Series comparison

-[Qemu-devel] [PULL 00/12] target-arm queue
+[Qemu-devel] [PULL 00/24] target-arm queue
-Not very much here, but several people have fallen over
+Latest arm queue, half minor code cleanups and half minor
-the vector operation segfault bug, so let's get the fix
+bug fixes.
 into master.
-thanks
 -- PMM
-The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:
+The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:
-  Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)
+  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617
-for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:
+for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:
-  hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)
+  target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * exynos4210: QOM'ify the Exynos4210 SoC
+ * support large kernel images in bootloader (by avoiding
- * exynos4210: Add DMA support for the Exynos4210
+   putting the initrd over the top of them)
- * arm_gicv3: Fix writes to ICC_CTLR_EL3
+ * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
- * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
+ * arm_gicv3: Fix decoding of ID register range
- * target/arm: Fix vector operation segfault
+ * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
- * target/arm: Minor improvements to BFXIL, EXTR
+ * some code cleanups following on from the VFP decodetree conversion
  * Only implement doubles if the FPU supports them
    (so we now correctly model Cortex-M4, -M33 as single precision only)
 ----------------------------------------------------------------
-Alistair Francis (1):
+Peter Maydell (24):
-      target/arm: Fix vector operation segfault
+      hw/arm/boot: Don't assume RAM starts at address zero
       hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
       hw/arm/boot: Avoid placing the initrd on top of the kernel
       hw/arm/boot: Honour image size field in AArch64 Image format kernels
       target/arm: Allow VFP and Neon to be disabled via a CPU property
       target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
       hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
       hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
       hw/intc/arm_gicv3: Fix decoding of ID register range
       hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
       target/arm: Move vfp_expand_imm() to translate.[ch]
       target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
       target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
       target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
       target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
       target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
       target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
       target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
       target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
       target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
       target/arm: Fix typos in trans function prototypes
       target/arm: Only implement doubles if the FPU supports them
-Guenter Roeck (1):
+ include/hw/arm/armsse.h        |   7 ++
-      hw/arm/exynos4210: Add DMA support for the Exynos4210
+ include/hw/arm/armv7m.h        |   4 +
  target/arm/cpu.h               |  12 +++
  target/arm/translate-a64.h     |   1 -
  target/arm/translate.h         |   7 ++
  hw/arm/armsse.c                |  58 +++++++---
  hw/arm/armv7m.c                |  18 ++++
  hw/arm/boot.c                  |  83 ++++++++++----
  hw/arm/musca.c                 |   8 ++
  hw/intc/arm_gicv3_dist.c       |  12 ++-
  hw/intc/arm_gicv3_redist.c     |   4 +-
  target/arm/cpu.c               | 179 ++++++++++++++++++++++++++++--
  target/arm/translate-a64.c     |  32 ------
  target/arm/translate-vfp.inc.c | 173 ++++++++++++++++++++++-------
  target/arm/translate.c         | 240 ++++++++++++++---------------------------
  target/arm/vfp.decode          |  10 +-
 files changed, 572 insertions(+), 276 deletions(-)
-Peter Maydell (5):
-      arm: Move system_clock_scale to armv7m_systick.h
-      arm: Remove unnecessary includes of hw/arm/arm.h
-      arm: Rename hw/arm/arm.h to hw/arm/boot.h
-      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
-      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
-Philippe Mathieu-Daudé (3):
-      hw/arm/exynos4: Remove unuseful debug code
-      hw/arm/exynos4: Use the IEC binary prefix definitions
-      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
-Richard Henderson (2):
-      target/arm: Use extract2 for EXTR
-      target/arm: Simplify BFXIL expansion
- include/hw/arm/allwinner-a10.h    |  2 +-
- include/hw/arm/aspeed_soc.h       |  1 -
- include/hw/arm/bcm2836.h          |  1 -
- include/hw/arm/{arm.h => boot.h}  | 12 +++------
- include/hw/arm/exynos4210.h       |  9 +++++--
- include/hw/arm/fsl-imx25.h        |  2 +-
- include/hw/arm/fsl-imx31.h        |  2 +-
- include/hw/arm/fsl-imx6.h         |  2 +-
- include/hw/arm/fsl-imx6ul.h       |  2 +-
- include/hw/arm/fsl-imx7.h         |  2 +-
- include/hw/arm/virt.h             |  2 +-
- include/hw/arm/xlnx-versal.h      |  2 +-
- include/hw/arm/xlnx-zynqmp.h      |  2 +-
- include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
- hw/arm/armsse.c                   |  2 +-
- hw/arm/armv7m.c                   |  2 +-
- hw/arm/aspeed.c                   |  2 +-
- hw/arm/boot.c                     |  2 +-
- hw/arm/collie.c                   |  2 +-
- hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
- hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
- hw/arm/highbank.c                 |  2 +-
- hw/arm/integratorcp.c             |  2 +-
- hw/arm/mainstone.c                |  2 +-
- hw/arm/microbit.c                 |  2 +-
- hw/arm/mps2-tz.c                  |  2 +-
- hw/arm/mps2.c                     |  2 +-
- hw/arm/msf2-soc.c                 |  1 -
- hw/arm/msf2-som.c                 |  2 +-
- hw/arm/musca.c                    |  2 +-
- hw/arm/musicpal.c                 |  2 +-
- hw/arm/netduino2.c                |  2 +-
- hw/arm/nrf51_soc.c                |  2 +-
- hw/arm/nseries.c                  |  2 +-
- hw/arm/omap1.c                    |  2 +-
- hw/arm/omap2.c                    |  2 +-
- hw/arm/omap_sx1.c                 |  2 +-
- hw/arm/palm.c                     |  2 +-
- hw/arm/raspi.c                    |  2 +-
- hw/arm/realview.c                 |  2 +-
- hw/arm/spitz.c                    |  2 +-
- hw/arm/stellaris.c                |  2 +-
- hw/arm/stm32f205_soc.c            |  2 +-
- hw/arm/strongarm.c                |  2 +-
- hw/arm/tosa.c                     |  2 +-
- hw/arm/versatilepb.c              |  2 +-
- hw/arm/vexpress.c                 |  2 +-
- hw/arm/virt.c                     |  2 +-
- hw/arm/xilinx_zynq.c              |  2 +-
- hw/arm/xlnx-versal.c              |  2 +-
- hw/arm/z2.c                       |  2 +-
- hw/intc/arm_gicv3_cpuif.c         |  6 ++---
- hw/intc/armv7m_nvic.c             |  1 -
- target/arm/arm-semi.c             |  1 -
- target/arm/cpu.c                  |  1 -
- target/arm/cpu64.c                |  1 -
- target/arm/kvm.c                  |  1 -
- target/arm/kvm32.c                |  1 -
- target/arm/kvm64.c                |  1 -
- target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
- target/arm/translate.c            |  4 +--
-files changed, 164 insertions(+), 123 deletions(-)
- rename include/hw/arm/{arm.h => boot.h} (96%)

-New patch
+[Qemu-devel] [PULL 01/24] hw/arm/boot: Don't assume RAM starts at address zero
+In the Arm kernel/initrd loading code, in some places we make the
+incorrect assumption that info->ram_size can be treated as the
+address of the end of RAM, as for instance when we calculate the
+available space for the initrd using "info->ram_size - info->initrd_start".
+This is wrong, because many Arm boards (including "virt") specify
+a non-zero info->loader_start to indicate that their RAM area
+starts at a non-zero physical address.
+Correct the places which make this incorrect assumption.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     int elf_machine;
+     hwaddr entry;
+     static const ARMInsnFixup *primary_loader;
++    uint64_t ram_end = info->loader_start + info->ram_size;
+     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+         primary_loader = bootloader_aarch64;
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         /* 32-bit ARM */
+         entry = info->loader_start + KERNEL_LOAD_ADDR;
+         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
+-                                             info->ram_size - KERNEL_LOAD_ADDR,
+-                                             as);
++                                             ram_end - KERNEL_LOAD_ADDR, as);
+         is_linux = 1;
+     }
+     if (kernel_size < 0) {
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         if (info->initrd_filename) {
+             initrd_size = load_ramdisk_as(info->initrd_filename,
+                                           info->initrd_start,
+-                                          info->ram_size - info->initrd_start,
+-                                          as);
++                                          ram_end - info->initrd_start, as);
+             if (initrd_size < 0) {
+                 initrd_size = load_image_targphys_as(info->initrd_filename,
+                                                      info->initrd_start,
+-                                                     info->ram_size -
++                                                     ram_end -
+                                                      info->initrd_start,
+                                                      as);
+             }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 02/24] hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
+We calculate the locations in memory where we want to put the
+initrd and the DTB based on the size of the kernel, since they
+come after it. Add some explicit checks that these aren't off the
+end of RAM entirely.
+(At the moment the way we calculate the initrd_start means that
+it can't ever be off the end of RAM, but that will change with
+the next commit.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 23 +++++++++++++++++++++++
+file changed, 23 insertions(+)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+         error_report("could not load kernel '%s'", info->kernel_filename);
+         exit(1);
+     }
++
++    if (kernel_size > info->ram_size) {
++        error_report("kernel '%s' is too large to fit in RAM "
++                     "(kernel size %d, RAM size %" PRId64 ")",
++                     info->kernel_filename, kernel_size, info->ram_size);
++        exit(1);
++    }
++
+     info->entry = entry;
+     if (is_linux) {
+         uint32_t fixupcontext[FIXUP_MAX];
+         if (info->initrd_filename) {
++
++            if (info->initrd_start >= ram_end) {
++                error_report("not enough space after kernel to load initrd");
++                exit(1);
++            }
++
+             initrd_size = load_ramdisk_as(info->initrd_filename,
+                                           info->initrd_start,
+                                           ram_end - info->initrd_start, as);
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+                              info->initrd_filename);
+                 exit(1);
+             }
++            if (info->initrd_start + initrd_size > info->ram_size) {
++                error_report("could not load initrd '%s': "
++                             "too big to fit into RAM after the kernel",
++                             info->initrd_filename);
++            }
+         } else {
+             initrd_size = 0;
+         }
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+             /* Place the DTB after the initrd in memory with alignment. */
+             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
+                                            align);
++            if (info->dtb_start >= ram_end) {
++                error_report("Not enough space for DTB after kernel/initrd");
++                exit(1);
++            }
+             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
+             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
+         } else {
+--
+.20.1

