen_gvec_shri(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
 +    }
 +}
 +
-+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+ DO_VSHLL(VSHLL_BS, vshllbs)
-+{
+ DO_VSHLL(VSHLL_BU, vshllbu)
-+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+ DO_VSHLL(VSHLL_TS, vshllts)
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
 -        if (is_double) {
 -            TCGv_i64 tcg_double = tcg_temp_new_i64();
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = tcg_temp_new_i64();
              if (is_signed) {
                  gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
      } else {
          TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 -        if (is_double) {
 -            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
 +        switch (type) {
 +        case 1: /* float64 */
 +            tcg_double = read_fp_dreg(s, rn);
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+[PULL 26/27] target/arm: Optimize MVE VSLI and VSRI
-In float-to-integer conversion, if the floating point input
+Optimize the MVE shift-and-insert insns by using TCG
-converts exactly to the largest or smallest integer that
+vector ops when possible.
 fits in to the result type, this is not an overflow.
 In this situation we were producing the correct result value,
 but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Fix the boundary case to take the right half of the if()
-statements.
-This fixes a regression from 2.11 introduced by the softfloat
-refactoring.
-Cc: qemu-stable@nongnu.org
-Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+Message-id: 20210913095440.13462-12-peter.maydell@linaro.org
 ---
- fpu/softfloat.c | 4 ++--
+ target/arm/translate-mve.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/target/arm/translate-mve.c
-+++ b/fpu/softfloat.c
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_VEC(VSHRI_U, vshli_u, true, do_gvec_shri_u)
-             r = UINT64_MAX;
+ DO_2SHIFT(VRSHRI_S, vrshli_s, true)
-         }
+ DO_2SHIFT(VRSHRI_U, vrshli_u, true)
-         if (p.sign) {
--            if (r < -(uint64_t) min) {
+-DO_2SHIFT(VSRI, vsri, false)
-+            if (r <= -(uint64_t) min) {
+-DO_2SHIFT(VSLI, vsli, false)
-                 return -r;
++DO_2SHIFT_VEC(VSRI, vsri, false, gen_gvec_sri)
-             } else {
++DO_2SHIFT_VEC(VSLI, vsli, false, gen_gvec_sli)
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
-                 return min;
+ #define DO_2SHIFT_FP(INSN, FN)                                  \
-             }
+     static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
          } else {
 -            if (r < max) {
 +            if (r <= max) {
                  return r;
              } else {
                  s->float_exception_flags = orig_flags | float_flag_invalid;
 --
-.17.0
+.20.1

-[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
+[PULL 27/27] target/arm: Optimize MVE 1op-immediate insns
-Usually the logging of the CPU state produced by -d cpu is sufficient
+Optimize the MVE 1op-immediate insns (VORR, VBIC, VMOV) to
-to diagnose problems, but sometimes you want to see the state of
+use TCG vector ops when possible.
 the floating point registers as well. We don't want to enable that
 by default as it adds a lot of extra data to the log; instead,
 allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
+Message-id: 20210913095440.13462-13-peter.maydell@linaro.org
 ---
- include/qemu/log.h   | 1 +
+ target/arm/translate-mve.c | 26 +++++++++++++++++++++-----
- accel/tcg/cpu-exec.c | 9 ++++++---
+file changed, 21 insertions(+), 5 deletions(-)
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/log.h b/include/qemu/log.h
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/log.h
+--- a/target/arm/translate-mve.c
-+++ b/include/qemu/log.h
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VADDLV(DisasContext *s, arg_VADDLV *a)
- #define CPU_LOG_PAGE       (1 << 14)
+     return true;
- /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
+ }
- #define CPU_LOG_TB_OP_IND  (1 << 16)
-+#define CPU_LOG_TB_FPU     (1 << 17)
+-static bool do_1imm(DisasContext *s, arg_1imm *a, MVEGenOneOpImmFn *fn)
++static bool do_1imm(DisasContext *s, arg_1imm *a, MVEGenOneOpImmFn *fn,
- /* Lock output for a series of related logs.  Since this is not needed
++                    GVecGen2iFn *vecfn)
-  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
+ {
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+     TCGv_ptr qd;
-index XXXXXXX..XXXXXXX 100644
+     uint64_t imm;
---- a/accel/tcg/cpu-exec.c
+@@ -XXX,XX +XXX,XX @@ static bool do_1imm(DisasContext *s, arg_1imm *a, MVEGenOneOpImmFn *fn)
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
+     imm = asimd_imm_const(a->imm, a->cmode, a->op);
-     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
-         && qemu_log_in_addr_range(itb->pc)) {
+-    qd = mve_qreg_ptr(a->qd);
-         qemu_log_lock();
+-    fn(cpu_env, qd, tcg_constant_i64(imm));
-+        int flags = 0;
+-    tcg_temp_free_ptr(qd);
-+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
++    if (vecfn && mve_no_predication(s)) {
-+            flags |= CPU_DUMP_FPU;
++        vecfn(MO_64, mve_qreg_offset(a->qd), mve_qreg_offset(a->qd),
-+        }
++              imm, 16, 16);
- #if defined(TARGET_I386)
++    } else {
--        log_cpu_state(cpu, CPU_DUMP_CCOP);
++        qd = mve_qreg_ptr(a->qd);
--#else
++        fn(cpu_env, qd, tcg_constant_i64(imm));
--        log_cpu_state(cpu, 0);
++        tcg_temp_free_ptr(qd);
-+        flags |= CPU_DUMP_CCOP;
++    }
- #endif
+     mve_update_eci(s);
-+        log_cpu_state(cpu, flags);
+     return true;
-         qemu_log_unlock();
+ }
 +static void gen_gvec_vmovi(unsigned vece, uint32_t dofs, uint32_t aofs,
 +                           int64_t c, uint32_t oprsz, uint32_t maxsz)
 +{
 +    tcg_gen_gvec_dup_imm(vece, dofs, oprsz, maxsz, c);
 +}
 +
  static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
  {
      /* Handle decode of cmode/op here between VORR/VBIC/VMOV */
      MVEGenOneOpImmFn *fn;
 +    GVecGen2iFn *vecfn;
      if ((a->cmode & 1) && a->cmode < 12) {
          if (a->op) {
@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
               * so the VBIC becomes a logical AND operation.
               */
              fn = gen_helper_mve_vandi;
 +            vecfn = tcg_gen_gvec_andi;
          } else {
              fn = gen_helper_mve_vorri;
 +            vecfn = tcg_gen_gvec_ori;
          }
      } else {
          /* There is one unallocated cmode/op combination in this space */
@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
          }
          /* asimd_imm_const() sorts out VMVNI vs VMOVI for us */
          fn = gen_helper_mve_vmovi;
 +        vecfn = gen_gvec_vmovi;
      }
- #endif /* DEBUG_DISAS */
+-    return do_1imm(s, a, fn);
-diff --git a/util/log.c b/util/log.c
++    return do_1imm(s, a, fn, vecfn);
-index XXXXXXX..XXXXXXX 100644
+ }
---- a/util/log.c
-+++ b/util/log.c
+ static bool do_2shift_vec(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.17.0
+.20.1

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0

arm queue: big stuff here is my MVE codegen optimisation,
and Alex's Apple Silicon hvf support.

-- PMM

The following changes since commit 7adb961995a3744f51396502b33ad04a56a317c3:

Merge remote-tracking branch 'remotes/dgilbert-gitlab/tags/pull-virtiofs-20210916' into staging (2021-09-19 18:53:29 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210920

for you to fetch changes up to 1dc5a60bfe406bc1122d68cbdefda38d23134b27:

target/arm: Optimize MVE 1op-immediate insns (2021-09-20 14:18:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * Optimize codegen for MVE when predication not active
 * hvf: Add Apple Silicon support
 * hw/intc: Set GIC maintenance interrupt level to only 0 or 1
 * Fix mishandling of MVE FPSCR.LTPSIZE reset for usermode emulator
 * elf2dmp: Fix coverity nits

----------------------------------------------------------------
Alexander Graf (7):
      arm: Move PMC register definitions to internals.h
      hvf: Add execute to dirty log permission bitmap
      hvf: Introduce hvf_arch_init() callback
      hvf: Add Apple Silicon support
      hvf: arm: Implement PSCI handling
      arm: Add Hypervisor.framework build target
      hvf: arm: Add rudimentary PMC support

Peter Collingbourne (1):
      arm/hvf: Add a WFI handler

Peter Maydell (18):
      elf2dmp: Check curl_easy_setopt() return value
      elf2dmp: Fail cleanly if PDB file specifies zero block_size
      target/arm: Don't skip M-profile reset entirely in user mode
      target/arm: Always clear exclusive monitor on reset
      target/arm: Consolidate ifdef blocks in reset
      hvf: arm: Implement -cpu host
      target/arm: Avoid goto_tb if we're trying to exit to the main loop
      target/arm: Enforce that FPDSCR.LTPSIZE is 4 on inbound migration
      target/arm: Add TB flag for "MVE insns not predicated"
      target/arm: Optimize MVE logic ops
      target/arm: Optimize MVE arithmetic ops
      target/arm: Optimize MVE VNEG, VABS
      target/arm: Optimize MVE VDUP
      target/arm: Optimize MVE VMVN
      target/arm: Optimize MVE VSHL, VSHR immediate forms
      target/arm: Optimize MVE VSHLL and VMOVL
      target/arm: Optimize MVE VSLI and VSRI
      target/arm: Optimize MVE 1op-immediate insns

Shashi Mallela (1):
      hw/intc: Set GIC maintenance interrupt level to only 0 or 1

Coverity points out that we aren't checking the return value
from curl_easy_setopt().

Fixes: Coverity CID 1458895
Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
Message-id: 20210910170656.366592-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/download.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/contrib/elf2dmp/download.c b/contrib/elf2dmp/download.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/download.c
+++ b/contrib/elf2dmp/download.c
@@ -XXX,XX +XXX,XX @@ int download_url(const char *name, const char *url)
         goto out_curl;
     }
 
-    curl_easy_setopt(curl, CURLOPT_URL, url);
-    curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL);
-    curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
-    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1);
-    curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0);
-
-    if (curl_easy_perform(curl) != CURLE_OK) {
-        err = 1;
-        fclose(file);
+    if (curl_easy_setopt(curl, CURLOPT_URL, url) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_WRITEDATA, file) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK
+            || curl_easy_perform(curl) != CURLE_OK) {
         unlink(name);
-        goto out_curl;
+        fclose(file);
+        err = 1;
+    } else {
+        err = fclose(file);
     }
 
-    err = fclose(file);
-
 out_curl:
     curl_easy_cleanup(curl);
 
-- 
2.20.1

Coverity points out that if the PDB file we're trying to read
has a header specifying a block_size of zero then we will
end up trying to divide by zero in pdb_ds_read_file().
Check for this and fail cleanly instead.

Fixes: Coverity CID 1458869
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Viktor Prutyanov <viktor.prutyanov@phystech.edu>
Message-id: 20210910170656.366592-3-philmd@redhat.com
Message-Id: <20210901143910.17112-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
 contrib/elf2dmp/pdb.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/contrib/elf2dmp/pdb.c b/contrib/elf2dmp/pdb.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pdb.c
+++ b/contrib/elf2dmp/pdb.c
@@ -XXX,XX +XXX,XX @@ out_symbols:
 
 static int pdb_reader_ds_init(struct pdb_reader *r, PDB_DS_HEADER *hdr)
 {
+    if (hdr->block_size == 0) {
+        return 1;
+    }
+
     memset(r->file_used, 0, sizeof(r->file_used));
     r->ds.header = hdr;
     r->ds.toc = pdb_ds_read(hdr, (uint32_t *)((uint8_t *)hdr +
-- 
2.20.1

Currently all of the M-profile specific code in arm_cpu_reset() is
inside a !defined(CONFIG_USER_ONLY) ifdef block.  This is
unintentional: it happened because originally the only
M-profile-specific handling was the setup of the initial SP and PC
from the vector table, which is system-emulation only.  But then we
added a lot of other M-profile setup to the same "if (ARM_FEATURE_M)"
code block without noticing that it was all inside a not-user-mode
ifdef.  This has generally been harmless, but with the addition of
v8.1M low-overhead-loop support we ran into a problem: the reset of
FPSCR.LTPSIZE to 4 was only being done for system emulation mode, so
if a user-mode guest tried to execute the LE instruction it would
incorrectly take a UsageFault.

Adjust the ifdefs so only the really system-emulation specific parts
are covered.  Because this means we now run some reset code that sets
up initial values in the FPCCR and similar FPU related registers,
explicitly set up the registers controlling FPU context handling in
user-emulation mode so that the FPU works by design and not by
chance.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/613
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210914120725.24992-2-peter.maydell@linaro.org
---
 target/arm/cpu.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->uncached_cpsr = ARM_CPU_MODE_SVC;
     }
     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
+#endif
 
     if (arm_feature(env, ARM_FEATURE_M)) {
+#ifndef CONFIG_USER_ONLY
         uint32_t initial_msp; /* Loaded from 0x0 */
         uint32_t initial_pc; /* Loaded from 0x4 */
         uint8_t *rom;
         uint32_t vecbase;
+#endif
 
         if (cpu_isar_feature(aa32_lob, cpu)) {
             /*
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
         }
+
+#ifndef CONFIG_USER_ONLY
         /* Unlike A/R profile, M profile defines the reset LR value */
         env->regs[14] = 0xffffffff;
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->regs[13] = initial_msp & 0xFFFFFFFC;
         env->regs[15] = initial_pc & ~1;
         env->thumb = initial_pc & 1;
+#else
+        /*
+         * For user mode we run non-secure and with access to the FPU.
+         * The FPU context is active (ie does not need further setup)
+         * and is owned by non-secure.
+         */
+        env->v7m.secure = false;
+        env->v7m.nsacr = 0xcff;
+        env->v7m.cpacr[M_REG_NS] = 0xf0ffff;
+        env->v7m.fpccr[M_REG_S] &=
+            ~(R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK);
+        env->v7m.control[M_REG_S] |= R_V7M_CONTROL_FPCA_MASK;
+#endif
     }
 
+#ifndef CONFIG_USER_ONLY
     /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
      * executing as AArch32 then check if highvecs are enabled and
      * adjust the PC accordingly.
-- 
2.20.1

There's no particular reason why the exclusive monitor should
be only cleared on reset in system emulation mode. It doesn't
hurt if it isn't cleared in user mode, but we might as well
reduce the amount of code we have that's inside an ifdef.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210914120725.24992-3-peter.maydell@linaro.org
---
 target/arm/cpu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->regs[15] = 0xFFFF0000;
     }
 
+    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
+#endif
+
     /* M profile requires that reset clears the exclusive monitor;
      * A profile does not, but clearing it makes more sense than having it
      * set with an exclusive access on address zero.
      */
     arm_clear_exclusive(env);
 
-    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
-#endif
-
     if (arm_feature(env, ARM_FEATURE_PMSA)) {
         if (cpu->pmsav7_dregion > 0) {
             if (arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.20.1

Move an ifndef CONFIG_USER_ONLY code block up in arm_cpu_reset() so
it can be merged with another earlier one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210914120725.24992-4-peter.maydell@linaro.org
---
 target/arm/cpu.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->uncached_cpsr = ARM_CPU_MODE_SVC;
     }
     env->daif = PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F;
+
+    /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
+     * executing as AArch32 then check if highvecs are enabled and
+     * adjust the PC accordingly.
+     */
+    if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
+        env->regs[15] = 0xFFFF0000;
+    }
+
+    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
 #endif
 
     if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
 #endif
     }
 
-#ifndef CONFIG_USER_ONLY
-    /* AArch32 has a hard highvec setting of 0xFFFF0000.  If we are currently
-     * executing as AArch32 then check if highvecs are enabled and
-     * adjust the PC accordingly.
-     */
-    if (A32_BANKED_CURRENT_REG_GET(env, sctlr) & SCTLR_V) {
-        env->regs[15] = 0xFFFF0000;
-    }
-
-    env->vfp.xregs[ARM_VFP_FPEXC] = 0;
-#endif
-
     /* M profile requires that reset clears the exclusive monitor;
      * A profile does not, but clearing it makes more sense than having it
      * set with an exclusive access on address zero.
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

During sbsa acs level 3 testing, it is seen that the GIC maintenance
interrupts are not triggered and the related test cases fail.  This
is because we were incorrectly passing the value of the MISR register
(from maintenance_interrupt_state()) to qemu_set_irq() as the level
argument, whereas the device on the other end of this irq line
expects a 0/1 value.