-[Qemu-devel] [PULL 09/12] hw/arm/exynos4: Remove unuseful debug code
+[Qemu-devel] [PULL 03/24] hw/arm/boot: Avoid placing the initrd on top of the kernel
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+We currently put the initrd at the smaller of:
  * 128MB into RAM
  * halfway into the RAM
 (with the dtb following it).
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+However for large kernels this might mean that the kernel
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+overlaps the initrd. For some kinds of kernel (self-decompressing
-Message-id: 20190520214342.13709-2-philmd@redhat.com
+-bit kernels, and ELF images with a BSS section at the end)
 we don't know the exact size, but even there we have a
 minimum size. Put the initrd at least further into RAM than
 that. For image formats that can give us an exact kernel size, this
 will mean that we definitely avoid overlaying kernel and initrd.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
 ---
- hw/arm/exynos4_boards.c | 24 ------------------------
+ hw/arm/boot.c | 34 ++++++++++++++++++++--------------
-file changed, 24 deletions(-)
+file changed, 20 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
+--- a/hw/arm/boot.c
-+++ b/hw/arm/exynos4_boards.c
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
- #include "hw/net/lan9118.h"
+     if (info->nb_cpus == 0)
- #include "hw/boards.h"
+         info->nb_cpus = 1;
--#undef DEBUG
+-    /*
 -     * We want to put the initrd far enough into RAM that when the
 -     * kernel is uncompressed it will not clobber the initrd. However
 -     * on boards without much RAM we must ensure that we still leave
 -     * enough room for a decent sized initrd, and on boards with large
 -     * amounts of RAM we must avoid the initrd being so far up in RAM
 -     * that it is outside lowmem and inaccessible to the kernel.
 -     * So for boards with less  than 256MB of RAM we put the initrd
 -     * halfway into RAM, and for boards with 256MB of RAM or more we put
 -     * the initrd at 128MB.
 -     */
 -    info->initrd_start = info->loader_start +
 -        MIN(info->ram_size / 2, 128 * 1024 * 1024);
 -
--//#define DEBUG
+     /* Assume that raw images are linux kernels, and ELF images are not.  */
--
+     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
--#ifdef DEBUG
+                                &elf_high_addr, elf_machine, as);
--    #undef PRINT_DEBUG
+@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
--    #define  PRINT_DEBUG(fmt, args...) \
+     }
--        do { \
--            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
+     info->entry = entry;
--        } while (0)
++
--#else
++    /*
--    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
++     * We want to put the initrd far enough into RAM that when the
--#endif
++     * kernel is uncompressed it will not clobber the initrd. However
--
++     * on boards without much RAM we must ensure that we still leave
- #define SMDK_LAN9118_BASE_ADDR      0x05000000
++     * enough room for a decent sized initrd, and on boards with large
++     * amounts of RAM we must avoid the initrd being so far up in RAM
- typedef enum Exynos4BoardType {
++     * that it is outside lowmem and inaccessible to the kernel.
-@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
++     * So for boards with less  than 256MB of RAM we put the initrd
-     exynos4_board_binfo.gic_cpu_if_addr =
++     * halfway into RAM, and for boards with 256MB of RAM or more we put
-             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
++     * the initrd at 128MB.
++     * We also refuse to put the initrd somewhere that will definitely
--    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
++     * overlay the kernel we just loaded, though for kernel formats which
--            " kernel_filename: %s\n"
++     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
--            " kernel_cmdline: %s\n"
++     * we might still make a bad choice here.
--            " initrd_filename: %s\n",
++     */
--            exynos4_board_ram_size[board_type] / 1048576,
++    info->initrd_start = info->loader_start +
--            exynos4_board_ram_size[board_type],
++        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
--            machine->kernel_filename,
++    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
--            machine->kernel_cmdline,
++
--            machine->initrd_filename);
+     if (is_linux) {
--
+         uint32_t fixupcontext[FIXUP_MAX];
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 --
 .20.1

-New patch
+[Qemu-devel] [PULL 04/24] hw/arm/boot: Honour image size field in AArch64 Image format kernels
+Since Linux v3.17, the kernel's Image header includes a field image_size,
+which gives the total size of the kernel including unpopulated data
+sections such as the BSS). If this is present, then return it from
+load_aarch64_image() as the true size of the kernel rather than
+just using the size of the Image file itself. This allows the code
+which calculates where to put the initrd to avoid putting it in
+the kernel's BSS area.
+This means that we should be able to reliably load kernel images
+which are larger than 128MB without accidentally putting the
+initrd or dtb in locations that clash with the kernel itself.
+Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
+---
+ hw/arm/boot.c | 17 +++++++++++++++--
+file changed, 15 insertions(+), 2 deletions(-)
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/boot.c
++++ b/hw/arm/boot.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+                                    hwaddr *entry, AddressSpace *as)
+ {
+     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
++    uint64_t kernel_size = 0;
+     uint8_t *buffer;
+     int size;
+@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+          * is only valid if the image_size is non-zero.
+          */
+         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
+-        if (hdrvals[1] != 0) {
++
++        kernel_size = le64_to_cpu(hdrvals[1]);
++
++        if (kernel_size != 0) {
+             kernel_load_offset = le64_to_cpu(hdrvals[0]);
+             /*
+@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+         }
+     }
++    /*
++     * Kernels before v3.17 don't populate the image_size field, and
++     * raw images have no header. For those our best guess at the size
++     * is the size of the Image file itself.
++     */
++    if (kernel_size == 0) {
++        kernel_size = size;
++    }
++
+     *entry = mem_base + kernel_load_offset;
+     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
+     g_free(buffer);
+-    return size;
++    return kernel_size;
+ }
+ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+--
+.20.1