Fix the logic to pass a 0/1 level indication, rather than a
0/not-0 value.

Fixes: c5fc89b36c0 ("hw/intc/arm_gicv3: Implement gicv3_cpuif_virt_update()")
Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210915205809.59068-1-shashi.mallela@linaro.org
[PMM: tweaked commit message; collapsed nested if()s into one]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_cpuif_virt_update(GICv3CPUState *cs)
         }
     }
 
-    if (cs->ich_hcr_el2 & ICH_HCR_EL2_EN) {
-        maintlevel = maintenance_interrupt_state(cs);
+    if ((cs->ich_hcr_el2 & ICH_HCR_EL2_EN) &&
+        maintenance_interrupt_state(cs) != 0) {
+        maintlevel = 1;
     }
 
     trace_gicv3_cpuif_virt_set_irqs(gicv3_redist_affid(cs), fiqlevel,
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

We will need PMC register definitions in accel specific code later.
Move all constant definitions to common arm headers so we can reuse
them.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-2-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 44 ++++++++++++++++++++++++++++++++++++++++++
 target/arm/helper.c    | 44 ------------------------------------------
 2 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ enum MVEECIState {
     /* All other values reserved */
 };
 
+/* Definitions for the PMU registers */
+#define PMCRN_MASK  0xf800
+#define PMCRN_SHIFT 11
+#define PMCRLC  0x40
+#define PMCRDP  0x20
+#define PMCRX   0x10
+#define PMCRD   0x8
+#define PMCRC   0x4
+#define PMCRP   0x2
+#define PMCRE   0x1
+/*
+ * Mask of PMCR bits writeable by guest (not including WO bits like C, P,
+ * which can be written as 1 to trigger behaviour but which stay RAZ).
+ */
+#define PMCR_WRITEABLE_MASK (PMCRLC | PMCRDP | PMCRX | PMCRD | PMCRE)
+
+#define PMXEVTYPER_P          0x80000000
+#define PMXEVTYPER_U          0x40000000
+#define PMXEVTYPER_NSK        0x20000000
+#define PMXEVTYPER_NSU        0x10000000
+#define PMXEVTYPER_NSH        0x08000000
+#define PMXEVTYPER_M          0x04000000
+#define PMXEVTYPER_MT         0x02000000
+#define PMXEVTYPER_EVTCOUNT   0x0000ffff
+#define PMXEVTYPER_MASK       (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
+                               PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
+                               PMXEVTYPER_M | PMXEVTYPER_MT | \
+                               PMXEVTYPER_EVTCOUNT)
+
+#define PMCCFILTR             0xf8000000
+#define PMCCFILTR_M           PMXEVTYPER_M
+#define PMCCFILTR_EL0         (PMCCFILTR | PMCCFILTR_M)
+
+static inline uint32_t pmu_num_counters(CPUARMState *env)
+{
+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
+}
+
+/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
+static inline uint64_t pmu_counter_mask(CPUARMState *env)
+{
+  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
+}
+
 #endif
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 
-/* Definitions for the PMU registers */
-#define PMCRN_MASK  0xf800
-#define PMCRN_SHIFT 11
-#define PMCRLC  0x40
-#define PMCRDP  0x20
-#define PMCRX   0x10
-#define PMCRD   0x8
-#define PMCRC   0x4
-#define PMCRP   0x2
-#define PMCRE   0x1
-/*
- * Mask of PMCR bits writeable by guest (not including WO bits like C, P,
- * which can be written as 1 to trigger behaviour but which stay RAZ).
- */
-#define PMCR_WRITEABLE_MASK (PMCRLC | PMCRDP | PMCRX | PMCRD | PMCRE)
-
-#define PMXEVTYPER_P          0x80000000
-#define PMXEVTYPER_U          0x40000000
-#define PMXEVTYPER_NSK        0x20000000
-#define PMXEVTYPER_NSU        0x10000000
-#define PMXEVTYPER_NSH        0x08000000
-#define PMXEVTYPER_M          0x04000000
-#define PMXEVTYPER_MT         0x02000000
-#define PMXEVTYPER_EVTCOUNT   0x0000ffff
-#define PMXEVTYPER_MASK       (PMXEVTYPER_P | PMXEVTYPER_U | PMXEVTYPER_NSK | \
-                               PMXEVTYPER_NSU | PMXEVTYPER_NSH | \
-                               PMXEVTYPER_M | PMXEVTYPER_MT | \
-                               PMXEVTYPER_EVTCOUNT)
-
-#define PMCCFILTR             0xf8000000
-#define PMCCFILTR_M           PMXEVTYPER_M
-#define PMCCFILTR_EL0         (PMCCFILTR | PMCCFILTR_M)
-
-static inline uint32_t pmu_num_counters(CPUARMState *env)
-{
-  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
-}
-
-/* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
-static inline uint64_t pmu_counter_mask(CPUARMState *env)
-{
-  return (1 << 31) | ((1 << pmu_num_counters(env)) - 1);
-}
-
 typedef struct pm_event {
     uint16_t number; /* PMEVTYPER.evtCount is 16 bits wide */
     /* If the event is supported on this CPU (used to generate PMCEID[01]) */
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

Hvf's permission bitmap during and after dirty logging does not include
the HV_MEMORY_EXEC permission. At least on Apple Silicon, this leads to
instruction faults once dirty logging was enabled.

Add the bit to make it work properly.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-3-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static void hvf_set_dirty_tracking(MemoryRegionSection *section, bool on)
     if (on) {
         slot->flags |= HVF_SLOT_LOG;
         hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ);
+                      HV_MEMORY_READ | HV_MEMORY_EXEC);
     /* stop tracking region*/
     } else {
         slot->flags &= ~HVF_SLOT_LOG;
         hv_vm_protect((uintptr_t)slot->start, (size_t)slot->size,
-                      HV_MEMORY_READ | HV_MEMORY_WRITE);
+                      HV_MEMORY_READ | HV_MEMORY_WRITE | HV_MEMORY_EXEC);
     }
 }
 
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

We will need to install a migration helper for the ARM hvf backend.
Let's introduce an arch callback for the overall hvf init chain to
do so.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-4-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/hvf_int.h  | 1 +
 accel/hvf/hvf-accel-ops.c | 3 ++-
 target/i386/hvf/hvf.c     | 5 +++++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf_int.h
+++ b/include/sysemu/hvf_int.h
@@ -XXX,XX +XXX,XX @@ struct hvf_vcpu_state {
 };
 
 void assert_hvf_ok(hv_return_t ret);
+int hvf_arch_init(void);
 int hvf_arch_init_vcpu(CPUState *cpu);
 void hvf_arch_vcpu_destroy(CPUState *cpu);
 int hvf_vcpu_exec(CPUState *);
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static int hvf_accel_init(MachineState *ms)
 
     hvf_state = s;
     memory_listener_register(&hvf_memory_listener, &address_space_memory);
-    return 0;
+
+    return hvf_arch_init();
 }
 
 static void hvf_accel_class_init(ObjectClass *oc, void *data)
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static inline bool apic_bus_freq_is_known(CPUX86State *env)
     return env->apic_bus_freq != 0;
 }
 
+int hvf_arch_init(void)
+{
+    return 0;
+}
+
 int hvf_arch_init_vcpu(CPUState *cpu)
 {
     X86CPU *x86cpu = X86_CPU(cpu);
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

With Apple Silicon available to the masses, it's a good time to add support
for driving its virtualization extensions from QEMU.

This patch adds all necessary architecture specific code to get basic VMs
working, including save/restore.

Known limitations:

- WFI handling is missing (follows in later patch)
  - No watchpoint/breakpoint support

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-5-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build                 |   1 +
 include/sysemu/hvf_int.h    |  10 +-
 accel/hvf/hvf-accel-ops.c   |   9 +
 target/arm/hvf/hvf.c        | 794 ++++++++++++++++++++++++++++++++++++
 target/i386/hvf/hvf.c       |   5 +
 MAINTAINERS                 |   5 +
 target/arm/hvf/trace-events |  10 +
 7 files changed, 833 insertions(+), 1 deletion(-)
 create mode 100644 target/arm/hvf/hvf.c
 create mode 100644 target/arm/hvf/trace-events

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if have_system or have_user
     'accel/tcg',
     'hw/core',
     'target/arm',
+    'target/arm/hvf',
     'target/hppa',
     'target/i386',
     'target/i386/kvm',
diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf_int.h
+++ b/include/sysemu/hvf_int.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HVF_INT_H
 #define HVF_INT_H
 
+#ifdef __aarch64__
+#include <Hypervisor/Hypervisor.h>
+#else
 #include <Hypervisor/hv.h>
+#endif
 
 /* hvf_slot flags */
 #define HVF_SLOT_LOG (1 << 0)
@@ -XXX,XX +XXX,XX @@ struct HVFState {
     int num_slots;
 
     hvf_vcpu_caps *hvf_caps;
+    uint64_t vtimer_offset;
 };
 extern HVFState *hvf_state;
 
 struct hvf_vcpu_state {
-    int fd;
+    uint64_t fd;
+    void *exit;
+    bool vtimer_masked;
 };
 
 void assert_hvf_ok(hv_return_t ret);
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *);
 hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
 int hvf_put_registers(CPUState *);
 int hvf_get_registers(CPUState *);
+void hvf_kick_vcpu_thread(CPUState *cpu);
 
 #endif
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@
 
 HVFState *hvf_state;
 
+#ifdef __aarch64__
+#define HV_VM_DEFAULT NULL
+#endif
+
 /* Memory slots */
 
 hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
@@ -XXX,XX +XXX,XX @@ static int hvf_init_vcpu(CPUState *cpu)
     pthread_sigmask(SIG_BLOCK, NULL, &set);
     sigdelset(&set, SIG_IPI);
 
+#ifdef __aarch64__
+    r = hv_vcpu_create(&cpu->hvf->fd, (hv_vcpu_exit_t **)&cpu->hvf->exit, NULL);
+#else
     r = hv_vcpu_create((hv_vcpuid_t *)&cpu->hvf->fd, HV_VCPU_DEFAULT);
+#endif
     cpu->vcpu_dirty = 1;
     assert_hvf_ok(r);
 
@@ -XXX,XX +XXX,XX @@ static void hvf_accel_ops_class_init(ObjectClass *oc, void *data)
     AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
 
     ops->create_vcpu_thread = hvf_start_vcpu_thread;
+    ops->kick_vcpu_thread = hvf_kick_vcpu_thread;
 