-[Qemu-devel] [PULL 05/12] arm: Remove unnecessary includes of hw/arm/arm.h
+[Qemu-devel] [PULL 05/24] target/arm: Allow VFP and Neon to be disabled via a CPU property
-The hw/arm/arm.h header now only includes declarations relating
+Allow VFP and neon to be disabled via a CPU property. As with
-to boot.c code, so it is only needed by Arm board or SoC code.
+the "pmu" property, we only allow these features to be removed
-Remove some unnecessary inclusions of it from target/arm files
+from CPUs which have it by default, not added to CPUs which
-and from hw/intc/armv7m_nvic.c.
+don't have it.
 The primary motivation here is to be able to optionally
 create Cortex-M33 CPUs with no FPU, but we provide switches
 for both VFP and Neon because the two interact:
  * AArch64 can't have one without the other
  * Some ID register fields only change if both are disabled
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190516163857.6430-3-peter.maydell@linaro.org
+Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 1 -
+ target/arm/cpu.h |   4 ++
- target/arm/arm-semi.c | 1 -
+ target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
- target/arm/cpu.c      | 1 -
+files changed, 148 insertions(+), 6 deletions(-)
- target/arm/cpu64.c    | 1 -
- target/arm/kvm.c      | 1 -
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
  target/arm/kvm32.c    | 1 -
  target/arm/kvm64.c    | 1 -
 files changed, 7 deletions(-)
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/target/arm/cpu.h
-+++ b/hw/intc/armv7m_nvic.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
- #include "cpu.h"
+     bool has_el3;
- #include "hw/sysbus.h"
+     /* CPU has PMU (Performance Monitor Unit) */
- #include "qemu/timer.h"
+     bool has_pmu;
--#include "hw/arm/arm.h"
++    /* CPU has VFP */
- #include "hw/intc/armv7m_nvic.h"
++    bool has_vfp;
- #include "target/arm/cpu.h"
++    /* CPU has Neon */
- #include "exec/exec-all.h"
++    bool has_neon;
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
-index XXXXXXX..XXXXXXX 100644
+     /* CPU has memory protection unit */
---- a/target/arm/arm-semi.c
+     bool has_mpu;
 +++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
  #else
  #include "qemu-common.h"
  #include "exec/gdbstub.h"
 -#include "hw/arm/arm.h"
  #include "qemu/cutils.h"
  #endif
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
- #if !defined(CONFIG_USER_ONLY)
+ static Property arm_cpu_has_pmu_property =
- #include "hw/loader.h"
+             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
- #endif
--#include "hw/arm/arm.h"
++static Property arm_cpu_has_vfp_property =
- #include "sysemu/sysemu.h"
++            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
- #include "sysemu/hw_accel.h"
++
- #include "kvm_arm.h"
++static Property arm_cpu_has_neon_property =
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
++            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
-index XXXXXXX..XXXXXXX 100644
++
---- a/target/arm/cpu64.c
+ static Property arm_cpu_has_mpu_property =
-+++ b/target/arm/cpu64.c
+             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
-@@ -XXX,XX +XXX,XX @@
- #if !defined(CONFIG_USER_ONLY)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
- #include "hw/loader.h"
+     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
- #endif
+         set_feature(&cpu->env, ARM_FEATURE_PMSA);
--#include "hw/arm/arm.h"
+     }
- #include "sysemu/sysemu.h"
++    /* Similarly for the VFP feature bits */
- #include "sysemu/kvm.h"
++    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
- #include "kvm_arm.h"
++        set_feature(&cpu->env, ARM_FEATURE_VFP3);
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
++    }
-index XXXXXXX..XXXXXXX 100644
++    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
---- a/target/arm/kvm.c
++        set_feature(&cpu->env, ARM_FEATURE_VFP);
-+++ b/target/arm/kvm.c
++    }
-@@ -XXX,XX +XXX,XX @@
- #include "cpu.h"
+     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
- #include "trace.h"
+         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
- #include "internals.h"
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
--#include "hw/arm/arm.h"
+                                  &error_abort);
- #include "hw/pci/pci.h"
+     }
- #include "exec/memattrs.h"
- #include "exec/address-spaces.h"
++    /*
-diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
++     * Allow user to turn off VFP and Neon support, but only for TCG --
-index XXXXXXX..XXXXXXX 100644
++     * KVM does not currently allow us to lie to the guest about its
---- a/target/arm/kvm32.c
++     * ID/feature registers, so the guest always sees what the host has.
-+++ b/target/arm/kvm32.c
++     */
-@@ -XXX,XX +XXX,XX @@
++    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
- #include "sysemu/kvm.h"
++        cpu->has_vfp = true;
- #include "kvm_arm.h"
++        if (!kvm_enabled()) {
- #include "internals.h"
++            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
--#include "hw/arm/arm.h"
++                                     &error_abort);
- #include "qemu/log.h"
++        }
++    }
- static inline void set_feature(uint64_t *features, int feature)
++
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
++    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
-index XXXXXXX..XXXXXXX 100644
++        cpu->has_neon = true;
---- a/target/arm/kvm64.c
++        if (!kvm_enabled()) {
-+++ b/target/arm/kvm64.c
++            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
-@@ -XXX,XX +XXX,XX @@
++                                     &error_abort);
- #include "sysemu/kvm.h"
++        }
- #include "kvm_arm.h"
++    }
- #include "internals.h"
++
--#include "hw/arm/arm.h"
+     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
+         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
- static bool have_guest_debug;
+                                  &error_abort);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          return;
      }
 +    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
 +        cpu->has_vfp != cpu->has_neon) {
 +        /*
 +         * This is an architectural requirement for AArch64; AArch32 is
 +         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
 +         */
 +        error_setg(errp,
 +                   "AArch64 CPUs must have both VFP and Neon or neither");
 +        return;
 +    }
 +
 +    if (!cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_VFP);
 +        unset_feature(env, ARM_FEATURE_VFP3);
 +        unset_feature(env, ARM_FEATURE_VFP4);
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, FPSP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
 +        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
 +        cpu->isar.mvfr0 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
 +        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
 +        u = FIELD_DP32(u, MVFR1, FPHP, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_NEON);
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar5;
 +        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
 +        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
 +        cpu->isar.id_isar5 = u;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
 +        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon && !cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
 +        cpu->isar.mvfr0 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V5)) {
          set_feature(env, ARM_FEATURE_V4T);
      }
 -    if (arm_feature(env, ARM_FEATURE_VFP4)) {
 -        set_feature(env, ARM_FEATURE_VFP3);
 -    }
 -    if (arm_feature(env, ARM_FEATURE_VFP3)) {
 -        set_feature(env, ARM_FEATURE_VFP);
 -    }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
          set_feature(env, ARM_FEATURE_PXN);
 --
 .20.1

-[Qemu-devel] [PULL 08/12] hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3
+[Qemu-devel] [PULL 06/24] target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
-The ICC_CTLR_EL3 register includes some bits which are aliases
+Allow the DSP extension to be disabled via a CPU property for
-of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
+M-profile CPUs. (A and R-profile CPUs don't have this extension
-to keep those bits in the cs->icc_ctlr_el1[] struct fields.
+as a defined separate optional architecture extension, so
-Unfortunately a missing '~' in the code to update the bits
+they don't need the property.)
 in those fields meant that writing to ICC_CTLR_EL3 would corrupt
 the ICC_CLTR_EL1 register values.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_cpuif.c | 4 ++--
+ target/arm/cpu.h |  2 ++
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
 files changed, 31 insertions(+)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/target/arm/cpu.h
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
+     bool has_vfp;
+     /* CPU has Neon */
-     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
+     bool has_neon;
--    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
++    /* CPU has M-profile DSP extension */
-+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
++    bool has_dsp;
-     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
-         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
+     /* CPU has memory protection unit */
      bool has_mpu;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
  static Property arm_cpu_has_neon_property =
              DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 +static Property arm_cpu_has_dsp_property =
 +            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
 +
  static Property arm_cpu_has_mpu_property =
              DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
          }
      }
-@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
++    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
 +        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
 +        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
 +                                 &error_abort);
 +    }
 +
      if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          cpu->isar.mvfr0 = u;
      }
--    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
++    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
-+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
++        uint32_t u;
-     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
++
-         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
++        unset_feature(env, ARM_FEATURE_THUMB_DSP);
-     }
++
 +        u = cpu->isar.id_isar1;
 +        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
 +        cpu->isar.id_isar1 = u;
 +
 +        u = cpu->isar.id_isar2;
 +        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
 +        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
 +        cpu->isar.id_isar2 = u;
 +
 +        u = cpu->isar.id_isar3;
 +        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
 +        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
 +        cpu->isar.id_isar3 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
 --
 .20.1

-[Qemu-devel] [PULL 10/12] hw/arm/exynos4: Use the IEC binary prefix definitions
+[Qemu-devel] [PULL 07/24] hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Create "vfp" and "dsp" properties on the armv7m container object
 which will be forwarded to its CPU object, so that SoCs can
 configure whether the CPU has these features.
-It eases code review, unit is explicit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
 ---
  include/hw/arm/armv7m.h |  4 ++++
  hw/arm/armv7m.c         | 18 ++++++++++++++++++
 files changed, 22 insertions(+)
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20190520214342.13709-3-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/exynos4_boards.c | 5 +++--
 file changed, 3 insertions(+), 2 deletions(-)
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
+--- a/include/hw/arm/armv7m.h
-+++ b/hw/arm/exynos4_boards.c
++++ b/include/hw/arm/armv7m.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct {
   *   devices will be automatically layered on top of this view.)
   * + Property "idau": IDAU interface (forwarded to CPU object)
   * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
 + * + Property "vfp": enable VFP (forwarded to CPU object)
 + * + Property "dsp": enable DSP (forwarded to CPU object)
   * + Property "enable-bitband": expose bitbanded IO
   */
+ typedef struct ARMv7MState {
- #include "qemu/osdep.h"
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
-+#include "qemu/units.h"
+     uint32_t init_svtor;
- #include "qapi/error.h"
+     bool enable_bitband;
- #include "qemu/error-report.h"
+     bool start_powered_off;
- #include "qemu-common.h"
++    bool vfp;
-@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
++    bool dsp;
  } ARMv7MState;
  #endif
 diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armv7m.c
 +++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
              return;
          }
      }
 +    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
 +        object_property_set_bool(OBJECT(s->cpu), s->vfp,
 +                                 "vfp", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
 +    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
 +        object_property_set_bool(OBJECT(s->cpu), s->dsp,
 +                                 "dsp", &err);
 +        if (err != NULL) {
 +            error_propagate(errp, err);
 +            return;
 +        }
 +    }
      /*
       * Tell the CPU where the NVIC is; it will fail realize if it doesn't
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
      DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
      DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
                       false),
 +    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
 +    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
      DEFINE_PROP_END_OF_LIST(),
  };
- static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
--    [EXYNOS4_BOARD_NURI]     = 0x40000000,
--    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
-+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
-+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
- };
- static struct arm_boot_info exynos4_board_binfo = {
 --
 .20.1