     ops->synchronize_post_reset = hvf_cpu_synchronize_post_reset;
     ops->synchronize_post_init = hvf_cpu_synchronize_post_init;
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU Hypervisor.framework support for Apple Silicon
+
+ * Copyright 2020 Alexander Graf <agraf@csgraf.de>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu-common.h"
+#include "qemu/error-report.h"
+
+#include "sysemu/runstate.h"
+#include "sysemu/hvf.h"
+#include "sysemu/hvf_int.h"
+#include "sysemu/hw_accel.h"
+
+#include <mach/mach_time.h>
+
+#include "exec/address-spaces.h"
+#include "hw/irq.h"
+#include "qemu/main-loop.h"
+#include "sysemu/cpus.h"
+#include "target/arm/cpu.h"
+#include "target/arm/internals.h"
+#include "trace/trace-target_arm_hvf.h"
+#include "migration/vmstate.h"
+
+#define HVF_SYSREG(crn, crm, op0, op1, op2) \
+        ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
+#define PL1_WRITE_MASK 0x4
+
+#define SYSREG(op0, op1, crn, crm, op2) \
+    ((op0 << 20) | (op2 << 17) | (op1 << 14) | (crn << 10) | (crm << 1))
+#define SYSREG_MASK           SYSREG(0x3, 0x7, 0xf, 0xf, 0x7)
+#define SYSREG_OSLAR_EL1      SYSREG(2, 0, 1, 0, 4)
+#define SYSREG_OSLSR_EL1      SYSREG(2, 0, 1, 1, 4)
+#define SYSREG_OSDLR_EL1      SYSREG(2, 0, 1, 3, 4)
+#define SYSREG_CNTPCT_EL0     SYSREG(3, 3, 14, 0, 1)
+
+#define WFX_IS_WFE (1 << 0)
+
+#define TMR_CTL_ENABLE  (1 << 0)
+#define TMR_CTL_IMASK   (1 << 1)
+#define TMR_CTL_ISTATUS (1 << 2)
+
+typedef struct HVFVTimer {
+    /* Vtimer value during migration and paused state */
+    uint64_t vtimer_val;
+} HVFVTimer;
+
+static HVFVTimer vtimer;
+
+struct hvf_reg_match {
+    int reg;
+    uint64_t offset;
+};
+
+static const struct hvf_reg_match hvf_reg_match[] = {
+    { HV_REG_X0,   offsetof(CPUARMState, xregs[0]) },
+    { HV_REG_X1,   offsetof(CPUARMState, xregs[1]) },
+    { HV_REG_X2,   offsetof(CPUARMState, xregs[2]) },
+    { HV_REG_X3,   offsetof(CPUARMState, xregs[3]) },
+    { HV_REG_X4,   offsetof(CPUARMState, xregs[4]) },
+    { HV_REG_X5,   offsetof(CPUARMState, xregs[5]) },
+    { HV_REG_X6,   offsetof(CPUARMState, xregs[6]) },
+    { HV_REG_X7,   offsetof(CPUARMState, xregs[7]) },
+    { HV_REG_X8,   offsetof(CPUARMState, xregs[8]) },
+    { HV_REG_X9,   offsetof(CPUARMState, xregs[9]) },
+    { HV_REG_X10,  offsetof(CPUARMState, xregs[10]) },
+    { HV_REG_X11,  offsetof(CPUARMState, xregs[11]) },
+    { HV_REG_X12,  offsetof(CPUARMState, xregs[12]) },
+    { HV_REG_X13,  offsetof(CPUARMState, xregs[13]) },
+    { HV_REG_X14,  offsetof(CPUARMState, xregs[14]) },
+    { HV_REG_X15,  offsetof(CPUARMState, xregs[15]) },
+    { HV_REG_X16,  offsetof(CPUARMState, xregs[16]) },
+    { HV_REG_X17,  offsetof(CPUARMState, xregs[17]) },
+    { HV_REG_X18,  offsetof(CPUARMState, xregs[18]) },
+    { HV_REG_X19,  offsetof(CPUARMState, xregs[19]) },
+    { HV_REG_X20,  offsetof(CPUARMState, xregs[20]) },
+    { HV_REG_X21,  offsetof(CPUARMState, xregs[21]) },
+    { HV_REG_X22,  offsetof(CPUARMState, xregs[22]) },
+    { HV_REG_X23,  offsetof(CPUARMState, xregs[23]) },
+    { HV_REG_X24,  offsetof(CPUARMState, xregs[24]) },
+    { HV_REG_X25,  offsetof(CPUARMState, xregs[25]) },
+    { HV_REG_X26,  offsetof(CPUARMState, xregs[26]) },
+    { HV_REG_X27,  offsetof(CPUARMState, xregs[27]) },
+    { HV_REG_X28,  offsetof(CPUARMState, xregs[28]) },
+    { HV_REG_X29,  offsetof(CPUARMState, xregs[29]) },
+    { HV_REG_X30,  offsetof(CPUARMState, xregs[30]) },
+    { HV_REG_PC,   offsetof(CPUARMState, pc) },
+};
+
+static const struct hvf_reg_match hvf_fpreg_match[] = {
+    { HV_SIMD_FP_REG_Q0,  offsetof(CPUARMState, vfp.zregs[0]) },
+    { HV_SIMD_FP_REG_Q1,  offsetof(CPUARMState, vfp.zregs[1]) },
+    { HV_SIMD_FP_REG_Q2,  offsetof(CPUARMState, vfp.zregs[2]) },
+    { HV_SIMD_FP_REG_Q3,  offsetof(CPUARMState, vfp.zregs[3]) },
+    { HV_SIMD_FP_REG_Q4,  offsetof(CPUARMState, vfp.zregs[4]) },
+    { HV_SIMD_FP_REG_Q5,  offsetof(CPUARMState, vfp.zregs[5]) },
+    { HV_SIMD_FP_REG_Q6,  offsetof(CPUARMState, vfp.zregs[6]) },
+    { HV_SIMD_FP_REG_Q7,  offsetof(CPUARMState, vfp.zregs[7]) },
+    { HV_SIMD_FP_REG_Q8,  offsetof(CPUARMState, vfp.zregs[8]) },
+    { HV_SIMD_FP_REG_Q9,  offsetof(CPUARMState, vfp.zregs[9]) },
+    { HV_SIMD_FP_REG_Q10, offsetof(CPUARMState, vfp.zregs[10]) },
+    { HV_SIMD_FP_REG_Q11, offsetof(CPUARMState, vfp.zregs[11]) },
+    { HV_SIMD_FP_REG_Q12, offsetof(CPUARMState, vfp.zregs[12]) },
+    { HV_SIMD_FP_REG_Q13, offsetof(CPUARMState, vfp.zregs[13]) },
+    { HV_SIMD_FP_REG_Q14, offsetof(CPUARMState, vfp.zregs[14]) },
+    { HV_SIMD_FP_REG_Q15, offsetof(CPUARMState, vfp.zregs[15]) },
+    { HV_SIMD_FP_REG_Q16, offsetof(CPUARMState, vfp.zregs[16]) },
+    { HV_SIMD_FP_REG_Q17, offsetof(CPUARMState, vfp.zregs[17]) },
+    { HV_SIMD_FP_REG_Q18, offsetof(CPUARMState, vfp.zregs[18]) },
+    { HV_SIMD_FP_REG_Q19, offsetof(CPUARMState, vfp.zregs[19]) },
+    { HV_SIMD_FP_REG_Q20, offsetof(CPUARMState, vfp.zregs[20]) },
+    { HV_SIMD_FP_REG_Q21, offsetof(CPUARMState, vfp.zregs[21]) },
+    { HV_SIMD_FP_REG_Q22, offsetof(CPUARMState, vfp.zregs[22]) },
+    { HV_SIMD_FP_REG_Q23, offsetof(CPUARMState, vfp.zregs[23]) },
+    { HV_SIMD_FP_REG_Q24, offsetof(CPUARMState, vfp.zregs[24]) },
+    { HV_SIMD_FP_REG_Q25, offsetof(CPUARMState, vfp.zregs[25]) },
+    { HV_SIMD_FP_REG_Q26, offsetof(CPUARMState, vfp.zregs[26]) },
+    { HV_SIMD_FP_REG_Q27, offsetof(CPUARMState, vfp.zregs[27]) },
+    { HV_SIMD_FP_REG_Q28, offsetof(CPUARMState, vfp.zregs[28]) },
+    { HV_SIMD_FP_REG_Q29, offsetof(CPUARMState, vfp.zregs[29]) },
+    { HV_SIMD_FP_REG_Q30, offsetof(CPUARMState, vfp.zregs[30]) },
+    { HV_SIMD_FP_REG_Q31, offsetof(CPUARMState, vfp.zregs[31]) },
+};
+
+struct hvf_sreg_match {
+    int reg;
+    uint32_t key;
+    uint32_t cp_idx;
+};
+
+static struct hvf_sreg_match hvf_sreg_match[] = {
+    { HV_SYS_REG_DBGBVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR0_EL1, HVF_SYSREG(0, 0, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR0_EL1, HVF_SYSREG(0, 0, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR1_EL1, HVF_SYSREG(0, 1, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR1_EL1, HVF_SYSREG(0, 1, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR2_EL1, HVF_SYSREG(0, 2, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR2_EL1, HVF_SYSREG(0, 2, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR3_EL1, HVF_SYSREG(0, 3, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR3_EL1, HVF_SYSREG(0, 3, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR4_EL1, HVF_SYSREG(0, 4, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR4_EL1, HVF_SYSREG(0, 4, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR5_EL1, HVF_SYSREG(0, 5, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR5_EL1, HVF_SYSREG(0, 5, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR6_EL1, HVF_SYSREG(0, 6, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR6_EL1, HVF_SYSREG(0, 6, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR7_EL1, HVF_SYSREG(0, 7, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR7_EL1, HVF_SYSREG(0, 7, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR8_EL1, HVF_SYSREG(0, 8, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR8_EL1, HVF_SYSREG(0, 8, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR9_EL1, HVF_SYSREG(0, 9, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR9_EL1, HVF_SYSREG(0, 9, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR10_EL1, HVF_SYSREG(0, 10, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR10_EL1, HVF_SYSREG(0, 10, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR11_EL1, HVF_SYSREG(0, 11, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR11_EL1, HVF_SYSREG(0, 11, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR12_EL1, HVF_SYSREG(0, 12, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR12_EL1, HVF_SYSREG(0, 12, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR13_EL1, HVF_SYSREG(0, 13, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR13_EL1, HVF_SYSREG(0, 13, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR14_EL1, HVF_SYSREG(0, 14, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR14_EL1, HVF_SYSREG(0, 14, 14, 0, 7) },
+
+    { HV_SYS_REG_DBGBVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 4) },
+    { HV_SYS_REG_DBGBCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 5) },
+    { HV_SYS_REG_DBGWVR15_EL1, HVF_SYSREG(0, 15, 14, 0, 6) },
+    { HV_SYS_REG_DBGWCR15_EL1, HVF_SYSREG(0, 15, 14, 0, 7) },
+
+#ifdef SYNC_NO_RAW_REGS
+    /*
+     * The registers below are manually synced on init because they are
+     * marked as NO_RAW. We still list them to make number space sync easier.
+     */
+    { HV_SYS_REG_MDCCINT_EL1, HVF_SYSREG(0, 2, 2, 0, 0) },
+    { HV_SYS_REG_MIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 0) },
+    { HV_SYS_REG_MPIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 5) },
+    { HV_SYS_REG_ID_AA64PFR0_EL1, HVF_SYSREG(0, 4, 3, 0, 0) },
+#endif
+    { HV_SYS_REG_ID_AA64PFR1_EL1, HVF_SYSREG(0, 4, 3, 0, 2) },
+    { HV_SYS_REG_ID_AA64DFR0_EL1, HVF_SYSREG(0, 5, 3, 0, 0) },
+    { HV_SYS_REG_ID_AA64DFR1_EL1, HVF_SYSREG(0, 5, 3, 0, 1) },
+    { HV_SYS_REG_ID_AA64ISAR0_EL1, HVF_SYSREG(0, 6, 3, 0, 0) },
+    { HV_SYS_REG_ID_AA64ISAR1_EL1, HVF_SYSREG(0, 6, 3, 0, 1) },
+#ifdef SYNC_NO_MMFR0
+    /* We keep the hardware MMFR0 around. HW limits are there anyway */
+    { HV_SYS_REG_ID_AA64MMFR0_EL1, HVF_SYSREG(0, 7, 3, 0, 0) },
+#endif
+    { HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) },
+    { HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) },
+
+    { HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) },
+    { HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) },
+    { HV_SYS_REG_CPACR_EL1, HVF_SYSREG(1, 0, 3, 0, 2) },
+    { HV_SYS_REG_TTBR0_EL1, HVF_SYSREG(2, 0, 3, 0, 0) },
+    { HV_SYS_REG_TTBR1_EL1, HVF_SYSREG(2, 0, 3, 0, 1) },
+    { HV_SYS_REG_TCR_EL1, HVF_SYSREG(2, 0, 3, 0, 2) },
+
+    { HV_SYS_REG_APIAKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 0) },
+    { HV_SYS_REG_APIAKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 1) },
+    { HV_SYS_REG_APIBKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 2) },
+    { HV_SYS_REG_APIBKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 3) },
+    { HV_SYS_REG_APDAKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 0) },
+    { HV_SYS_REG_APDAKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 1) },
+    { HV_SYS_REG_APDBKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 2) },
+    { HV_SYS_REG_APDBKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 3) },
+    { HV_SYS_REG_APGAKEYLO_EL1, HVF_SYSREG(2, 3, 3, 0, 0) },
+    { HV_SYS_REG_APGAKEYHI_EL1, HVF_SYSREG(2, 3, 3, 0, 1) },
+
+    { HV_SYS_REG_SPSR_EL1, HVF_SYSREG(4, 0, 3, 0, 0) },
+    { HV_SYS_REG_ELR_EL1, HVF_SYSREG(4, 0, 3, 0, 1) },
+    { HV_SYS_REG_SP_EL0, HVF_SYSREG(4, 1, 3, 0, 0) },
+    { HV_SYS_REG_AFSR0_EL1, HVF_SYSREG(5, 1, 3, 0, 0) },
+    { HV_SYS_REG_AFSR1_EL1, HVF_SYSREG(5, 1, 3, 0, 1) },
+    { HV_SYS_REG_ESR_EL1, HVF_SYSREG(5, 2, 3, 0, 0) },
+    { HV_SYS_REG_FAR_EL1, HVF_SYSREG(6, 0, 3, 0, 0) },
+    { HV_SYS_REG_PAR_EL1, HVF_SYSREG(7, 4, 3, 0, 0) },
+    { HV_SYS_REG_MAIR_EL1, HVF_SYSREG(10, 2, 3, 0, 0) },
+    { HV_SYS_REG_AMAIR_EL1, HVF_SYSREG(10, 3, 3, 0, 0) },
+    { HV_SYS_REG_VBAR_EL1, HVF_SYSREG(12, 0, 3, 0, 0) },
+    { HV_SYS_REG_CONTEXTIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 1) },
+    { HV_SYS_REG_TPIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 4) },
+    { HV_SYS_REG_CNTKCTL_EL1, HVF_SYSREG(14, 1, 3, 0, 0) },
+    { HV_SYS_REG_CSSELR_EL1, HVF_SYSREG(0, 0, 3, 2, 0) },
+    { HV_SYS_REG_TPIDR_EL0, HVF_SYSREG(13, 0, 3, 3, 2) },
+    { HV_SYS_REG_TPIDRRO_EL0, HVF_SYSREG(13, 0, 3, 3, 3) },
+    { HV_SYS_REG_CNTV_CTL_EL0, HVF_SYSREG(14, 3, 3, 3, 1) },
+    { HV_SYS_REG_CNTV_CVAL_EL0, HVF_SYSREG(14, 3, 3, 3, 2) },
+    { HV_SYS_REG_SP_EL1, HVF_SYSREG(4, 1, 3, 4, 0) },
+};
+
+int hvf_get_registers(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    hv_return_t ret;
+    uint64_t val;
+    hv_simd_fp_uchar16_t fpval;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
+        ret = hv_vcpu_get_reg(cpu->hvf->fd, hvf_reg_match[i].reg, &val);
+        *(uint64_t *)((void *)env + hvf_reg_match[i].offset) = val;
+        assert_hvf_ok(ret);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
+        ret = hv_vcpu_get_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
+                                      &fpval);
+        memcpy((void *)env + hvf_fpreg_match[i].offset, &fpval, sizeof(fpval));
+        assert_hvf_ok(ret);
+    }
+
+    val = 0;
+    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPCR, &val);
+    assert_hvf_ok(ret);
+    vfp_set_fpcr(env, val);
+
+    val = 0;
+    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_FPSR, &val);
+    assert_hvf_ok(ret);
+    vfp_set_fpsr(env, val);
+
+    ret = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_CPSR, &val);
+    assert_hvf_ok(ret);
+    pstate_write(env, val);
+
+    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
+        if (hvf_sreg_match[i].cp_idx == -1) {
+            continue;
+        }
+
+        ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, &val);
+        assert_hvf_ok(ret);
+
+        arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
+    }
+    assert(write_list_to_cpustate(arm_cpu));
+
+    aarch64_restore_sp(env, arm_current_el(env));
+
+    return 0;
+}
+
+int hvf_put_registers(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    hv_return_t ret;
+    uint64_t val;
+    hv_simd_fp_uchar16_t fpval;
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
+        val = *(uint64_t *)((void *)env + hvf_reg_match[i].offset);
+        ret = hv_vcpu_set_reg(cpu->hvf->fd, hvf_reg_match[i].reg, val);
+        assert_hvf_ok(ret);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(hvf_fpreg_match); i++) {
+        memcpy(&fpval, (void *)env + hvf_fpreg_match[i].offset, sizeof(fpval));
+        ret = hv_vcpu_set_simd_fp_reg(cpu->hvf->fd, hvf_fpreg_match[i].reg,
+                                      fpval);
+        assert_hvf_ok(ret);
+    }
+
+    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPCR, vfp_get_fpcr(env));
+    assert_hvf_ok(ret);
+
+    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_FPSR, vfp_get_fpsr(env));
+    assert_hvf_ok(ret);
+
+    ret = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_CPSR, pstate_read(env));
+    assert_hvf_ok(ret);
+
+    aarch64_save_sp(env, arm_current_el(env));
+
+    assert(write_cpustate_to_list(arm_cpu, false));
+    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
+        if (hvf_sreg_match[i].cp_idx == -1) {
+            continue;
+        }
+
+        val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx];
+        ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, hvf_sreg_match[i].reg, val);
+        assert_hvf_ok(ret);
+    }
+
+    ret = hv_vcpu_set_vtimer_offset(cpu->hvf->fd, hvf_state->vtimer_offset);
+    assert_hvf_ok(ret);
+
+    return 0;
+}
+
+static void flush_cpu_state(CPUState *cpu)
+{
+    if (cpu->vcpu_dirty) {
+        hvf_put_registers(cpu);
+        cpu->vcpu_dirty = false;
+    }
+}
+
+static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val)
+{
+    hv_return_t r;
+
+    flush_cpu_state(cpu);
+
+    if (rt < 31) {
+        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_X0 + rt, val);
+        assert_hvf_ok(r);
+    }
+}
+
+static uint64_t hvf_get_reg(CPUState *cpu, int rt)
+{
+    uint64_t val = 0;
+    hv_return_t r;
+
+    flush_cpu_state(cpu);
+
+    if (rt < 31) {
+        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_X0 + rt, &val);
+        assert_hvf_ok(r);
+    }
+
+    return val;
+}
+
+void hvf_arch_vcpu_destroy(CPUState *cpu)
+{
+}
+
+int hvf_arch_init_vcpu(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    uint32_t sregs_match_len = ARRAY_SIZE(hvf_sreg_match);
+    uint32_t sregs_cnt = 0;
+    uint64_t pfr;
+    hv_return_t ret;
+    int i;
+
+    env->aarch64 = 1;
+    asm volatile("mrs %0, cntfrq_el0" : "=r"(arm_cpu->gt_cntfrq_hz));
+
+    /* Allocate enough space for our sysreg sync */
+    arm_cpu->cpreg_indexes = g_renew(uint64_t, arm_cpu->cpreg_indexes,
+                                     sregs_match_len);
+    arm_cpu->cpreg_values = g_renew(uint64_t, arm_cpu->cpreg_values,
+                                    sregs_match_len);
+    arm_cpu->cpreg_vmstate_indexes = g_renew(uint64_t,
+                                             arm_cpu->cpreg_vmstate_indexes,
+                                             sregs_match_len);
+    arm_cpu->cpreg_vmstate_values = g_renew(uint64_t,
+                                            arm_cpu->cpreg_vmstate_values,
+                                            sregs_match_len);
+
+    memset(arm_cpu->cpreg_values, 0, sregs_match_len * sizeof(uint64_t));
+
+    /* Populate cp list for all known sysregs */
+    for (i = 0; i < sregs_match_len; i++) {
+        const ARMCPRegInfo *ri;
+        uint32_t key = hvf_sreg_match[i].key;
+
+        ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key);
+        if (ri) {
+            assert(!(ri->type & ARM_CP_NO_RAW));
+            hvf_sreg_match[i].cp_idx = sregs_cnt;
+            arm_cpu->cpreg_indexes[sregs_cnt++] = cpreg_to_kvm_id(key);
+        } else {
+            hvf_sreg_match[i].cp_idx = -1;
+        }
+    }
+    arm_cpu->cpreg_array_len = sregs_cnt;
+    arm_cpu->cpreg_vmstate_array_len = sregs_cnt;
+
+    assert(write_cpustate_to_list(arm_cpu, false));
+
+    /* Set CP_NO_RAW system registers on init */
+    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MIDR_EL1,
+                              arm_cpu->midr);
+    assert_hvf_ok(ret);
+
+    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_MPIDR_EL1,
+                              arm_cpu->mp_affinity);
+    assert_hvf_ok(ret);
+
+    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, &pfr);
+    assert_hvf_ok(ret);
+    pfr |= env->gicv3state ? (1 << 24) : 0;
+    ret = hv_vcpu_set_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64PFR0_EL1, pfr);
+    assert_hvf_ok(ret);
+
+    /* We're limited to underlying hardware caps, override internal versions */
+    ret = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_ID_AA64MMFR0_EL1,
+                              &arm_cpu->isar.id_aa64mmfr0);
+    assert_hvf_ok(ret);
+
+    return 0;
+}
+
+void hvf_kick_vcpu_thread(CPUState *cpu)
+{
+    hv_vcpus_exit(&cpu->hvf->fd, 1);
+}
+
+static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
+                                uint32_t syndrome)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+
+    cpu->exception_index = excp;
+    env->exception.target_el = 1;
+    env->exception.syndrome = syndrome;
+
+    arm_cpu_do_interrupt(cpu);
+}
+
+static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    uint64_t val = 0;
+
+    switch (reg) {
+    case SYSREG_CNTPCT_EL0:
+        val = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
+              gt_cntfrq_period_ns(arm_cpu);
+        break;
+    case SYSREG_OSLSR_EL1:
+        val = env->cp15.oslsr_el1;
+        break;
+    case SYSREG_OSDLR_EL1:
+        /* Dummy register */
+        break;
+    default:
+        cpu_synchronize_state(cpu);
+        trace_hvf_unhandled_sysreg_read(env->pc, reg,
+                                        (reg >> 20) & 0x3,
+                                        (reg >> 14) & 0x7,
+                                        (reg >> 10) & 0xf,
+                                        (reg >> 1) & 0xf,
+                                        (reg >> 17) & 0x7);
+        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        return 1;
+    }
+
+    trace_hvf_sysreg_read(reg,
+                          (reg >> 20) & 0x3,
+                          (reg >> 14) & 0x7,
+                          (reg >> 10) & 0xf,
+                          (reg >> 1) & 0xf,
+                          (reg >> 17) & 0x7,
+                          val);
+    hvf_set_reg(cpu, rt, val);
+
+    return 0;
+}
+
+static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+
+    trace_hvf_sysreg_write(reg,
+                           (reg >> 20) & 0x3,
+                           (reg >> 14) & 0x7,
+                           (reg >> 10) & 0xf,
+                           (reg >> 1) & 0xf,
+                           (reg >> 17) & 0x7,
+                           val);
+
+    switch (reg) {
+    case SYSREG_OSLAR_EL1:
+        env->cp15.oslsr_el1 = val & 1;
+        break;
+    case SYSREG_OSDLR_EL1:
+        /* Dummy register */
+        break;
+    default:
+        cpu_synchronize_state(cpu);
+        trace_hvf_unhandled_sysreg_write(env->pc, reg,
+                                         (reg >> 20) & 0x3,
+                                         (reg >> 14) & 0x7,
+                                         (reg >> 10) & 0xf,
+                                         (reg >> 1) & 0xf,
+                                         (reg >> 17) & 0x7);
+        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        return 1;
+    }
+
+    return 0;
+}
+
+static int hvf_inject_interrupts(CPUState *cpu)
+{
+    if (cpu->interrupt_request & CPU_INTERRUPT_FIQ) {
+        trace_hvf_inject_fiq();
+        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_FIQ,
+                                      true);
+    }
+
+    if (cpu->interrupt_request & CPU_INTERRUPT_HARD) {
+        trace_hvf_inject_irq();
+        hv_vcpu_set_pending_interrupt(cpu->hvf->fd, HV_INTERRUPT_TYPE_IRQ,
+                                      true);
+    }
+
+    return 0;
+}
+
+static uint64_t hvf_vtimer_val_raw(void)
+{
+    /*
+     * mach_absolute_time() returns the vtimer value without the VM
+     * offset that we define. Add our own offset on top.
+     */
+    return mach_absolute_time() - hvf_state->vtimer_offset;
+}
+
+static void hvf_sync_vtimer(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    hv_return_t r;
+    uint64_t ctl;
+    bool irq_state;
+
+    if (!cpu->hvf->vtimer_masked) {
+        /* We will get notified on vtimer changes by hvf, nothing to do */
+        return;
+    }
+
+    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
+    assert_hvf_ok(r);
+
+    irq_state = (ctl & (TMR_CTL_ENABLE | TMR_CTL_IMASK | TMR_CTL_ISTATUS)) ==
+                (TMR_CTL_ENABLE | TMR_CTL_ISTATUS);
+    qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], irq_state);
+
+    if (!irq_state) {
+        /* Timer no longer asserting, we can unmask it */
+        hv_vcpu_set_vtimer_mask(cpu->hvf->fd, false);
+        cpu->hvf->vtimer_masked = false;
+    }
+}
+
+int hvf_vcpu_exec(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    hv_vcpu_exit_t *hvf_exit = cpu->hvf->exit;
+    hv_return_t r;
+    bool advance_pc = false;
+
+    if (hvf_inject_interrupts(cpu)) {
+        return EXCP_INTERRUPT;
+    }
+
+    if (cpu->halted) {
+        return EXCP_HLT;
+    }
+
+    flush_cpu_state(cpu);
+
+    qemu_mutex_unlock_iothread();
+    assert_hvf_ok(hv_vcpu_run(cpu->hvf->fd));
+
+    /* handle VMEXIT */
+    uint64_t exit_reason = hvf_exit->reason;
+    uint64_t syndrome = hvf_exit->exception.syndrome;
+    uint32_t ec = syn_get_ec(syndrome);
+
+    qemu_mutex_lock_iothread();
+    switch (exit_reason) {
+    case HV_EXIT_REASON_EXCEPTION:
+        /* This is the main one, handle below. */
+        break;
+    case HV_EXIT_REASON_VTIMER_ACTIVATED:
+        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
+        cpu->hvf->vtimer_masked = true;
+        return 0;
+    case HV_EXIT_REASON_CANCELED:
+        /* we got kicked, no exit to process */
+        return 0;
+    default:
+        assert(0);
+    }
+
+    hvf_sync_vtimer(cpu);
+
+    switch (ec) {
+    case EC_DATAABORT: {
+        bool isv = syndrome & ARM_EL_ISV;
+        bool iswrite = (syndrome >> 6) & 1;
+        bool s1ptw = (syndrome >> 7) & 1;
+        uint32_t sas = (syndrome >> 22) & 3;
+        uint32_t len = 1 << sas;
+        uint32_t srt = (syndrome >> 16) & 0x1f;
+        uint64_t val = 0;
+
+        trace_hvf_data_abort(env->pc, hvf_exit->exception.virtual_address,
+                             hvf_exit->exception.physical_address, isv,
+                             iswrite, s1ptw, len, srt);
+
+        assert(isv);
+
+        if (iswrite) {
+            val = hvf_get_reg(cpu, srt);
+            address_space_write(&address_space_memory,
+                                hvf_exit->exception.physical_address,
+                                MEMTXATTRS_UNSPECIFIED, &val, len);
+        } else {
+            address_space_read(&address_space_memory,
+                               hvf_exit->exception.physical_address,
+                               MEMTXATTRS_UNSPECIFIED, &val, len);
+            hvf_set_reg(cpu, srt, val);
+        }
+
+        advance_pc = true;
+        break;
+    }
+    case EC_SYSTEMREGISTERTRAP: {
+        bool isread = (syndrome >> 0) & 1;
+        uint32_t rt = (syndrome >> 5) & 0x1f;
+        uint32_t reg = syndrome & SYSREG_MASK;
+        uint64_t val;
+        int ret = 0;
+
+        if (isread) {
+            ret = hvf_sysreg_read(cpu, reg, rt);
+        } else {
+            val = hvf_get_reg(cpu, rt);
+            ret = hvf_sysreg_write(cpu, reg, val);
+        }
+
+        advance_pc = !ret;
+        break;
+    }
+    case EC_WFX_TRAP:
+        advance_pc = true;
+        break;
+    case EC_AA64_HVC:
+        cpu_synchronize_state(cpu);
+        trace_hvf_unknown_hvc(env->xregs[0]);
+        /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
+        env->xregs[0] = -1;
+        break;
+    case EC_AA64_SMC:
+        cpu_synchronize_state(cpu);
+        trace_hvf_unknown_smc(env->xregs[0]);
+        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        break;
+    default:
+        cpu_synchronize_state(cpu);
+        trace_hvf_exit(syndrome, ec, env->pc);
+        error_report("0x%llx: unhandled exception ec=0x%x", env->pc, ec);
+    }
+
+    if (advance_pc) {
+        uint64_t pc;
+
+        flush_cpu_state(cpu);
+
+        r = hv_vcpu_get_reg(cpu->hvf->fd, HV_REG_PC, &pc);
+        assert_hvf_ok(r);
+        pc += 4;
+        r = hv_vcpu_set_reg(cpu->hvf->fd, HV_REG_PC, pc);
+        assert_hvf_ok(r);
+    }
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_hvf_vtimer = {
+    .name = "hvf-vtimer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64(vtimer_val, HVFVTimer),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static void hvf_vm_state_change(void *opaque, bool running, RunState state)
+{
+    HVFVTimer *s = opaque;
+
+    if (running) {
+        /* Update vtimer offset on all CPUs */
+        hvf_state->vtimer_offset = mach_absolute_time() - s->vtimer_val;
+        cpu_synchronize_all_states();
+    } else {
+        /* Remember vtimer value on every pause */
+        s->vtimer_val = hvf_vtimer_val_raw();
+    }
+}
+
+int hvf_arch_init(void)
+{
+    hvf_state->vtimer_offset = mach_absolute_time();
+    vmstate_register(NULL, 0, &vmstate_hvf_vtimer, &vtimer);
+    qemu_add_vm_change_state_handler(hvf_vm_state_change, &vtimer);
+    return 0;
+}
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static inline bool apic_bus_freq_is_known(CPUX86State *env)
     return env->apic_bus_freq != 0;
 }
 
+void hvf_kick_vcpu_thread(CPUState *cpu)
+{
+    cpus_kick_thread(cpu);
+}
+
 int hvf_arch_init(void)
 {
     return 0;
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: accel/accel-*.c
 F: accel/Makefile.objs
 F: accel/stubs/Makefile.objs
 
+Apple Silicon HVF CPUs
+M: Alexander Graf <agraf@csgraf.de>
+S: Maintained
+F: target/arm/hvf/
+
 X86 HVF CPUs
 M: Cameron Esfahani <dirty@apple.com>
 M: Roman Bolshakov <r.bolshakov@yadro.com>
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/hvf/trace-events
@@ -XXX,XX +XXX,XX @@
+hvf_unhandled_sysreg_read(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2) "unhandled sysreg read at pc=0x%"PRIx64": 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d)"
+hvf_unhandled_sysreg_write(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2) "unhandled sysreg write at pc=0x%"PRIx64": 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d)"
+hvf_inject_fiq(void) "injecting FIQ"
+hvf_inject_irq(void) "injecting IRQ"
+hvf_data_abort(uint64_t pc, uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [pc=0x%"PRIx64" va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
+hvf_sysreg_read(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg read 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d) = 0x%016"PRIx64
+hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg write 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d, val=0x%016"PRIx64")"
+hvf_unknown_hvc(uint64_t x0) "unknown HVC! 0x%016"PRIx64
+hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
+hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
-- 
2.20.1

From: Peter Collingbourne <pcc@google.com>

Sleep on WFI until the VTIMER is due but allow ourselves to be woken
up on IPI.