-[Qemu-devel] [PULL 06/12] arm: Rename hw/arm/arm.h to hw/arm/boot.h
+[Qemu-devel] [PULL 08/24] hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
-The header file hw/arm/arm.h now includes only declarations
+The SSE-200 hardware has configurable integration settings which
-relating to hw/arm/boot.c functionality. Rename it accordingly,
+determine whether its two CPUs have the FPU and DSP:
-and adjust its header comment.
+ * CPU0_FPU (default 0)
  * CPU0_DSP (default 0)
  * CPU1_FPU (default 1)
  * CPU1_DSP (default 1)
-The bulk of this commit was created via
+Similarly, the IoTKit has settings for its single CPU:
- perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h
+ * CPU0_FPU (default 1)
  * CPU0_DSP (default 1)
-In a few cases we can just delete the #include:
+Of our four boards that use either the IoTKit or the SSE-200:
-hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
+ * mps2-an505, mps2-an521 and musca-a use the default settings
-include/hw/arm/bcm2836.h did not require it.
+ * musca-b1 enables FPU and DSP on both CPUs
 Currently QEMU models all these boards using CPUs with
 both FPU and DSP enabled. This means that we are incorrect
 for mps2-an521 and musca-a, which should not have FPU or DSP
 on CPU0.
 Create QOM properties on the ARMSSE devices corresponding to the
 default h/w integration settings, and make the Musca-B1 board
 enable FPU and DSP on both CPUs. This fixes the mps2-an521
 and musca-a behaviour, and leaves the musca-b1 and mps2-an505
 behaviour unchanged.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
 Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
 ---
- include/hw/arm/allwinner-a10.h   | 2 +-
+ include/hw/arm/armsse.h |  7 +++++
- include/hw/arm/aspeed_soc.h      | 1 -
+ hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
- include/hw/arm/bcm2836.h         | 1 -
+ hw/arm/musca.c          |  8 ++++++
- include/hw/arm/{arm.h => boot.h} | 8 ++++----
+files changed, 61 insertions(+), 12 deletions(-)
  include/hw/arm/fsl-imx25.h       | 2 +-
  include/hw/arm/fsl-imx31.h       | 2 +-
  include/hw/arm/fsl-imx6.h        | 2 +-
  include/hw/arm/fsl-imx6ul.h      | 2 +-
  include/hw/arm/fsl-imx7.h        | 2 +-
  include/hw/arm/virt.h            | 2 +-
  include/hw/arm/xlnx-versal.h     | 2 +-
  include/hw/arm/xlnx-zynqmp.h     | 2 +-
  hw/arm/armsse.c                  | 2 +-
  hw/arm/armv7m.c                  | 2 +-
  hw/arm/aspeed.c                  | 2 +-
  hw/arm/boot.c                    | 2 +-
  hw/arm/collie.c                  | 2 +-
  hw/arm/exynos4210.c              | 2 +-
  hw/arm/exynos4_boards.c          | 2 +-
  hw/arm/highbank.c                | 2 +-
  hw/arm/integratorcp.c            | 2 +-
  hw/arm/mainstone.c               | 2 +-
  hw/arm/microbit.c                | 2 +-
  hw/arm/mps2-tz.c                 | 2 +-
  hw/arm/mps2.c                    | 2 +-
  hw/arm/msf2-soc.c                | 1 -
  hw/arm/msf2-som.c                | 2 +-
  hw/arm/musca.c                   | 2 +-
  hw/arm/musicpal.c                | 2 +-
  hw/arm/netduino2.c               | 2 +-
  hw/arm/nrf51_soc.c               | 2 +-
  hw/arm/nseries.c                 | 2 +-
  hw/arm/omap1.c                   | 2 +-
  hw/arm/omap2.c                   | 2 +-
  hw/arm/omap_sx1.c                | 2 +-
  hw/arm/palm.c                    | 2 +-
  hw/arm/raspi.c                   | 2 +-
  hw/arm/realview.c                | 2 +-
  hw/arm/spitz.c                   | 2 +-
  hw/arm/stellaris.c               | 2 +-
  hw/arm/stm32f205_soc.c           | 2 +-
  hw/arm/strongarm.c               | 2 +-
  hw/arm/tosa.c                    | 2 +-
  hw/arm/versatilepb.c             | 2 +-
  hw/arm/vexpress.c                | 2 +-
  hw/arm/virt.c                    | 2 +-
  hw/arm/xilinx_zynq.c             | 2 +-
  hw/arm/xlnx-versal.c             | 2 +-
  hw/arm/z2.c                      | 2 +-
 files changed, 49 insertions(+), 52 deletions(-)
  rename include/hw/arm/{arm.h => boot.h} (98%)
-diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
+diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-a10.h
+--- a/include/hw/arm/armsse.h
-+++ b/include/hw/arm/allwinner-a10.h
++++ b/include/hw/arm/armsse.h
 @@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
+  *    address of each SRAM bank (and thus the total amount of internal SRAM)
- #include "qemu/error-report.h"
+  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
- #include "hw/char/serial.h"
+  *    (where it expects to load the PC and SP from the vector table on reset)
--#include "hw/arm/arm.h"
++ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
-+#include "hw/arm/boot.h"
++ *    set whether the CPUs have the FPU and DSP features present. The default
- #include "hw/timer/allwinner-a10-pit.h"
++ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
- #include "hw/intc/allwinner-a10-pic.h"
++ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
- #include "hw/net/allwinner_emac.h"
++ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
-index XXXXXXX..XXXXXXX 100644
+  *    which are wired to its NVIC lines 32 .. n+32
---- a/include/hw/arm/aspeed_soc.h
+  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
-+++ b/include/hw/arm/aspeed_soc.h
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
-@@ -XXX,XX +XXX,XX @@
+     uint32_t mainclk_frq;
- #ifndef ASPEED_SOC_H
+     uint32_t sram_addr_width;
- #define ASPEED_SOC_H
+     uint32_t init_svtor;
++    bool cpu_fpu[SSE_MAX_CPUS];
--#include "hw/arm/arm.h"
++    bool cpu_dsp[SSE_MAX_CPUS];
- #include "hw/intc/aspeed_vic.h"
+ } ARMSSE;
- #include "hw/misc/aspeed_scu.h"
- #include "hw/misc/aspeed_sdmc.h"
+ typedef struct ARMSSEInfo ARMSSEInfo;
 diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/bcm2836.h
 +++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
  #ifndef BCM2836_H
  #define BCM2836_H
 -#include "hw/arm/arm.h"
  #include "hw/arm/bcm2835_peripherals.h"
  #include "hw/intc/bcm2836_control.h"
 diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
 similarity index 98%
 rename from include/hw/arm/arm.h
 rename to include/hw/arm/boot.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/arm.h
 +++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
  /*
 - * Misc ARM declarations
 + * ARM kernel loader.
   *
   * Copyright (c) 2006 CodeSourcery.
   * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
   *
   */
 -#ifndef HW_ARM_H
 -#define HW_ARM_H
 +#ifndef HW_ARM_BOOT_H
 +#define HW_ARM_BOOT_H
  #include "exec/memory.h"
  #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                              const struct arm_boot_info *info,
                                              hwaddr mvbar_addr);
 -#endif /* HW_ARM_H */
 +#endif /* HW_ARM_BOOT_H */
 diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx25.h
 +++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX25_H
  #define FSL_IMX25_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/imx_avic.h"
  #include "hw/misc/imx25_ccm.h"
  #include "hw/char/imx_serial.h"
 diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx31.h
 +++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX31_H
  #define FSL_IMX31_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/imx_avic.h"
  #include "hw/misc/imx31_ccm.h"
  #include "hw/char/imx_serial.h"
 diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx6.h
 +++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX6_H
  #define FSL_IMX6_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/cpu/a9mpcore.h"
  #include "hw/misc/imx6_ccm.h"
  #include "hw/misc/imx6_src.h"
 diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx6ul.h
 +++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX6UL_H
  #define FSL_IMX6UL_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/cpu/a15mpcore.h"
  #include "hw/misc/imx6ul_ccm.h"
  #include "hw/misc/imx6_src.h"
 diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/fsl-imx7.h
 +++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
  #ifndef FSL_IMX7_H
  #define FSL_IMX7_H
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/cpu/a15mpcore.h"
  #include "hw/intc/imx_gpcv2.h"
  #include "hw/misc/imx7_ccm.h"
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
  #include "exec/hwaddr.h"
  #include "qemu/notify.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "sysemu/kvm.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/xlnx-versal.h
 +++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
  #define XLNX_VERSAL_H
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/arm_gicv3.h"
  #define TYPE_XLNX_VERSAL "xlnx-versal"
 diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/xlnx-zynqmp.h
 +++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
  #ifndef XLNX_ZYNQMP_H
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/intc/arm_gic.h"
  #include "hw/net/cadence_gem.h"
  #include "hw/char/cadence_uart.h"
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
- #include "hw/sysbus.h"
+     bool has_cachectrl;
- #include "hw/registerfields.h"
+     bool has_cpusecctrl;
- #include "hw/arm/armsse.h"
+     bool has_cpuid;
--#include "hw/arm/arm.h"
++    Property *props;
-+#include "hw/arm/boot.h"
++};
++
- /* Format of the System Information block SYS_CONFIG register */
++static Property iotkit_properties[] = {
- typedef enum SysConfigFormat {
++    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
++                     MemoryRegion *),
-index XXXXXXX..XXXXXXX 100644
++    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
---- a/hw/arm/armv7m.c
++    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-+++ b/hw/arm/armv7m.c
++    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-@@ -XXX,XX +XXX,XX @@
++    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
- #include "qemu-common.h"
++    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
- #include "cpu.h"
++    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
- #include "hw/sysbus.h"
++    DEFINE_PROP_END_OF_LIST()
--#include "hw/arm/arm.h"
++};
-+#include "hw/arm/boot.h"
++
- #include "hw/loader.h"
++static Property armsse_properties[] = {
- #include "elf.h"
++    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
- #include "sysemu/qtest.h"
++                     MemoryRegion *),
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
++    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-index XXXXXXX..XXXXXXX 100644
++    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
---- a/hw/arm/aspeed.c
++    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-+++ b/hw/arm/aspeed.c
++    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-@@ -XXX,XX +XXX,XX @@
++    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
- #include "qemu-common.h"
++    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
- #include "cpu.h"
++    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
- #include "exec/address-spaces.h"
++    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
--#include "hw/arm/arm.h"
++    DEFINE_PROP_END_OF_LIST()
-+#include "hw/arm/boot.h"
+ };
- #include "hw/arm/aspeed.h"
- #include "hw/arm/aspeed_soc.h"
+ static const ARMSSEInfo armsse_variants[] = {
- #include "hw/boards.h"
+@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+         .has_cachectrl = false,
-index XXXXXXX..XXXXXXX 100644
+         .has_cpusecctrl = false,
---- a/hw/arm/boot.c
+         .has_cpuid = false,
-+++ b/hw/arm/boot.c
++        .props = iotkit_properties,
-@@ -XXX,XX +XXX,XX @@
+     },
- #include "qapi/error.h"
+     {
- #include <libfdt.h>
+         .name = TYPE_SSE200,
- #include "hw/hw.h"
+@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
--#include "hw/arm/arm.h"
+         .has_cachectrl = true,
-+#include "hw/arm/boot.h"
+         .has_cpusecctrl = true,
- #include "hw/arm/linux-boot-if.h"
+         .has_cpuid = true,
- #include "sysemu/kvm.h"
++        .props = armsse_properties,
- #include "sysemu/sysemu.h"
+     },
-diff --git a/hw/arm/collie.c b/hw/arm/collie.c
+ };
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/collie.c
+@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-+++ b/hw/arm/collie.c
+                 return;
-@@ -XXX,XX +XXX,XX @@
+             }
- #include "hw/sysbus.h"
+         }
- #include "hw/boards.h"
++        if (!s->cpu_fpu[i]) {
- #include "strongarm.h"
++            object_property_set_bool(cpuobj, false, "vfp", &err);
--#include "hw/arm/arm.h"
++            if (err) {
-+#include "hw/arm/boot.h"
++                error_propagate(errp, err);
- #include "hw/block/flash.h"
++                return;
- #include "exec/address-spaces.h"
++            }
- #include "cpu.h"
++        }
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
++        if (!s->cpu_dsp[i]) {
-index XXXXXXX..XXXXXXX 100644
++            object_property_set_bool(cpuobj, false, "dsp", &err);
---- a/hw/arm/exynos4210.c
++            if (err) {
-+++ b/hw/arm/exynos4210.c
++                error_propagate(errp, err);
-@@ -XXX,XX +XXX,XX @@
++                return;
- #include "hw/boards.h"
++            }
- #include "sysemu/sysemu.h"
++        }
- #include "hw/sysbus.h"
--#include "hw/arm/arm.h"
+         if (i > 0) {
-+#include "hw/arm/boot.h"
+             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
- #include "hw/loader.h"
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
- #include "hw/arm/exynos4210.h"
+     }
- #include "hw/sd/sdhci.h"
+ };
-diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
-index XXXXXXX..XXXXXXX 100644
+-static Property armsse_properties[] = {
---- a/hw/arm/exynos4_boards.c
+-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-+++ b/hw/arm/exynos4_boards.c
+-                     MemoryRegion *),
-@@ -XXX,XX +XXX,XX @@
+-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
- #include "sysemu/sysemu.h"
+-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
- #include "hw/sysbus.h"
+-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
- #include "net/net.h"
+-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
--#include "hw/arm/arm.h"
+-    DEFINE_PROP_END_OF_LIST()
-+#include "hw/arm/boot.h"
+-};
- #include "exec/address-spaces.h"
+-
- #include "hw/arm/exynos4210.h"
+ static void armsse_reset(DeviceState *dev)
- #include "hw/net/lan9118.h"
+ {
-diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+     ARMSSE *s = ARMSSE(dev);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
---- a/hw/arm/highbank.c
+     DeviceClass *dc = DEVICE_CLASS(klass);
-+++ b/hw/arm/highbank.c
+     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
-@@ -XXX,XX +XXX,XX @@
+     ARMSSEClass *asc = ARMSSE_CLASS(klass);
- #include "qemu/osdep.h"
++    const ARMSSEInfo *info = data;
- #include "qapi/error.h"
- #include "hw/sysbus.h"
+     dc->realize = armsse_realize;
--#include "hw/arm/arm.h"
+     dc->vmsd = &armsse_vmstate;
-+#include "hw/arm/boot.h"
+-    dc->props = armsse_properties;
- #include "hw/loader.h"
++    dc->props = info->props;
- #include "net/net.h"
+     dc->reset = armsse_reset;
- #include "sysemu/kvm.h"
+     iic->check = armsse_idau_check;
-diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
+-    asc->info = data;
-index XXXXXXX..XXXXXXX 100644
++    asc->info = info;
---- a/hw/arm/integratorcp.c
+ }
-+++ b/hw/arm/integratorcp.c
-@@ -XXX,XX +XXX,XX @@
+ static const TypeInfo armsse_info = {
  #include "cpu.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/misc/arm_integrator_debug.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
 diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mainstone.c
 +++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "hw/net/smc91c111.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/microbit.c
 +++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2.c
 +++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/armv7m.h"
  #include "hw/or-irq.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-soc.c
 +++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/units.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
  #include "exec/address-spaces.h"
  #include "hw/char/serial.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/msf2-som.c
 +++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/error-report.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/msf2-soc.h"
  #include "cpu.h"
 diff --git a/hw/arm/musca.c b/hw/arm/musca.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/musca.c
 +++ b/hw/arm/musca.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
- #include "qapi/error.h"
+     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
- #include "exec/address-spaces.h"
+     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
- #include "sysemu/sysemu.h"
+     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
--#include "hw/arm/arm.h"
++    /*
-+#include "hw/arm/boot.h"
++     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
- #include "hw/arm/armsse.h"
++     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
- #include "hw/boards.h"
++     */
- #include "hw/char/pl011.h"
++    if (mmc->type == MUSCA_B1) {
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
++        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
-index XXXXXXX..XXXXXXX 100644
++        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
---- a/hw/arm/musicpal.c
++    }
-+++ b/hw/arm/musicpal.c
+     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
-@@ -XXX,XX +XXX,XX @@
+                              &error_fatal);
- #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduino2.c
 +++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #include "qemu/error-report.h"
  #include "hw/arm/stm32f205_soc.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  static void netduino2_init(MachineState *machine)
  {
 diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nrf51_soc.c
 +++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/sysbus.h"
  #include "hw/boards.h"
  #include "hw/misc/unimp.h"
 diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/nseries.c
 +++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bswap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/omap.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/irq.h"
  #include "ui/console.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap1.c
 +++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/soc_dma.h"
 diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap2.c
 +++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/qtest.h"
  #include "hw/boards.h"
  #include "hw/hw.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/omap.h"
  #include "sysemu/sysemu.h"
  #include "qemu/timer.h"
 diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap_sx1.c
 +++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/block/flash.h"
  #include "sysemu/qtest.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/palm.c b/hw/arm/palm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/palm.c
 +++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
  #include "ui/console.h"
  #include "hw/arm/omap.h"
  #include "hw/boards.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/input/tsc2xxx.h"
  #include "hw/loader.h"
  #include "exec/address-spaces.h"
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "hw/boards.h"
  #include "hw/loader.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
 diff --git a/hw/arm/realview.c b/hw/arm/realview.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/realview.c
 +++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/net/smc91c111.h"
 diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/spitz.c
 +++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "sysemu/sysemu.h"
  #include "hw/pcmcia.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/sysbus.h"
  #include "hw/ssi/ssi.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "qemu/timer.h"
  #include "hw/i2c/i2c.h"
  #include "net/net.h"
 diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f205_soc.c
 +++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
  #include "qemu-common.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "exec/address-spaces.h"
  #include "hw/arm/stm32f205_soc.h"
 diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/strongarm.c
 +++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "strongarm.h"
  #include "qemu/error-report.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "chardev/char-fe.h"
  #include "chardev/char-serial.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/tosa.c
 +++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/sharpsl.h"
  #include "hw/pcmcia.h"
  #include "hw/boards.h"
 diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/versatilepb.c
 +++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/net/smc91c111.h"
  #include "net/net.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/vexpress.c
 +++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/net/lan9118.h"
  #include "hw/i2c/i2c.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/arm/primecell.h"
  #include "hw/arm/virt.h"
  #include "hw/block/flash.h"
 diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xilinx_zynq.c
 +++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu-common.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "net/net.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/kvm.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/intc/arm_gicv3_common.h"
 diff --git a/hw/arm/z2.c b/hw/arm/z2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/z2.c
 +++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/hw.h"
  #include "hw/arm/pxa.h"
 -#include "hw/arm/arm.h"
 +#include "hw/arm/boot.h"
  #include "hw/i2c/i2c.h"
  #include "hw/ssi/ssi.h"
  #include "hw/boards.h"
 --
 .20.1