In this implementation IPI is blocked on the CPU thread at startup and
pselect() is used to atomically unblock the signal and begin sleeping.
The signal is sent unconditionally so there's no need to worry about
races between actually sleeping and the "we think we're sleeping"
state. It may lead to an extra wakeup but that's better than missing
it entirely.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Message-id: 20210916155404.86958-6-agraf@csgraf.de
[agraf: Remove unused 'set' variable, always advance PC on WFX trap,
        support vm stop / continue operations and cntv offsets]
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/hvf_int.h  |  1 +
 accel/hvf/hvf-accel-ops.c |  5 +--
 target/arm/hvf/hvf.c      | 79 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 82 insertions(+), 3 deletions(-)

diff --git a/include/sysemu/hvf_int.h b/include/sysemu/hvf_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/hvf_int.h
+++ b/include/sysemu/hvf_int.h
@@ -XXX,XX +XXX,XX @@ struct hvf_vcpu_state {
     uint64_t fd;
     void *exit;
     bool vtimer_masked;
+    sigset_t unblock_ipi_mask;
 };
 
 void assert_hvf_ok(hv_return_t ret);
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -XXX,XX +XXX,XX @@ static int hvf_init_vcpu(CPUState *cpu)
     cpu->hvf = g_malloc0(sizeof(*cpu->hvf));
 
     /* init cpu signals */
-    sigset_t set;
     struct sigaction sigact;
 
     memset(&sigact, 0, sizeof(sigact));
     sigact.sa_handler = dummy_signal;
     sigaction(SIG_IPI, &sigact, NULL);
 
-    pthread_sigmask(SIG_BLOCK, NULL, &set);
-    sigdelset(&set, SIG_IPI);
+    pthread_sigmask(SIG_BLOCK, NULL, &cpu->hvf->unblock_ipi_mask);
+    sigdelset(&cpu->hvf->unblock_ipi_mask, SIG_IPI);
 
 #ifdef __aarch64__
     r = hv_vcpu_create(&cpu->hvf->fd, (hv_vcpu_exit_t **)&cpu->hvf->exit, NULL);
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
  * QEMU Hypervisor.framework support for Apple Silicon
 
  * Copyright 2020 Alexander Graf <agraf@csgraf.de>
+ * Copyright 2020 Google LLC
  *
  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  * See the COPYING file in the top-level directory.
@@ -XXX,XX +XXX,XX @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
 void hvf_kick_vcpu_thread(CPUState *cpu)
 {
+    cpus_kick_thread(cpu);
     hv_vcpus_exit(&cpu->hvf->fd, 1);
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t hvf_vtimer_val_raw(void)
     return mach_absolute_time() - hvf_state->vtimer_offset;
 }
 
+static uint64_t hvf_vtimer_val(void)
+{
+    if (!runstate_is_running()) {
+        /* VM is paused, the vtimer value is in vtimer.vtimer_val */
+        return vtimer.vtimer_val;
+    }
+
+    return hvf_vtimer_val_raw();
+}
+
+static void hvf_wait_for_ipi(CPUState *cpu, struct timespec *ts)
+{
+    /*
+     * Use pselect to sleep so that other threads can IPI us while we're
+     * sleeping.
+     */
+    qatomic_mb_set(&cpu->thread_kicked, false);
+    qemu_mutex_unlock_iothread();
+    pselect(0, 0, 0, 0, ts, &cpu->hvf->unblock_ipi_mask);
+    qemu_mutex_lock_iothread();
+}
+
+static void hvf_wfi(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    struct timespec ts;
+    hv_return_t r;
+    uint64_t ctl;
+    uint64_t cval;
+    int64_t ticks_to_sleep;
+    uint64_t seconds;
+    uint64_t nanos;
+    uint32_t cntfrq;
+
+    if (cpu->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ)) {
+        /* Interrupt pending, no need to wait */
+        return;
+    }
+
+    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CTL_EL0, &ctl);
+    assert_hvf_ok(r);
+
+    if (!(ctl & 1) || (ctl & 2)) {
+        /* Timer disabled or masked, just wait for an IPI. */
+        hvf_wait_for_ipi(cpu, NULL);
+        return;
+    }
+
+    r = hv_vcpu_get_sys_reg(cpu->hvf->fd, HV_SYS_REG_CNTV_CVAL_EL0, &cval);
+    assert_hvf_ok(r);
+
+    ticks_to_sleep = cval - hvf_vtimer_val();
+    if (ticks_to_sleep < 0) {
+        return;
+    }
+
+    cntfrq = gt_cntfrq_period_ns(arm_cpu);
+    seconds = muldiv64(ticks_to_sleep, cntfrq, NANOSECONDS_PER_SECOND);
+    ticks_to_sleep -= muldiv64(seconds, NANOSECONDS_PER_SECOND, cntfrq);
+    nanos = ticks_to_sleep * cntfrq;
+
+    /*
+     * Don't sleep for less than the time a context switch would take,
+     * so that we can satisfy fast timer requests on the same CPU.
+     * Measurements on M1 show the sweet spot to be ~2ms.
+     */
+    if (!seconds && nanos < (2 * SCALE_MS)) {
+        return;
+    }
+
+    ts = (struct timespec) { seconds, nanos };
+    hvf_wait_for_ipi(cpu, &ts);
+}
+
 static void hvf_sync_vtimer(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
     }
     case EC_WFX_TRAP:
         advance_pc = true;
+        if (!(syndrome & WFX_IS_WFE)) {
+            hvf_wfi(cpu);
+        }
         break;
     case EC_AA64_HVC:
         cpu_synchronize_state(cpu);
-- 
2.20.1

Now that we have working system register sync, we push more target CPU
properties into the virtual machine. That might be useful in some
situations, but is not the typical case that users want.

So let's add a -cpu host option that allows them to explicitly pass all
CPU capabilities of their host CPU into the guest.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Acked-by: Roman Bolshakov <r.bolshakov@yadro.com>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-7-agraf@csgraf.de
[PMM: drop unnecessary #include line from .h file]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |  2 +
 target/arm/hvf_arm.h | 18 +++++++++
 target/arm/kvm_arm.h |  2 -
 target/arm/cpu.c     | 13 ++++--
 target/arm/hvf/hvf.c | 95 ++++++++++++++++++++++++++++++++++++++++++++
 5 files changed, 124 insertions(+), 6 deletions(-)
 create mode 100644 target/arm/hvf_arm.h

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 #define ARM_CPU_TYPE_NAME(name) (name ARM_CPU_TYPE_SUFFIX)
 #define CPU_RESOLVING_TYPE TYPE_ARM_CPU
 
+#define TYPE_ARM_HOST_CPU "host-" TYPE_ARM_CPU
+
 #define cpu_signal_handler cpu_arm_signal_handler
 #define cpu_list arm_cpu_list
 
diff --git a/target/arm/hvf_arm.h b/target/arm/hvf_arm.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/hvf_arm.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU Hypervisor.framework (HVF) support -- ARM specifics
+ *
+ * Copyright (c) 2021 Alexander Graf
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef QEMU_HVF_ARM_H
+#define QEMU_HVF_ARM_H
+
+#include "cpu.h"
+
+void hvf_arm_set_cpu_features_from_host(struct ARMCPU *cpu);
+
+#endif
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
  */
 void kvm_arm_destroy_scratch_host_vcpu(int *fdarray);
 
-#define TYPE_ARM_HOST_CPU "host-" TYPE_ARM_CPU
-
 /**
  * ARMHostCPUFeatures: information about the host CPU (identified
  * by asking the host kernel)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/tcg.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
+#include "hvf_arm.h"
 #include "disas/capstone.h"
 #include "fpu/softfloat.h"
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      * this is the first point where we can report it.
      */
     if (cpu->host_cpu_probe_failed) {
-        if (!kvm_enabled()) {
-            error_setg(errp, "The 'host' CPU type can only be used with KVM");
+        if (!kvm_enabled() && !hvf_enabled()) {
+            error_setg(errp, "The 'host' CPU type can only be used with KVM or HVF");
         } else {
             error_setg(errp, "Failed to retrieve host CPU features");
         }
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_class_init(ObjectClass *oc, void *data)
 #endif /* CONFIG_TCG */
 }
 
-#ifdef CONFIG_KVM
+#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
 static void arm_host_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
+#ifdef CONFIG_KVM
     kvm_arm_set_cpu_features_from_host(cpu);
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         aarch64_add_sve_properties(obj);
     }
+#else
+    hvf_arm_set_cpu_features_from_host(cpu);
+#endif
     arm_cpu_post_init(obj);
 }
 
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_register_types(void)
 {
     type_register_static(&arm_cpu_type_info);
 
-#ifdef CONFIG_KVM
+#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     type_register_static(&host_arm_cpu_type_info);
 #endif
 }
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/hvf.h"
 #include "sysemu/hvf_int.h"
 #include "sysemu/hw_accel.h"
+#include "hvf_arm.h"
 
 #include <mach/mach_time.h>
 
@@ -XXX,XX +XXX,XX @@ typedef struct HVFVTimer {
 
 static HVFVTimer vtimer;
 
+typedef struct ARMHostCPUFeatures {
+    ARMISARegisters isar;
+    uint64_t features;
+    uint64_t midr;
+    uint32_t reset_sctlr;
+    const char *dtb_compatible;
+} ARMHostCPUFeatures;
+
+static ARMHostCPUFeatures arm_host_cpu_features;
+
 struct hvf_reg_match {
     int reg;
     uint64_t offset;
@@ -XXX,XX +XXX,XX @@ static uint64_t hvf_get_reg(CPUState *cpu, int rt)
     return val;
 }
 
+static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+{
+    ARMISARegisters host_isar = {};
+    const struct isar_regs {
+        int reg;
+        uint64_t *val;
+    } regs[] = {
+        { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.id_aa64pfr0 },
+        { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.id_aa64pfr1 },
+        { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.id_aa64dfr0 },
+        { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.id_aa64dfr1 },
+        { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.id_aa64isar0 },
+        { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.id_aa64isar1 },
+        { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.id_aa64mmfr0 },
+        { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.id_aa64mmfr1 },
+        { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.id_aa64mmfr2 },
+    };
+    hv_vcpu_t fd;
+    hv_return_t r = HV_SUCCESS;
+    hv_vcpu_exit_t *exit;
+    int i;
+
+    ahcf->dtb_compatible = "arm,arm-v8";
+    ahcf->features = (1ULL << ARM_FEATURE_V8) |
+                     (1ULL << ARM_FEATURE_NEON) |
+                     (1ULL << ARM_FEATURE_AARCH64) |
+                     (1ULL << ARM_FEATURE_PMU) |
+                     (1ULL << ARM_FEATURE_GENERIC_TIMER);
+
+    /* We set up a small vcpu to extract host registers */
+
+    if (hv_vcpu_create(&fd, &exit, NULL) != HV_SUCCESS) {
+        return false;
+    }
+
+    for (i = 0; i < ARRAY_SIZE(regs); i++) {
+        r |= hv_vcpu_get_sys_reg(fd, regs[i].reg, regs[i].val);
+    }
+    r |= hv_vcpu_get_sys_reg(fd, HV_SYS_REG_MIDR_EL1, &ahcf->midr);
+    r |= hv_vcpu_destroy(fd);
+
+    ahcf->isar = host_isar;
+
+    /*
+     * A scratch vCPU returns SCTLR 0, so let's fill our default with the M1
+     * boot SCTLR from https://github.com/AsahiLinux/m1n1/issues/97
+     */
+    ahcf->reset_sctlr = 0x30100180;
+    /*
+     * SPAN is disabled by default when SCTLR.SPAN=1. To improve compatibility,
+     * let's disable it on boot and then allow guest software to turn it on by
+     * setting it to 0.
+     */
+    ahcf->reset_sctlr |= 0x00800000;
+
+    /* Make sure we don't advertise AArch32 support for EL0/EL1 */
+    if ((host_isar.id_aa64pfr0 & 0xff) != 0x11) {
+        return false;
+    }
+
+    return r == HV_SUCCESS;
+}
+
+void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu)
+{
+    if (!arm_host_cpu_features.dtb_compatible) {
+        if (!hvf_enabled() ||
+            !hvf_arm_get_host_cpu_features(&arm_host_cpu_features)) {
+            /*
+             * We can't report this error yet, so flag that we need to
+             * in arm_cpu_realizefn().
+             */
+            cpu->host_cpu_probe_failed = true;
+            return;
+        }
+    }
+
+    cpu->dtb_compatible = arm_host_cpu_features.dtb_compatible;
+    cpu->isar = arm_host_cpu_features.isar;
+    cpu->env.features = arm_host_cpu_features.features;
+    cpu->midr = arm_host_cpu_features.midr;
+    cpu->reset_sctlr = arm_host_cpu_features.reset_sctlr;
+}
+
 void hvf_arch_vcpu_destroy(CPUState *cpu)
 {
 }
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

We need to handle PSCI calls. Most of the TCG code works for us,
but we can simplify it to only handle aa64 mode and we need to
handle SUSPEND differently.

This patch takes the TCG code as template and duplicates it in HVF.

To tell the guest that we support PSCI 0.2 now, update the check in
arm_cpu_initfn() as well.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-8-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c            |   4 +-
 target/arm/hvf/hvf.c        | 141 ++++++++++++++++++++++++++++++++++--
 target/arm/hvf/trace-events |   1 +
 3 files changed, 139 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     cpu->psci_version = 1; /* By default assume PSCI v0.1 */
     cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
 
-    if (tcg_enabled()) {
-        cpu->psci_version = 2; /* TCG implements PSCI 0.2 */
+    if (tcg_enabled() || hvf_enabled()) {
+        cpu->psci_version = 2; /* TCG and HVF implement PSCI 0.2 */
     }
 }
 
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "qemu/main-loop.h"
 #include "sysemu/cpus.h"
+#include "arm-powerctl.h"
 #include "target/arm/cpu.h"
 #include "target/arm/internals.h"
 #include "trace/trace-target_arm_hvf.h"
@@ -XXX,XX +XXX,XX @@
 #define TMR_CTL_IMASK   (1 << 1)
 #define TMR_CTL_ISTATUS (1 << 2)
 
+static void hvf_wfi(CPUState *cpu);
+
 typedef struct HVFVTimer {
     /* Vtimer value during migration and paused state */
     uint64_t vtimer_val;
@@ -XXX,XX +XXX,XX @@ static void hvf_raise_exception(CPUState *cpu, uint32_t excp,
     arm_cpu_do_interrupt(cpu);
 }
 
+static void hvf_psci_cpu_off(ARMCPU *arm_cpu)
+{
+    int32_t ret = arm_set_cpu_off(arm_cpu->mp_affinity);
+    assert(ret == QEMU_ARM_POWERCTL_RET_SUCCESS);
+}
+
+/*
+ * Handle a PSCI call.
+ *
+ * Returns 0 on success
+ *         -1 when the PSCI call is unknown,
+ */
+static bool hvf_handle_psci_call(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+    uint64_t param[4] = {
+        env->xregs[0],
+        env->xregs[1],
+        env->xregs[2],
+        env->xregs[3]
+    };
+    uint64_t context_id, mpidr;
+    bool target_aarch64 = true;
+    CPUState *target_cpu_state;
+    ARMCPU *target_cpu;
+    target_ulong entry;
+    int target_el = 1;
+    int32_t ret = 0;
+
+    trace_hvf_psci_call(param[0], param[1], param[2], param[3],
+                        arm_cpu->mp_affinity);
+
+    switch (param[0]) {
+    case QEMU_PSCI_0_2_FN_PSCI_VERSION:
+        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
+        break;
+    case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
+        ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
+        break;
+    case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
+    case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
+        mpidr = param[1];
+
+        switch (param[2]) {
+        case 0:
+            target_cpu_state = arm_get_cpu_by_id(mpidr);
+            if (!target_cpu_state) {
+                ret = QEMU_PSCI_RET_INVALID_PARAMS;
+                break;
+            }
+            target_cpu = ARM_CPU(target_cpu_state);
+
+            ret = target_cpu->power_state;
+            break;
+        default:
+            /* Everything above affinity level 0 is always on. */
+            ret = 0;
+        }
+        break;
+    case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+        /*
+         * QEMU reset and shutdown are async requests, but PSCI
+         * mandates that we never return from the reset/shutdown
+         * call, so power the CPU off now so it doesn't execute
+         * anything further.
+         */
+        hvf_psci_cpu_off(arm_cpu);
+        break;
+    case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
+        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+        hvf_psci_cpu_off(arm_cpu);
+        break;
+    case QEMU_PSCI_0_1_FN_CPU_ON:
+    case QEMU_PSCI_0_2_FN_CPU_ON:
+    case QEMU_PSCI_0_2_FN64_CPU_ON:
+        mpidr = param[1];
+        entry = param[2];
+        context_id = param[3];
+        ret = arm_set_cpu_on(mpidr, entry, context_id,
+                             target_el, target_aarch64);
+        break;
+    case QEMU_PSCI_0_1_FN_CPU_OFF:
+    case QEMU_PSCI_0_2_FN_CPU_OFF:
+        hvf_psci_cpu_off(arm_cpu);
+        break;
+    case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
+    case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
+    case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
+        /* Affinity levels are not supported in QEMU */
+        if (param[1] & 0xfffe0000) {
+            ret = QEMU_PSCI_RET_INVALID_PARAMS;
+            break;
+        }
+        /* Powerdown is not supported, we always go into WFI */
+        env->xregs[0] = 0;
+        hvf_wfi(cpu);
+        break;
+    case QEMU_PSCI_0_1_FN_MIGRATE:
+    case QEMU_PSCI_0_2_FN_MIGRATE:
+        ret = QEMU_PSCI_RET_NOT_SUPPORTED;
+        break;
+    default:
+        return false;
+    }
+
+    env->xregs[0] = ret;
+    return true;
+}
+
 static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ int hvf_vcpu_exec(CPUState *cpu)
         break;
     case EC_AA64_HVC:
         cpu_synchronize_state(cpu);
-        trace_hvf_unknown_hvc(env->xregs[0]);
-        /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
-        env->xregs[0] = -1;
+        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
+            if (!hvf_handle_psci_call(cpu)) {
+                trace_hvf_unknown_hvc(env->xregs[0]);
+                /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
+                env->xregs[0] = -1;
+            }
+        } else {
+            trace_hvf_unknown_hvc(env->xregs[0]);
+            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        }
         break;
     case EC_AA64_SMC:
         cpu_synchronize_state(cpu);
-        trace_hvf_unknown_smc(env->xregs[0]);
-        hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) {
+            advance_pc = true;
+
+            if (!hvf_handle_psci_call(cpu)) {
+                trace_hvf_unknown_smc(env->xregs[0]);
+                /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
+                env->xregs[0] = -1;
+            }
+        } else {
+            trace_hvf_unknown_smc(env->xregs[0]);
+            hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized());
+        }
         break;
     default:
         cpu_synchronize_state(cpu);
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -XXX,XX +XXX,XX @@ hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_
 hvf_unknown_hvc(uint64_t x0) "unknown HVC! 0x%016"PRIx64
 hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
 hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
+hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpu=0x%x"
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

Now that we have all logic in place that we need to handle Hypervisor.framework
on Apple Silicon systems, let's add CONFIG_HVF for aarch64 as well so that we
can build it.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Roman Bolshakov <r.bolshakov@yadro.com>
Tested-by: Roman Bolshakov <r.bolshakov@yadro.com> (x86 only)
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Sergio Lopez <slp@redhat.com>
Message-id: 20210916155404.86958-9-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build                | 7 +++++++
 target/arm/hvf/meson.build | 3 +++
 target/arm/meson.build     | 2 ++
 3 files changed, 12 insertions(+)
 create mode 100644 target/arm/hvf/meson.build

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ else
 endif
 
 accelerator_targets = { 'CONFIG_KVM': kvm_targets }
+
+if cpu in ['aarch64']
+  accelerator_targets += {
+    'CONFIG_HVF': ['aarch64-softmmu']
+  }
+endif
+
 if cpu in ['x86', 'x86_64', 'arm', 'aarch64']
   # i386 emulator provides xenpv machine type for multiple architectures
   accelerator_targets += {
diff --git a/target/arm/hvf/meson.build b/target/arm/hvf/meson.build
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/hvf/meson.build
@@ -XXX,XX +XXX,XX @@
+arm_softmmu_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
+  'hvf.c',
+))
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_softmmu_ss.add(files(
   'psci.c',
 ))
 
+subdir('hvf')
+
 target_arch += {'arm': arm_ss}
 target_softmmu_arch += {'arm': arm_softmmu_ss}
-- 
2.20.1

From: Alexander Graf <agraf@csgraf.de>

We can expose cycle counters on the PMU easily. To be as compatible as
possible, let's do so, but make sure we don't expose any other architectural
counters that we can not model yet.

This allows OSs to work that require PMU support.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210916155404.86958-10-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 179 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 179 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@
 #define SYSREG_OSLSR_EL1      SYSREG(2, 0, 1, 1, 4)
 #define SYSREG_OSDLR_EL1      SYSREG(2, 0, 1, 3, 4)
 #define SYSREG_CNTPCT_EL0     SYSREG(3, 3, 14, 0, 1)
+#define SYSREG_PMCR_EL0       SYSREG(3, 3, 9, 12, 0)
+#define SYSREG_PMUSERENR_EL0  SYSREG(3, 3, 9, 14, 0)
+#define SYSREG_PMCNTENSET_EL0 SYSREG(3, 3, 9, 12, 1)
+#define SYSREG_PMCNTENCLR_EL0 SYSREG(3, 3, 9, 12, 2)
+#define SYSREG_PMINTENCLR_EL1 SYSREG(3, 0, 9, 14, 2)
+#define SYSREG_PMOVSCLR_EL0   SYSREG(3, 3, 9, 12, 3)
+#define SYSREG_PMSWINC_EL0    SYSREG(3, 3, 9, 12, 4)
+#define SYSREG_PMSELR_EL0     SYSREG(3, 3, 9, 12, 5)
+#define SYSREG_PMCEID0_EL0    SYSREG(3, 3, 9, 12, 6)
+#define SYSREG_PMCEID1_EL0    SYSREG(3, 3, 9, 12, 7)
+#define SYSREG_PMCCNTR_EL0    SYSREG(3, 3, 9, 13, 0)
+#define SYSREG_PMCCFILTR_EL0  SYSREG(3, 3, 14, 15, 7)
 
 #define WFX_IS_WFE (1 << 0)
 
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
         val = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) /
               gt_cntfrq_period_ns(arm_cpu);
         break;
+    case SYSREG_PMCR_EL0:
+        val = env->cp15.c9_pmcr;
+        break;
+    case SYSREG_PMCCNTR_EL0:
+        pmu_op_start(env);
+        val = env->cp15.c15_ccnt;
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMCNTENCLR_EL0:
+        val = env->cp15.c9_pmcnten;
+        break;
+    case SYSREG_PMOVSCLR_EL0:
+        val = env->cp15.c9_pmovsr;
+        break;
+    case SYSREG_PMSELR_EL0:
+        val = env->cp15.c9_pmselr;
+        break;
+    case SYSREG_PMINTENCLR_EL1:
+        val = env->cp15.c9_pminten;
+        break;
+    case SYSREG_PMCCFILTR_EL0:
+        val = env->cp15.pmccfiltr_el0;
+        break;
+    case SYSREG_PMCNTENSET_EL0:
+        val = env->cp15.c9_pmcnten;
+        break;
+    case SYSREG_PMUSERENR_EL0:
+        val = env->cp15.c9_pmuserenr;
+        break;
+    case SYSREG_PMCEID0_EL0:
+    case SYSREG_PMCEID1_EL0:
+        /* We can't really count anything yet, declare all events invalid */
+        val = 0;
+        break;
     case SYSREG_OSLSR_EL1:
         val = env->cp15.oslsr_el1;
         break;
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint32_t rt)
     return 0;
 }
 
+static void pmu_update_irq(CPUARMState *env)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    qemu_set_irq(cpu->pmu_interrupt, (env->cp15.c9_pmcr & PMCRE) &&
+            (env->cp15.c9_pminten & env->cp15.c9_pmovsr));
+}
+
+static bool pmu_event_supported(uint16_t number)
+{
+    return false;
+}
+
+/* Returns true if the counter (pass 31 for PMCCNTR) should count events using
+ * the current EL, security state, and register configuration.
+ */
+static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
+{
+    uint64_t filter;
+    bool enabled, filtered = true;
+    int el = arm_current_el(env);
+
+    enabled = (env->cp15.c9_pmcr & PMCRE) &&
+              (env->cp15.c9_pmcnten & (1 << counter));
+
+    if (counter == 31) {
+        filter = env->cp15.pmccfiltr_el0;
+    } else {
+        filter = env->cp15.c14_pmevtyper[counter];
+    }
+
+    if (el == 0) {
+        filtered = filter & PMXEVTYPER_U;
+    } else if (el == 1) {
+        filtered = filter & PMXEVTYPER_P;
+    }
+
+    if (counter != 31) {
+        /*
+         * If not checking PMCCNTR, ensure the counter is setup to an event we
+         * support
+         */
+        uint16_t event = filter & PMXEVTYPER_EVTCOUNT;
+        if (!pmu_event_supported(event)) {
+            return false;
+        }
+    }
+
+    return enabled && !filtered;
+}
+
+static void pmswinc_write(CPUARMState *env, uint64_t value)
+{
+    unsigned int i;
+    for (i = 0; i < pmu_num_counters(env); i++) {
+        /* Increment a counter's count iff: */
+        if ((value & (1 << i)) && /* counter's bit is set */
+                /* counter is enabled and not filtered */
+                pmu_counter_enabled(env, i) &&
+                /* counter is SW_INCR */
+                (env->cp15.c14_pmevtyper[i] & PMXEVTYPER_EVTCOUNT) == 0x0) {
+            /*
+             * Detect if this write causes an overflow since we can't predict
+             * PMSWINC overflows like we can for other events
+             */
+            uint32_t new_pmswinc = env->cp15.c14_pmevcntr[i] + 1;
+
+            if (env->cp15.c14_pmevcntr[i] & ~new_pmswinc & INT32_MIN) {
+                env->cp15.c9_pmovsr |= (1 << i);
+                pmu_update_irq(env);
+            }
+
+            env->cp15.c14_pmevcntr[i] = new_pmswinc;
+        }
+    }
+}
+
 static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
                            val);
 
     switch (reg) {
+    case SYSREG_PMCCNTR_EL0:
+        pmu_op_start(env);
+        env->cp15.c15_ccnt = val;
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMCR_EL0:
+        pmu_op_start(env);
+
+        if (val & PMCRC) {
+            /* The counter has been reset */
+            env->cp15.c15_ccnt = 0;
+        }
+
+        if (val & PMCRP) {
+            unsigned int i;
+            for (i = 0; i < pmu_num_counters(env); i++) {
+                env->cp15.c14_pmevcntr[i] = 0;
+            }
+        }
+
+        env->cp15.c9_pmcr &= ~PMCR_WRITEABLE_MASK;
+        env->cp15.c9_pmcr |= (val & PMCR_WRITEABLE_MASK);
+
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMUSERENR_EL0:
+        env->cp15.c9_pmuserenr = val & 0xf;
+        break;
+    case SYSREG_PMCNTENSET_EL0:
+        env->cp15.c9_pmcnten |= (val & pmu_counter_mask(env));
+        break;
+    case SYSREG_PMCNTENCLR_EL0:
+        env->cp15.c9_pmcnten &= ~(val & pmu_counter_mask(env));
+        break;
+    case SYSREG_PMINTENCLR_EL1:
+        pmu_op_start(env);
+        env->cp15.c9_pminten |= val;
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMOVSCLR_EL0:
+        pmu_op_start(env);
+        env->cp15.c9_pmovsr &= ~val;
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMSWINC_EL0:
+        pmu_op_start(env);
+        pmswinc_write(env, val);
+        pmu_op_finish(env);
+        break;
+    case SYSREG_PMSELR_EL0:
+        env->cp15.c9_pmselr = val & 0x1f;
+        break;
+    case SYSREG_PMCCFILTR_EL0:
+        pmu_op_start(env);
+        env->cp15.pmccfiltr_el0 = val & PMCCFILTR_EL0;
+        pmu_op_finish(env);
+        break;
     case SYSREG_OSLAR_EL1:
         env->cp15.oslsr_el1 = val & 1;
         break;
-- 
2.20.1

Currently gen_jmp_tb() assumes that if it is called then the jump it
is handling is the only reason that we might be trying to end the TB,
so it will use goto_tb if it can.  This is usually the case: mostly
"we did something that means we must end the TB" happens on a
non-branch instruction.  However, there are cases where we decide
early in handling an instruction that we need to end the TB and
return to the main loop, and then the insn is a complex one that
involves gen_jmp_tb().  For instance, for M-profile FP instructions,
in gen_preserve_fp_state() which is called from vfp_access_check() we
want to force an exit to the main loop if lazy state preservation is
active and we are in icount mode.