-[Qemu-devel] [PULL 07/12] hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
+[Qemu-devel] [PULL 09/24] hw/intc/arm_gicv3: Fix decoding of ID register range
-In ich_vmcr_write() we enforce "writes of BPR fields to less than
+The GIC ID registers cover an area 0x30 bytes in size
-their minimum sets them to the minimum" by doing a "read vbpr and
+(12 registers, 4 bytes each). We were incorrectly decoding
-write it back" operation.  A typo here meant that we weren't handling
+only the first 0x20 bytes.
 writes to these fields correctly, because we were reading from VBPR0
 but writing to VBPR1.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
+Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_cpuif.c | 2 +-
+ hw/intc/arm_gicv3_dist.c   | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/intc/arm_gicv3_redist.c | 4 ++--
 files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/hw/intc/arm_gicv3_dist.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/hw/intc/arm_gicv3_dist.c
-@@ -XXX,XX +XXX,XX @@ static void ich_vmcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
-     /* Enforce "writing BPRs to less than minimum sets them to the minimum"
+         }
-      * by reading and writing back the fields.
+         return MEMTX_OK;
-      */
+     }
--    write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G0));
+-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
-+    write_vbpr(cs, GICV3_G0, read_vbpr(cs, GICV3_G0));
++    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
-     write_vbpr(cs, GICV3_G1, read_vbpr(cs, GICV3_G1));
+         /* ID registers */
+         *data = gicv3_idreg(offset - GICD_IDREGS);
-     gicv3_cpuif_virt_update(cs);
+         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
          gicd_write_irouter(s, attrs, irq, r);
          return MEMTX_OK;
      }
 -    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
 +    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
      case GICD_TYPER:
      case GICD_IIDR:
          /* RO registers, ignore the write */
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
          }
          *data = cs->gicr_nsacr;
          return MEMTX_OK;
 -    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
 +    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
          *data = gicv3_idreg(offset - GICR_IDREGS);
          return MEMTX_OK;
      default:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
          return MEMTX_OK;
      case GICR_IIDR:
      case GICR_TYPER:
 -    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
 +    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
          /* RO registers, ignore the write */
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: invalid guest write to RO register at offset "
 --
 .20.1

-New patch
+[Qemu-devel] [PULL 10/24] hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
+is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
+if the security extension is unsupported. "Security extension
+unsupported" always implies GICD_CTLR.DS == 1, but the guest can
+also set DS on a GIC which does support the security extension.
+Fix the condition to correctly check the GICD_CTLR.DS bit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
+---
+ hw/intc/arm_gicv3_dist.c | 8 +++++++-
+file changed, 7 insertions(+), 1 deletion(-)
+diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/arm_gicv3_dist.c
++++ b/hw/intc/arm_gicv3_dist.c
+@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+          * ITLinesNumber == (num external irqs / 32) - 1
+          */
+         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
++        /*
++         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
++         * "security extensions not supported" always implies DS == 1,
++         * so we only need to check the DS bit.
++         */
++        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
+-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
++        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
+             (0xf << 19) | itlinesnumber;
+         return MEMTX_OK;
+     }
+--
+.20.1

-[Qemu-devel] [PULL 01/12] target/arm: Use extract2 for EXTR
+[Qemu-devel] [PULL 11/24] target/arm: Move vfp_expand_imm() to translate.[ch]
-From: Richard Henderson <richard.henderson@linaro.org>
+We want to use vfp_expand_imm() in the AArch32 VFP decode;
 move it from the a64-only header/source file to the
 AArch32 one (which is always compiled even for AArch64).
-This is, after all, how we implement extract2 in tcg/aarch64.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
 ---
  target/arm/translate-a64.h     |  1 -
  target/arm/translate.h         |  7 +++++++
  target/arm/translate-a64.c     | 32 --------------------------------
  target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 files changed, 40 insertions(+), 33 deletions(-)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+index XXXXXXX..XXXXXXX 100644
-Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
+--- a/target/arm/translate-a64.h
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++++ b/target/arm/translate-a64.h
----
+@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
- target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
+ TCGv_ptr get_fpstatus_ptr(bool);
-file changed, 20 insertions(+), 18 deletions(-)
+ bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
+                             unsigned int imms, unsigned int immr);
 -uint64_t vfp_expand_imm(int size, uint8_t imm8);
  bool sve_access_check(DisasContext *s);
  /* We should have at some point before trying to access an FP register
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
      }
  }
 +/*
 + * Given a VFP floating point constant encoded into an 8 bit immediate in an
 + * instruction, expand it to the actual constant value of the specified
 + * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
 + */
 +uint64_t vfp_expand_imm(int size, uint8_t imm8);
 +
  /* Vector operations shared between ARM and AArch64.  */
  extern const GVecGen3 mla_op[4];
  extern const GVecGen3 mls_op[4];
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
-             } else {
+     }
-                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
+ }
-             }
--        } else if (rm == rn) { /* ROR */
+-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
--            tcg_rm = cpu_reg(s, rm);
+- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
--            if (sf) {
+- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
--                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
+- */
--            } else {
+-uint64_t vfp_expand_imm(int size, uint8_t imm8)
--                TCGv_i32 tmp = tcg_temp_new_i32();
+-{
--                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
+-    uint64_t imm;
--                tcg_gen_rotri_i32(tmp, tmp, imm);
+-
--                tcg_gen_extu_i32_i64(tcg_rd, tmp);
+-    switch (size) {
--                tcg_temp_free_i32(tmp);
+-    case MO_64:
--            }
+-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-         } else {
+-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
--            tcg_rm = read_cpu_reg(s, rm, sf);
+-            extract32(imm8, 0, 6);
--            tcg_rn = read_cpu_reg(s, rn, sf);
+-        imm <<= 48;
--            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
+-        break;
--            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
+-    case MO_32:
--            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
+-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
--            if (!sf) {
+-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
--                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+-            (extract32(imm8, 0, 6) << 3);
-+            tcg_rm = cpu_reg(s, rm);
+-        imm <<= 16;
-+            tcg_rn = cpu_reg(s, rn);
+-        break;
 -    case MO_16:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 6);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -    return imm;
 -}
 -
  /* Floating point immediate
   *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
   * +---+---+---+-----------+------+---+------------+-------+------+------+
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
  #include "decode-vfp.inc.c"
  #include "decode-vfp-uncond.inc.c"
 +/*
 + * The imm8 encodes the sign bit, enough bits to represent an exponent in
 + * the range 01....1xx to 10....0xx, and the most significant 4 bits of
 + * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
 + */
 +uint64_t vfp_expand_imm(int size, uint8_t imm8)
 +{
 +    uint64_t imm;
 +
-+            if (sf) {
++    switch (size) {
-+                /* Specialization to ROR happens in EXTRACT2.  */
++    case MO_64:
-+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
++        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-+            } else {
++            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-+                TCGv_i32 t0 = tcg_temp_new_i32();
++            extract32(imm8, 0, 6);
 +        imm <<= 48;
 +        break;
 +    case MO_32:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 3);
 +        imm <<= 16;
 +        break;
 +    case MO_16:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 6);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return imm;
 +}
 +
-+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+ /*
-+                if (rm == rn) {
+  * Return the offset of a 16-bit half of the specified VFP single-precision
-+                    tcg_gen_rotri_i32(t0, t0, imm);
+  * register. If top is true, returns the top 16 bits; otherwise the bottom
 +                } else {
 +                    TCGv_i32 t1 = tcg_temp_new_i32();
 +                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
 +                    tcg_gen_extract2_i32(t0, t0, t1, imm);
 +                    tcg_temp_free_i32(t1);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_rd, t0);
 +                tcg_temp_free_i32(t0);
              }
          }
      }
 --
 .20.1

-New patch
+[Qemu-devel] [PULL 12/24] target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
+The AArch32 VMOV (immediate) instruction uses the same VFP encoded
+immediate format we already handle in vfp_expand_imm().  Use that
+function rather than hand-decoding it.
+Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
+---
+ target/arm/translate-vfp.inc.c | 28 ++++------------------------
+ target/arm/vfp.decode          | 10 ++++++----
+files changed, 10 insertions(+), 28 deletions(-)
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
+     uint32_t delta_d = 0;
+     int veclen = s->vec_len;
+     TCGv_i32 fd;
+-    uint32_t n, i, vd;
++    uint32_t vd;
+     vd = a->vd;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
+         }
+     }
+-    n = (a->imm4h << 28) & 0x80000000;
+-    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
+-    if (i & 0x40) {
+-        i |= 0x780;
+-    } else {
+-        i |= 0x800;
+-    }
+-    n |= i << 19;
+-
+-    fd = tcg_temp_new_i32();
+-    tcg_gen_movi_i32(fd, n);
++    fd = tcg_const_i32(vfp_expand_imm(MO_32, a->imm));
+     for (;;) {
+         neon_store_reg32(fd, vd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
+     uint32_t delta_d = 0;
+     int veclen = s->vec_len;
+     TCGv_i64 fd;
+-    uint32_t n, i, vd;
++    uint32_t vd;
+     vd = a->vd;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
+         }
+     }
+-    n = (a->imm4h << 28) & 0x80000000;
+-    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
+-    if (i & 0x40) {
+-        i |= 0x3f80;
+-    } else {
+-        i |= 0x4000;
+-    }
+-    n |= i << 16;
+-
+-    fd = tcg_temp_new_i64();
+-    tcg_gen_movi_i64(fd, ((uint64_t)n) << 32);
++    fd = tcg_const_i64(vfp_expand_imm(MO_64, a->imm));
+     for (;;) {
+         neon_store_reg64(fd, vd);
+diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp.decode
++++ b/target/arm/vfp.decode
+@@ -XXX,XX +XXX,XX @@
+ %vmov_idx_b     21:1 5:2
+ %vmov_idx_h     21:1 6:1
++%vmov_imm 16:4 0:4
++
+ # VMOV scalar to general-purpose register; note that this does
+ # include some Neon cases.
+ VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
+@@ -XXX,XX +XXX,XX @@ VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
+ VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
+              vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
+-VMOV_imm_sp  ---- 1110 1.11 imm4h:4 .... 1010 0000 imm4l:4 \
+-             vd=%vd_sp
+-VMOV_imm_dp  ---- 1110 1.11 imm4h:4 .... 1011 0000 imm4l:4 \
+-             vd=%vd_dp
++VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
++             vd=%vd_sp imm=%vmov_imm
++VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
++             vd=%vd_dp imm=%vmov_imm
+ VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
+              vd=%vd_sp vm=%vm_sp
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 13/24] target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
+Where Neon instructions are floating point operations, we
+mostly use the old VFP utility functions like gen_vfp_abs()
+which work on the TCG globals cpu_F0s and cpu_F1s. The
+Neon for-each-element loop conditionally loads the inputs
+into either a plain old TCG temporary for most operations
+or into cpu_F0s for float operations, and similarly stores
+back either cpu_F0s or the temporary.
+Switch NEON_2RM_VABS_F away from using cpu_F0s, and
+update neon_2rm_is_float_op() accordingly.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-4-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 19 ++++++++-----------
+file changed, 8 insertions(+), 11 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-static inline void gen_vfp_abs(int dp)
+-{
+-    if (dp)
+-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
+-    else
+-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
+-}
+-
+ static inline void gen_vfp_neg(int dp)
+ {
+     if (dp)
+@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
+ static int neon_2rm_is_float_op(int op)
+ {
+-    /* Return true if this neon 2reg-misc op is float-to-float */
+-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
++    /*
++     * Return true if this neon 2reg-misc op is float-to-float.
++     * This is not a property of the operation but of our code --
++     * what we are asking here is "does the code for this case in
++     * the Neon for-each-pass loop use cpu_F0s?".
++     */
++    return (op == NEON_2RM_VNEG_F ||
+             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+             op == NEON_2RM_VRINTM ||
+             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             break;
+                         }
+                         case NEON_2RM_VABS_F:
+-                            gen_vfp_abs(0);
++                            gen_helper_vfp_abss(tmp, tmp);
+                             break;
+                         case NEON_2RM_VNEG_F:
+                             gen_vfp_neg(0);
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 14/24] target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
+Switch NEON_2RM_VABS_F away from using cpu_F0s.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-5-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 13 ++-----------
+file changed, 2 insertions(+), 11 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-static inline void gen_vfp_neg(int dp)
+-{
+-    if (dp)
+-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
+-    else
+-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
+-}
+-
+ #define VFP_GEN_ITOF(name) \
+ static inline void gen_vfp_##name(int dp, int neon) \
+ { \
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
+      */
+-    return (op == NEON_2RM_VNEG_F ||
+-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
++    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+             op == NEON_2RM_VRINTM ||
+             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+             op >= NEON_2RM_VRECPE_F);
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             gen_helper_vfp_abss(tmp, tmp);
+                             break;
+                         case NEON_2RM_VNEG_F:
+-                            gen_vfp_neg(0);
++                            gen_helper_vfp_negs(tmp, tmp);
+                             break;
+                         case NEON_2RM_VSWP:
+                             tmp2 = neon_load_reg(rd, pass);
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 15/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
+Switch NEON_2RM_VRINT* away from using cpu_F0s.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-6-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 8 +++-----
+file changed, 3 insertions(+), 5 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
+      */
+-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+-            op == NEON_2RM_VRINTM ||
+-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
++    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
+             op >= NEON_2RM_VRECPE_F);
+ }
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
+                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
+                                                       cpu_env);
+-                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
++                            gen_helper_rints(tmp, tmp, fpstatus);
+                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
+                                                       cpu_env);
+                             tcg_temp_free_ptr(fpstatus);
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                         case NEON_2RM_VRINTX:
+                         {
+                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+-                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
++                            gen_helper_rints_exact(tmp, tmp, fpstatus);
+                             tcg_temp_free_ptr(fpstatus);
+                             break;
+                         }
+--
+.20.1