Make gen_jmp_tb() look at the current value of is_jmp, and only use
goto_tb if the previous is_jmp was DISAS_NEXT or DISAS_TOO_MANY.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-2-peter.maydell@linaro.org
---
 target/arm/translate.c | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static inline void gen_jmp_tb(DisasContext *s, uint32_t dest, int tbno)
         /* An indirect jump so that we still trigger the debug exception.  */
         gen_set_pc_im(s, dest);
         s->base.is_jmp = DISAS_JUMP;
-    } else {
+        return;
+    }
+    switch (s->base.is_jmp) {
+    case DISAS_NEXT:
+    case DISAS_TOO_MANY:
+    case DISAS_NORETURN:
+        /*
+         * The normal case: just go to the destination TB.
+         * NB: NORETURN happens if we generate code like
+         *    gen_brcondi(l);
+         *    gen_jmp();
+         *    gen_set_label(l);
+         *    gen_jmp();
+         * on the second call to gen_jmp().
+         */
         gen_goto_tb(s, tbno, dest);
+        break;
+    case DISAS_UPDATE_NOCHAIN:
+    case DISAS_UPDATE_EXIT:
+        /*
+         * We already decided we're leaving the TB for some other reason.
+         * Avoid using goto_tb so we really do exit back to the main loop
+         * and don't chain to another TB.
+         */
+        gen_set_pc_im(s, dest);
+        gen_goto_ptr();
+        s->base.is_jmp = DISAS_NORETURN;
+        break;
+    default:
+        /*
+         * We shouldn't be emitting code for a jump and also have
+         * is_jmp set to one of the special cases like DISAS_SWI.
+         */
+        g_assert_not_reached();
     }
 }
 
-- 
2.20.1

Architecturally, for an M-profile CPU with the LOB feature the
LTPSIZE field in FPDSCR is always constant 4.  QEMU's implementation
enforces this everywhere, except that we don't check that it is true
in incoming migration data.

We're going to add come in gen_update_fp_context() which relies on
the "always 4" property.  Since this is TCG-only, we don't actually
need to be robust to bogus incoming migration data, and the effect of
it being wrong would be wrong code generation rather than a QEMU
crash; but if it did ever happen somehow it would be very difficult
to track down the cause.  Add a check so that we fail the inbound
migration if the FPDSCR.LTPSIZE value is incorrect.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-3-peter.maydell@linaro.org
---
 target/arm/machine.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
     hw_breakpoint_update_all(cpu);
     hw_watchpoint_update_all(cpu);
 
+    /*
+     * TCG gen_update_fp_context() relies on the invariant that
+     * FPDSCR.LTPSIZE is constant 4 for M-profile with the LOB extension;
+     * forbid bogus incoming data with some other value.
+     */
+    if (arm_feature(env, ARM_FEATURE_M) && cpu_isar_feature(aa32_lob, cpu)) {
+        if (extract32(env->v7m.fpdscr[M_REG_NS],
+                      FPCR_LTPSIZE_SHIFT, FPCR_LTPSIZE_LENGTH) != 4 ||
+            extract32(env->v7m.fpdscr[M_REG_S],
+                      FPCR_LTPSIZE_SHIFT, FPCR_LTPSIZE_LENGTH) != 4) {
+            return -1;
+        }
+    }
     if (!kvm_enabled()) {
         pmu_op_finish(&cpu->env);
     }
-- 
2.20.1

Our current codegen for MVE always calls out to helper functions,
because some byte lanes might be predicated.  The common case is that
in fact there is no predication active and all lanes should be
updated together, so we can produce better code by detecting that and
using the TCG generic vector infrastructure.

Add a TB flag that is set when we can guarantee that there is no
active MVE predication, and a bool in the DisasContext.  Subsequent
patches will use this flag to generate improved code for some
instructions.

In most cases when the predication state changes we simply end the TB
after that instruction.  For the code called from vfp_access_check()
that handles lazy state preservation and creating a new FP context,
we can usually avoid having to try to end the TB because luckily the
new value of the flag following the register changes in those
sequences doesn't depend on any runtime decisions.  We do have to end
the TB if the guest has enabled lazy FP state preservation but not
automatic state preservation, but this is an odd corner case that is
not going to be common in real-world code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-4-peter.maydell@linaro.org
---
 target/arm/cpu.h              |  4 +++-
 target/arm/translate.h        |  2 ++
 target/arm/helper.c           | 33 +++++++++++++++++++++++++++++++++
 target/arm/translate-m-nocp.c |  8 +++++++-
 target/arm/translate-mve.c    | 13 ++++++++++++-
 target/arm/translate-vfp.c    | 33 +++++++++++++++++++++++++++------
 target/arm/translate.c        |  8 ++++++++
 7 files changed, 92 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef ARMCPU ArchCPU;
  * | TBFLAG_AM32 |          +-----+----------+
  * |             |                |TBFLAG_M32|
  * +-------------+----------------+----------+
- *  31         23                5 4        0
+ *  31         23                6 5        0
  *
  * Unless otherwise noted, these bits are cached in env->hflags.
  */
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_M32, LSPACT, 2, 1)                 /* Not cached. */
 FIELD(TBFLAG_M32, NEW_FP_CTXT_NEEDED, 3, 1)     /* Not cached. */
 /* Set if FPCCR.S does not match current security state */
 FIELD(TBFLAG_M32, FPCCR_S_WRONG, 4, 1)          /* Not cached. */
+/* Set if MVE insns are definitely not predicated by VPR or LTPSIZE */
+FIELD(TBFLAG_M32, MVE_NO_PRED, 5, 1)            /* Not cached. */
 
 /*
  * Bit usage when in AArch64 state
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool align_mem;
     /* True if PSTATE.IL is set */
     bool pstate_il;
+    /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
+    bool mve_no_pred;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static inline void assert_hflags_rebuild_correctly(CPUARMState *env)
 #endif
 }
 
+static bool mve_no_pred(CPUARMState *env)
+{
+    /*
+     * Return true if there is definitely no predication of MVE
+     * instructions by VPR or LTPSIZE. (Returning false even if there
+     * isn't any predication is OK; generated code will just be
+     * a little worse.)
+     * If the CPU does not implement MVE then this TB flag is always 0.
+     *
+     * NOTE: if you change this logic, the "recalculate s->mve_no_pred"
+     * logic in gen_update_fp_context() needs to be updated to match.
+     *
+     * We do not include the effect of the ECI bits here -- they are
+     * tracked in other TB flags. This simplifies the logic for
+     * "when did we emit code that changes the MVE_NO_PRED TB flag
+     * and thus need to end the TB?".
+     */
+    if (cpu_isar_feature(aa32_mve, env_archcpu(env))) {
+        return false;
+    }
+    if (env->v7m.vpr) {
+        return false;
+    }
+    if (env->v7m.ltpsize < 4) {
+        return false;
+    }
+    return true;
+}
+
 void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
                           target_ulong *cs_base, uint32_t *pflags)
 {
@@ -XXX,XX +XXX,XX @@ void cpu_get_tb_cpu_state(CPUARMState *env, target_ulong *pc,
             if (env->v7m.fpccr[is_secure] & R_V7M_FPCCR_LSPACT_MASK) {
                 DP_TBFLAG_M32(flags, LSPACT, 1);
             }
+
+            if (mve_no_pred(env)) {
+                DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
+            }
         } else {
             /*
              * Note that XSCALE_CPAR shares bits with VECSTRIDE.
diff --git a/target/arm/translate-m-nocp.c b/target/arm/translate-m-nocp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-m-nocp.c
+++ b/target/arm/translate-m-nocp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
 
     clear_eci_state(s);
 
-    /* End the TB, because we have updated FP control bits */
+    /*
+     * End the TB, because we have updated FP control bits,
+     * and possibly VPR or LTPSIZE.
+     */
     s->base.is_jmp = DISAS_UPDATE_EXIT;
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         store_cpu_field(control, v7m.control[M_REG_S]);
         tcg_gen_andi_i32(tmp, tmp, ~FPCR_NZCV_MASK);
         gen_helper_vfp_set_fpscr(cpu_env, tmp);
+        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
         tcg_temp_free_i32(tmp);
         tcg_temp_free_i32(sfpa);
         break;
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         }
         tmp = loadfn(s, opaque, true);
         store_cpu_field(tmp, v7m.vpr);
+        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
         break;
     case ARM_VFP_P0:
     {
@@ -XXX,XX +XXX,XX @@ static bool gen_M_fp_sysreg_write(DisasContext *s, int regno,
         tcg_gen_deposit_i32(vpr, vpr, tmp,
                             R_V7M_VPR_P0_SHIFT, R_V7M_VPR_P0_LENGTH);
         store_cpu_field(vpr, v7m.vpr);
+        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
         tcg_temp_free_i32(tmp);
         break;
     }
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_LOGIC(VORR, gen_helper_mve_vorr)
 DO_LOGIC(VORN, gen_helper_mve_vorn)
 DO_LOGIC(VEOR, gen_helper_mve_veor)
 
-DO_LOGIC(VPSEL, gen_helper_mve_vpsel)
+static bool trans_VPSEL(DisasContext *s, arg_2op *a)
+{
+    /* This insn updates predication bits */
+    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
+    return do_2op(s, a, gen_helper_mve_vpsel);
+}
 
 #define DO_2OP(INSN, FN) \
     static bool trans_##INSN(DisasContext *s, arg_2op *a)       \
@@ -XXX,XX +XXX,XX @@ static bool trans_VPNOT(DisasContext *s, arg_VPNOT *a)
     }
 
     gen_helper_mve_vpnot(cpu_env);
+    /* This insn updates predication bits */
+    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
     mve_update_eci(s);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_vcmp(DisasContext *s, arg_vcmp *a, MVEGenCmpFn *fn)
         /* VPT */
         gen_vpst(s, a->mask);
     }
+    /* This insn updates predication bits */
+    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
     mve_update_eci(s);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_vcmp_scalar(DisasContext *s, arg_vcmp_scalar *a,
         /* VPT */
         gen_vpst(s, a->mask);
     }
+    /* This insn updates predication bits */
+    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
     mve_update_eci(s);
     return true;
 }
diff --git a/target/arm/translate-vfp.c b/target/arm/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.c
+++ b/target/arm/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static inline long vfp_f16_offset(unsigned reg, bool top)
  * Generate code for M-profile lazy FP state preservation if needed;
  * this corresponds to the pseudocode PreserveFPState() function.
  */
-static void gen_preserve_fp_state(DisasContext *s)
+static void gen_preserve_fp_state(DisasContext *s, bool skip_context_update)
 {
     if (s->v7m_lspact) {
         /*
@@ -XXX,XX +XXX,XX @@ static void gen_preserve_fp_state(DisasContext *s)
          * any further FP insns in this TB.
          */
         s->v7m_lspact = false;
+        /*
+         * The helper might have zeroed VPR, so we do not know the
+         * correct value for the MVE_NO_PRED TB flag any more.
+         * If we're about to create a new fp context then that
+         * will precisely determine the MVE_NO_PRED value (see
+         * gen_update_fp_context()). Otherwise, we must:
+         *  - set s->mve_no_pred to false, so this instruction
+         *    is generated to use helper functions
+         *  - end the TB now, without chaining to the next TB
+         */
+        if (skip_context_update || !s->v7m_new_fp_ctxt_needed) {
+            s->mve_no_pred = false;
+            s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_update_fp_context(DisasContext *s)
             TCGv_i32 z32 = tcg_const_i32(0);
             store_cpu_field(z32, v7m.vpr);
         }
-
         /*
-         * We don't need to arrange to end the TB, because the only
-         * parts of FPSCR which we cache in the TB flags are the VECLEN
-         * and VECSTRIDE, and those don't exist for M-profile.
+         * We just updated the FPSCR and VPR. Some of this state is cached
+         * in the MVE_NO_PRED TB flag. We want to avoid having to end the
+         * TB here, which means we need the new value of the MVE_NO_PRED
+         * flag to be exactly known here and the same for all executions.
+         * Luckily FPDSCR.LTPSIZE is always constant 4 and the VPR is
+         * always set to 0, so the new MVE_NO_PRED flag is always 1
+         * if and only if we have MVE.
+         *
+         * (The other FPSCR state cached in TB flags is VECLEN and VECSTRIDE,
+         * but those do not exist for M-profile, so are not relevant here.)
          */
+        s->mve_no_pred = dc_isar_feature(aa32_mve, s);
 
         if (s->v8m_secure) {
             bits |= R_V7M_CONTROL_SFPA_MASK;
@@ -XXX,XX +XXX,XX @@ bool vfp_access_check_m(DisasContext *s, bool skip_context_update)
     /* Handle M-profile lazy FP state mechanics */
 