-[Qemu-devel] [PULL 12/12] hw/arm/exynos4210: QOM'ify the Exynos4210 SoC
+[Qemu-devel] [PULL 16/24] target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20190520214342.13709-5-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-7-peter.maydell@linaro.org
 ---
- include/hw/arm/exynos4210.h |  9 +++++++--
+ target/arm/translate.c | 7 +++----
- hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
+file changed, 3 insertions(+), 4 deletions(-)
  hw/arm/exynos4_boards.c     |  9 ++++++---
 files changed, 37 insertions(+), 9 deletions(-)
-diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/exynos4210.h
+--- a/target/arm/translate.c
-+++ b/include/hw/arm/exynos4210.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
- } Exynos4210Irq;
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
- typedef struct Exynos4210State {
+      */
-+    /*< private >*/
+-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-+    SysBusDevice parent_obj;
+-            op >= NEON_2RM_VRECPE_F);
-+    /*< public >*/
++    return op >= NEON_2RM_VRECPE_F;
      ARMCPU *cpu[EXYNOS4210_NCPUS];
      Exynos4210Irq irqs;
      qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
      I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
  } Exynos4210State;
 +#define TYPE_EXYNOS4210_SOC "exynos4210"
 +#define EXYNOS4210_SOC(obj) \
 +    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
 +
  void exynos4210_write_secondary(ARMCPU *cpu,
          const struct arm_boot_info *info);
 -Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
 -
  /* Initialize exynos4210 IRQ subsystem stub */
  qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4210.c
 +++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
      sysbus_connect_irq(busdev, 0, irq);
  }
--Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+ static bool neon_2rm_is_v8_op(int op)
-+static void exynos4210_realize(DeviceState *socdev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
- {
+                                                       cpu_env);
--    Exynos4210State *s = g_new0(Exynos4210State, 1);
-+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+                             if (is_signed) {
-+    MemoryRegion *system_mem = get_system_memory();
+-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
-     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
++                                gen_helper_vfp_tosls(tmp, tmp,
-     SysBusDevice *busdev;
+                                                      tcg_shift, fpst);
-     DeviceState *dev;
+                             } else {
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
-                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
++                                gen_helper_vfp_touls(tmp, tmp,
-     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                                                      tcg_shift, fpst);
-                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+                             }
 -
 -    return s;
  }
 +
 +static void exynos4210_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = exynos4210_realize;
 +}
 +
 +static const TypeInfo exynos4210_info = {
 +    .name = TYPE_EXYNOS4210_SOC,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(Exynos4210State),
 +    .class_init = exynos4210_class_init,
 +};
 +
 +static void exynos4210_register_types(void)
 +{
 +    type_register_static(&exynos4210_info);
 +}
 +
 +type_init(exynos4210_register_types)
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/exynos4_boards.c
 +++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
  } Exynos4BoardType;
  typedef struct Exynos4BoardState {
 -    Exynos4210State *soc;
 +    Exynos4210State soc;
      MemoryRegion dram0_mem;
      MemoryRegion dram1_mem;
  } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
      exynos4_boards_init_ram(s, get_system_memory(),
                              exynos4_board_ram_size[board_type]);
 -    s->soc = exynos4210_init(get_system_memory());
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
 +    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
 +    object_property_set_bool(OBJECT(&s->soc), true, "realized",
 +                             &error_fatal);
      return s;
  }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                        EXYNOS4_BOARD_SMDKC210);
      lan9215_init(SMDK_LAN9118_BASE_ADDR,
 -            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
 +            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
      arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
  }
 --
 .20.1

-New patch
+[Qemu-devel] [PULL 17/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
+Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-8-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+      * what we are asking here is "does the code for this case in
+      * the Neon for-each-pass loop use cpu_F0s?".
+      */
+-    return op >= NEON_2RM_VRECPE_F;
++    return op >= NEON_2RM_VCVT_FS;
+ }
+ static bool neon_2rm_is_v8_op(int op)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                         case NEON_2RM_VRECPE_F:
+                         {
+                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+-                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
++                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
+                             tcg_temp_free_ptr(fpstatus);
+                             break;
+                         }
+                         case NEON_2RM_VRSQRTE_F:
+                         {
+                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+-                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
++                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
+                             tcg_temp_free_ptr(fpstatus);
+                             break;
+                         }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 18/24] target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
+Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
+Since this is the last user of cpu_F0s in the Neon 2rm-op
+loop, we can remove the handling code for it too.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-9-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 82 ++++++++++++------------------------------
+file changed, 22 insertions(+), 60 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-#define VFP_GEN_ITOF(name) \
+-static inline void gen_vfp_##name(int dp, int neon) \
+-{ \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+-    } \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-
+-VFP_GEN_ITOF(uito)
+-VFP_GEN_ITOF(sito)
+-#undef VFP_GEN_ITOF
+-
+-#define VFP_GEN_FTOI(name) \
+-static inline void gen_vfp_##name(int dp, int neon) \
+-{ \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+-    } \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-
+-VFP_GEN_FTOI(touiz)
+-VFP_GEN_FTOI(tosiz)
+-#undef VFP_GEN_FTOI
+-
+ #define VFP_GEN_FIX(name, round) \
+ static inline void gen_vfp_##name(int dp, int shift, int neon) \
+ { \
+@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
+ #define NEON_2RM_VCVT_SF 62
+ #define NEON_2RM_VCVT_UF 63
+-static int neon_2rm_is_float_op(int op)
+-{
+-    /*
+-     * Return true if this neon 2reg-misc op is float-to-float.
+-     * This is not a property of the operation but of our code --
+-     * what we are asking here is "does the code for this case in
+-     * the Neon for-each-pass loop use cpu_F0s?".
+-     */
+-    return op >= NEON_2RM_VCVT_FS;
+-}
+-
+ static bool neon_2rm_is_v8_op(int op)
+ {
+     /* Return true if this neon 2reg-misc op is ARMv8 and up */
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                 default:
+                 elementwise:
+                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
+-                        if (neon_2rm_is_float_op(op)) {
+-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
+-                                           neon_reg_offset(rm, pass));
+-                            tmp = NULL;
+-                        } else {
+-                            tmp = neon_load_reg(rm, pass);
+-                        }
++                        tmp = neon_load_reg(rm, pass);
+                         switch (op) {
+                         case NEON_2RM_VREV32:
+                             switch (size) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                             break;
+                         }
+                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
+-                            gen_vfp_sito(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
+-                            gen_vfp_uito(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
+-                            gen_vfp_tosiz(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
+-                            gen_vfp_touiz(0, 1);
++                        {
++                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
++                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
++                            tcg_temp_free_ptr(fpstatus);
+                             break;
++                        }
+                         default:
+                             /* Reserved op values were caught by the
+                              * neon_2rm_sizes[] check earlier.
+                              */
+                             abort();
+                         }
+-                        if (neon_2rm_is_float_op(op)) {
+-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
+-                                           neon_reg_offset(rd, pass));
+-                        } else {
+-                            neon_store_reg(rd, pass, tmp);
+-                        }
++                        neon_store_reg(rd, pass, tmp);
+                     }
+                     break;
+                 }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 19/24] target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
+Stop using cpu_F0s in the Neon VCVT fixed-point operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 62 +++++++++++++++++++-----------------------
+file changed, 28 insertions(+), 34 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+ /* Function prototypes for gen_ functions calling Neon helpers.  */
+ typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+                                  TCGv_i32, TCGv_i32);
++/* Function prototypes for gen_ functions for fix point conversions */
++typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+ /* initialize TCG globals.  */
+ void arm_translate_init(void)
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+     return statusptr;
+ }
+-#define VFP_GEN_FIX(name, round) \
+-static inline void gen_vfp_##name(int dp, int shift, int neon) \
+-{ \
+-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
+-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+-    if (dp) { \
+-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
+-                                        statusptr); \
+-    } else { \
+-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
+-                                        statusptr); \
+-    } \
+-    tcg_temp_free_i32(tmp_shift); \
+-    tcg_temp_free_ptr(statusptr); \
+-}
+-VFP_GEN_FIX(tosl, _round_to_zero)
+-VFP_GEN_FIX(toul, _round_to_zero)
+-VFP_GEN_FIX(slto, )
+-VFP_GEN_FIX(ulto, )
+-#undef VFP_GEN_FIX
+-
+ static inline long vfp_reg_offset(bool dp, unsigned reg)
+ {
+     if (dp) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                 }
+             } else if (op >= 14) {
+                 /* VCVT fixed-point.  */
++                TCGv_ptr fpst;
++                TCGv_i32 shiftv;
++                VFPGenFixPointFn *fn;
++
+                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
+                     return 1;
+                 }
++
++                if (!(op & 1)) {
++                    if (u) {
++                        fn = gen_helper_vfp_ultos;
++                    } else {
++                        fn = gen_helper_vfp_sltos;
++                    }
++                } else {
++                    if (u) {
++                        fn = gen_helper_vfp_touls_round_to_zero;
++                    } else {
++                        fn = gen_helper_vfp_tosls_round_to_zero;
++                    }
++                }
++
+                 /* We have already masked out the must-be-1 top bit of imm6,
+                  * hence this 32-shift where the ARM ARM has 64-imm6.
+                  */
+                 shift = 32 - shift;
++                fpst = get_fpstatus_ptr(1);
++                shiftv = tcg_const_i32(shift);
+                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
+-                    if (!(op & 1)) {
+-                        if (u)
+-                            gen_vfp_ulto(0, shift, 1);
+-                        else
+-                            gen_vfp_slto(0, shift, 1);
+-                    } else {
+-                        if (u)
+-                            gen_vfp_toul(0, shift, 1);
+-                        else
+-                            gen_vfp_tosl(0, shift, 1);
+-                    }
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
++                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
++                    fn(tmpf, tmpf, shiftv, fpst);
++                    neon_store_reg(rd, pass, tmpf);
+                 }
++                tcg_temp_free_ptr(fpst);
++                tcg_temp_free_i32(shiftv);
+             } else {
+                 return 1;
+             }
+--
+.20.1