     /* Trigger lazy-state preservation if necessary */
-    gen_preserve_fp_state(s);
+    gen_preserve_fp_state(s, skip_context_update);
 
     if (!skip_context_update) {
         /* Update ownership of FP context and create new FP context if needed */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_DLS(DisasContext *s, arg_DLS *a)
         /* DLSTP: set FPSCR.LTPSIZE */
         tmp = tcg_const_i32(a->size);
         store_cpu_field(tmp, v7m.ltpsize);
+        s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_WLS(DisasContext *s, arg_WLS *a)
         assert(ok);
         tmp = tcg_const_i32(a->size);
         store_cpu_field(tmp, v7m.ltpsize);
+        /*
+         * LTPSIZE updated, but MVE_NO_PRED will always be the same thing (0)
+         * when we take this upcoming exit from this TB, so gen_jmp_tb() is OK.
+         */
     }
     gen_jmp_tb(s, s->base.pc_next, 1);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCTP(DisasContext *s, arg_VCTP *a)
     gen_helper_mve_vctp(cpu_env, masklen);
     tcg_temp_free_i32(masklen);
     tcg_temp_free_i32(rn_shifted);
+    /* This insn updates predication bits */
+    s->base.is_jmp = DISAS_UPDATE_NOCHAIN;
     mve_update_eci(s);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->v7m_new_fp_ctxt_needed =
             EX_TBFLAG_M32(tb_flags, NEW_FP_CTXT_NEEDED);
         dc->v7m_lspact = EX_TBFLAG_M32(tb_flags, LSPACT);
+        dc->mve_no_pred = EX_TBFLAG_M32(tb_flags, MVE_NO_PRED);
     } else {
         dc->debug_target_el = EX_TBFLAG_ANY(tb_flags, DEBUG_TARGET_EL);
         dc->sctlr_b = EX_TBFLAG_A32(tb_flags, SCTLR__B);
-- 
2.20.1

When not predicating, implement the MVE bitwise logical insns
directly using TCG vector operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-5-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 51 +++++++++++++++++++++++++++-----------
 1 file changed, 36 insertions(+), 15 deletions(-)

diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr mve_qreg_ptr(unsigned reg)
     return ret;
 }
 
+static bool mve_no_predication(DisasContext *s)
+{
+    /*
+     * Return true if we are executing the entire MVE instruction
+     * with no predication or partial-execution, and so we can safely
+     * use an inline TCG vector implementation.
+     */
+    return s->eci == 0 && s->mve_no_pred;
+}
+
 static bool mve_check_qreg_bank(DisasContext *s, int qmask)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static bool trans_VNEG_fp(DisasContext *s, arg_1op *a)
     return do_1op(s, a, fns[a->size]);
 }
 
-static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn)
+static bool do_2op_vec(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn,
+                       GVecGen3Fn *vecfn)
 {
     TCGv_ptr qd, qn, qm;
 
@@ -XXX,XX +XXX,XX @@ static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn fn)
         return true;
     }
 
-    qd = mve_qreg_ptr(a->qd);
-    qn = mve_qreg_ptr(a->qn);
-    qm = mve_qreg_ptr(a->qm);
-    fn(cpu_env, qd, qn, qm);
-    tcg_temp_free_ptr(qd);
-    tcg_temp_free_ptr(qn);
-    tcg_temp_free_ptr(qm);
+    if (vecfn && mve_no_predication(s)) {
+        vecfn(a->size, mve_qreg_offset(a->qd), mve_qreg_offset(a->qn),
+              mve_qreg_offset(a->qm), 16, 16);
+    } else {
+        qd = mve_qreg_ptr(a->qd);
+        qn = mve_qreg_ptr(a->qn);
+        qm = mve_qreg_ptr(a->qm);
+        fn(cpu_env, qd, qn, qm);
+        tcg_temp_free_ptr(qd);
+        tcg_temp_free_ptr(qn);
+        tcg_temp_free_ptr(qm);
+    }
     mve_update_eci(s);
     return true;
 }
 
-#define DO_LOGIC(INSN, HELPER)                                  \
+static bool do_2op(DisasContext *s, arg_2op *a, MVEGenTwoOpFn *fn)
+{
+    return do_2op_vec(s, a, fn, NULL);
+}
+
+#define DO_LOGIC(INSN, HELPER, VECFN)                           \
     static bool trans_##INSN(DisasContext *s, arg_2op *a)       \
     {                                                           \
-        return do_2op(s, a, HELPER);                            \
+        return do_2op_vec(s, a, HELPER, VECFN);                 \
     }
 
-DO_LOGIC(VAND, gen_helper_mve_vand)
-DO_LOGIC(VBIC, gen_helper_mve_vbic)
-DO_LOGIC(VORR, gen_helper_mve_vorr)
-DO_LOGIC(VORN, gen_helper_mve_vorn)
-DO_LOGIC(VEOR, gen_helper_mve_veor)
+DO_LOGIC(VAND, gen_helper_mve_vand, tcg_gen_gvec_and)
+DO_LOGIC(VBIC, gen_helper_mve_vbic, tcg_gen_gvec_andc)
+DO_LOGIC(VORR, gen_helper_mve_vorr, tcg_gen_gvec_or)
+DO_LOGIC(VORN, gen_helper_mve_vorn, tcg_gen_gvec_orc)
+DO_LOGIC(VEOR, gen_helper_mve_veor, tcg_gen_gvec_xor)
 
 static bool trans_VPSEL(DisasContext *s, arg_2op *a)
 {
-- 
2.20.1

Optimize MVE arithmetic ops when we have a TCG
vector operation we can use.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-6-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

Optimize the MVE VNEG and VABS insns by using TCG
vector ops when possible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-7-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

Optimize the MVE VDUP insns by using TCG vector ops when possible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-8-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
         return true;
     }
 
-    qd = mve_qreg_ptr(a->qd);
     rt = load_reg(s, a->rt);
-    tcg_gen_dup_i32(a->size, rt, rt);
-    gen_helper_mve_vdup(cpu_env, qd, rt);
-    tcg_temp_free_ptr(qd);
+    if (mve_no_predication(s)) {
+        tcg_gen_gvec_dup_i32(a->size, mve_qreg_offset(a->qd), 16, 16, rt);
+    } else {
+        qd = mve_qreg_ptr(a->qd);
+        tcg_gen_dup_i32(a->size, rt, rt);
+        gen_helper_mve_vdup(cpu_env, qd, rt);
+        tcg_temp_free_ptr(qd);
+    }
     tcg_temp_free_i32(rt);
     mve_update_eci(s);
     return true;
-- 
2.20.1

Optimize the MVE VSHL and VSHR immediate forms by using TCG vector
ops when possible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-10-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 83 +++++++++++++++++++++++++++++---------
 1 file changed, 63 insertions(+), 20 deletions(-)

diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
     return do_1imm(s, a, fn);
 }
 
-static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
-                      bool negateshift)
+static bool do_2shift_vec(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
+                          bool negateshift, GVecGen2iFn vecfn)
 {
     TCGv_ptr qd, qm;
     int shift = a->shift;
@@ -XXX,XX +XXX,XX @@ static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
         shift = -shift;
     }
 
-    qd = mve_qreg_ptr(a->qd);
-    qm = mve_qreg_ptr(a->qm);
-    fn(cpu_env, qd, qm, tcg_constant_i32(shift));
-    tcg_temp_free_ptr(qd);
-    tcg_temp_free_ptr(qm);
+    if (vecfn && mve_no_predication(s)) {
+        vecfn(a->size, mve_qreg_offset(a->qd), mve_qreg_offset(a->qm),
+              shift, 16, 16);
+    } else {
+        qd = mve_qreg_ptr(a->qd);
+        qm = mve_qreg_ptr(a->qm);
+        fn(cpu_env, qd, qm, tcg_constant_i32(shift));
+        tcg_temp_free_ptr(qd);
+        tcg_temp_free_ptr(qm);
+    }
     mve_update_eci(s);
     return true;
 }
 
-#define DO_2SHIFT(INSN, FN, NEGATESHIFT)                         \
-    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
-    {                                                           \
-        static MVEGenTwoOpShiftFn * const fns[] = {             \
-            gen_helper_mve_##FN##b,                             \
-            gen_helper_mve_##FN##h,                             \
-            gen_helper_mve_##FN##w,                             \
-            NULL,                                               \
-        };                                                      \
-        return do_2shift(s, a, fns[a->size], NEGATESHIFT);      \
+static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
+                      bool negateshift)
+{
+    return do_2shift_vec(s, a, fn, negateshift, NULL);
+}
+
+#define DO_2SHIFT_VEC(INSN, FN, NEGATESHIFT, VECFN)                     \
+    static bool trans_##INSN(DisasContext *s, arg_2shift *a)            \
+    {                                                                   \
+        static MVEGenTwoOpShiftFn * const fns[] = {                     \
+            gen_helper_mve_##FN##b,                                     \
+            gen_helper_mve_##FN##h,                                     \
+            gen_helper_mve_##FN##w,                                     \
+            NULL,                                                       \
+        };                                                              \
+        return do_2shift_vec(s, a, fns[a->size], NEGATESHIFT, VECFN);   \
     }
 
-DO_2SHIFT(VSHLI, vshli_u, false)
+#define DO_2SHIFT(INSN, FN, NEGATESHIFT)        \
+    DO_2SHIFT_VEC(INSN, FN, NEGATESHIFT, NULL)
+
+static void do_gvec_shri_s(unsigned vece, uint32_t dofs, uint32_t aofs,
+                           int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    /*
+     * We get here with a negated shift count, and we must handle
+     * shifts by the element size, which tcg_gen_gvec_sari() does not do.
+     */
+    shift = -shift;
+    if (shift == (8 << vece)) {
+        shift--;
+    }
+    tcg_gen_gvec_sari(vece, dofs, aofs, shift, oprsz, maxsz);
+}
+
+static void do_gvec_shri_u(unsigned vece, uint32_t dofs, uint32_t aofs,
+                           int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    /*
+     * We get here with a negated shift count, and we must handle
+     * shifts by the element size, which tcg_gen_gvec_shri() does not do.
+     */
+    shift = -shift;
+    if (shift == (8 << vece)) {
+        tcg_gen_gvec_dup_imm(vece, dofs, oprsz, maxsz, 0);
+    } else {
+        tcg_gen_gvec_shri(vece, dofs, aofs, shift, oprsz, maxsz);
+    }
+}
+
+DO_2SHIFT_VEC(VSHLI, vshli_u, false, tcg_gen_gvec_shli)
 DO_2SHIFT(VQSHLI_S, vqshli_s, false)
 DO_2SHIFT(VQSHLI_U, vqshli_u, false)
 DO_2SHIFT(VQSHLUI, vqshlui_s, false)
 /* These right shifts use a left-shift helper with negated shift count */
-DO_2SHIFT(VSHRI_S, vshli_s, true)
-DO_2SHIFT(VSHRI_U, vshli_u, true)
+DO_2SHIFT_VEC(VSHRI_S, vshli_s, true, do_gvec_shri_s)
+DO_2SHIFT_VEC(VSHRI_U, vshli_u, true, do_gvec_shri_u)
 DO_2SHIFT(VRSHRI_S, vrshli_s, true)
 DO_2SHIFT(VRSHRI_U, vrshli_u, true)
 
-- 
2.20.1

Optimize the MVE VSHLL insns by using TCG vector ops when possible.
This includes the VMOVL insn, which we handle in mve.decode as "VSHLL
with zero shift count".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-11-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 67 +++++++++++++++++++++++++++++++++-----
 1 file changed, 59 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_SCALAR(VQSHL_U_scalar, vqshli_u)
 DO_2SHIFT_SCALAR(VQRSHL_S_scalar, vqrshli_s)
 DO_2SHIFT_SCALAR(VQRSHL_U_scalar, vqrshli_u)
 
-#define DO_VSHLL(INSN, FN)                                      \
-    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
-    {                                                           \
-        static MVEGenTwoOpShiftFn * const fns[] = {             \
-            gen_helper_mve_##FN##b,                             \
-            gen_helper_mve_##FN##h,                             \
-        };                                                      \
-        return do_2shift(s, a, fns[a->size], false);            \
+#define DO_VSHLL(INSN, FN)                                              \
+    static bool trans_##INSN(DisasContext *s, arg_2shift *a)            \
+    {                                                                   \
+        static MVEGenTwoOpShiftFn * const fns[] = {                     \
+            gen_helper_mve_##FN##b,                                     \
+            gen_helper_mve_##FN##h,                                     \
+        };                                                              \
+        return do_2shift_vec(s, a, fns[a->size], false, do_gvec_##FN);  \
     }
 
+/*
+ * For the VSHLL vector helpers, the vece is the size of the input
+ * (ie MO_8 or MO_16); the helpers want to work in the output size.
+ * The shift count can be 0..<input size>, inclusive. (0 is VMOVL.)
+ */
+static void do_gvec_vshllbs(unsigned vece, uint32_t dofs, uint32_t aofs,
+                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    unsigned ovece = vece + 1;
+    unsigned ibits = vece == MO_8 ? 8 : 16;
+    tcg_gen_gvec_shli(ovece, dofs, aofs, ibits, oprsz, maxsz);
+    tcg_gen_gvec_sari(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
+}
+
+static void do_gvec_vshllbu(unsigned vece, uint32_t dofs, uint32_t aofs,
+                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    unsigned ovece = vece + 1;
+    tcg_gen_gvec_andi(ovece, dofs, aofs,
+                      ovece == MO_16 ? 0xff : 0xffff, oprsz, maxsz);
+    tcg_gen_gvec_shli(ovece, dofs, dofs, shift, oprsz, maxsz);
+}
+
+static void do_gvec_vshllts(unsigned vece, uint32_t dofs, uint32_t aofs,
+                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    unsigned ovece = vece + 1;
+    unsigned ibits = vece == MO_8 ? 8 : 16;
+    if (shift == 0) {
+        tcg_gen_gvec_sari(ovece, dofs, aofs, ibits, oprsz, maxsz);
+    } else {
+        tcg_gen_gvec_andi(ovece, dofs, aofs,
+                          ovece == MO_16 ? 0xff00 : 0xffff0000, oprsz, maxsz);
+        tcg_gen_gvec_sari(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
+    }
+}
+
+static void do_gvec_vshlltu(unsigned vece, uint32_t dofs, uint32_t aofs,
+                            int64_t shift, uint32_t oprsz, uint32_t maxsz)
+{
+    unsigned ovece = vece + 1;
+    unsigned ibits = vece == MO_8 ? 8 : 16;
+    if (shift == 0) {
+        tcg_gen_gvec_shri(ovece, dofs, aofs, ibits, oprsz, maxsz);
+    } else {
+        tcg_gen_gvec_andi(ovece, dofs, aofs,
+                          ovece == MO_16 ? 0xff00 : 0xffff0000, oprsz, maxsz);
+        tcg_gen_gvec_shri(ovece, dofs, dofs, ibits - shift, oprsz, maxsz);
+    }
+}
+
 DO_VSHLL(VSHLL_BS, vshllbs)
 DO_VSHLL(VSHLL_BU, vshllbu)
 DO_VSHLL(VSHLL_TS, vshllts)
-- 
2.20.1

Optimize the MVE 1op-immediate insns (VORR, VBIC, VMOV) to
use TCG vector ops when possible.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210913095440.13462-13-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)