-New patch
+[Qemu-devel] [PULL 20/24] target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
+Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
+ * don't use cpu_F0s
+ * don't use tcg_gen_ld_f32
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-11-peter.maydell@linaro.org
+---
+ target/arm/translate.c | 27 ++++++++++++---------------
+file changed, 12 insertions(+), 15 deletions(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+     return ret;
+ }
+-#define tcg_gen_ld_f32 tcg_gen_ld_i32
+ #define tcg_gen_st_f32 tcg_gen_st_i32
+ #define ARM_CP_RW_BIT   (1 << 20)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                         q || (rm & 1)) {
+                         return 1;
+                     }
+-                    tmp = tcg_temp_new_i32();
+-                    tmp2 = tcg_temp_new_i32();
+                     fpst = get_fpstatus_ptr(true);
+                     ahp = get_ahp_flag();
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
+-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
+-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
++                    tmp = neon_load_reg(rm, 0);
++                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
++                    tmp2 = neon_load_reg(rm, 1);
++                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
+                     tcg_gen_shli_i32(tmp2, tmp2, 16);
+                     tcg_gen_or_i32(tmp2, tmp2, tmp);
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
+-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
+-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
++                    tcg_temp_free_i32(tmp);
++                    tmp = neon_load_reg(rm, 2);
++                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
++                    tmp3 = neon_load_reg(rm, 3);
+                     neon_store_reg(rd, 0, tmp2);
+-                    tmp2 = tcg_temp_new_i32();
+-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+-                    tcg_gen_shli_i32(tmp2, tmp2, 16);
+-                    tcg_gen_or_i32(tmp2, tmp2, tmp);
+-                    neon_store_reg(rd, 1, tmp2);
++                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
++                    tcg_gen_shli_i32(tmp3, tmp3, 16);
++                    tcg_gen_or_i32(tmp3, tmp3, tmp);
++                    neon_store_reg(rd, 1, tmp3);
+                     tcg_temp_free_i32(tmp);
+                     tcg_temp_free_i32(ahp);
+                     tcg_temp_free_ptr(fpst);
+--
+.20.1

-[Qemu-devel] [PULL 03/12] target/arm: Fix vector operation segfault
+[Qemu-devel] [PULL 21/24] target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
-From: Alistair Francis <alistair.francis@wdc.com>
+Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
  * don't use CPU_F0s
  * don't use tcg_gen_st_f32
-Commit 89e68b575 "target/arm: Use vector operations for saturation"
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 causes this abort() when booting QEMU ARM with a Cortex-A15:
 0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
 0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
 0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
 0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
 0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
 0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
 0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
 0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
 0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
 0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.
 This patch ensures that we don't hit the abort() in the second switch
 case in disas_neon_data_insn() as we will return from the first case.
 Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20190613163917.28589-12-peter.maydell@linaro.org
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 4 ++--
+ target/arm/translate.c | 26 +++++++++++---------------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 11 insertions(+), 15 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+     return ret;
+ }
+-#define tcg_gen_st_f32 tcg_gen_st_i32
+-
+ #define ARM_CP_RW_BIT   (1 << 20)
+ /* Include the VFP decoder */
 @@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
+                     tmp = neon_load_reg(rm, 0);
-                            rn_ofs, rm_ofs, vec_size, vec_size,
+                     tmp2 = neon_load_reg(rm, 1);
-                            (u ? uqadd_op : sqadd_op) + size);
+                     tcg_gen_ext16u_i32(tmp3, tmp);
--            break;
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-+            return 0;
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
+-                    tcg_gen_shri_i32(tmp3, tmp, 16);
-         case NEON_3R_VQSUB:
+-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
+-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
-                            rn_ofs, rm_ofs, vec_size, vec_size,
+-                    tcg_temp_free_i32(tmp);
-                            (u ? uqsub_op : sqsub_op) + size);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
--            break;
++                    neon_store_reg(rd, 0, tmp3);
-+            return 0;
++                    tcg_gen_shri_i32(tmp, tmp, 16);
++                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
-         case NEON_3R_VMUL: /* VMUL */
++                    neon_store_reg(rd, 1, tmp);
-             if (u) {
++                    tmp3 = tcg_temp_new_i32();
                      tcg_gen_ext16u_i32(tmp3, tmp2);
 -                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
 -                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
 -                    tcg_gen_shri_i32(tmp3, tmp2, 16);
 -                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
 -                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
 -                    tcg_temp_free_i32(tmp2);
 -                    tcg_temp_free_i32(tmp3);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
 +                    neon_store_reg(rd, 2, tmp3);
 +                    tcg_gen_shri_i32(tmp2, tmp2, 16);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
 +                    neon_store_reg(rd, 3, tmp2);
                      tcg_temp_free_i32(ahp);
                      tcg_temp_free_ptr(fpst);
                      break;
 --
 .20.1

-[Qemu-devel] [PULL 02/12] target/arm: Simplify BFXIL expansion
+[Qemu-devel] [PULL 22/24] target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
-From: Richard Henderson <richard.henderson@linaro.org>
+Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.
-The mask implied by the extract is redundant with the one
+cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
-implied by the deposit.  Also, fix spelling of BFXIL.
+cpu_V1 are used by both iwmmxt and Neon.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190613163917.28589-13-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 6 +++---
+ target/arm/translate.c | 12 ++----------
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 2 insertions(+), 10 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/translate.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
-             tcg_gen_extract_i64(tcg_rd, tcg_tmp, ri, len);
+ TCGv_i64 cpu_exclusive_addr;
-             return;
+ TCGv_i64 cpu_exclusive_val;
-         }
--        /* opc == 1, BXFIL fall through to deposit */
+-/* FIXME:  These should be removed.  */
--        tcg_gen_extract_i64(tcg_tmp, tcg_tmp, ri, len);
+-static TCGv_i32 cpu_F0s, cpu_F1s;
-+        /* opc == 1, BFXIL fall through to deposit */
+-static TCGv_i64 cpu_F0d, cpu_F1d;
-+        tcg_gen_shri_i64(tcg_tmp, tcg_tmp, ri);
+-
-         pos = 0;
+ #include "exec/gen-icount.h"
-     } else {
-         /* Handle the ri > si case with a deposit
+ static const char * const regnames[] =
-@@ -XXX,XX +XXX,XX @@ static void disas_bitfield(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-         len = ri;
+         dc->base.max_insns = MIN(dc->base.max_insns, bound);
      }
--    if (opc == 1) { /* BFM, BXFIL */
+-    cpu_F0s = tcg_temp_new_i32();
-+    if (opc == 1) { /* BFM, BFXIL */
+-    cpu_F1s = tcg_temp_new_i32();
-         tcg_gen_deposit_i64(tcg_rd, tcg_rd, tcg_tmp, pos, len);
+-    cpu_F0d = tcg_temp_new_i64();
-     } else {
+-    cpu_F1d = tcg_temp_new_i64();
-         /* SBFM or UBFM: We start with zero, and we haven't modified
+-    cpu_V0 = cpu_F0d;
 -    cpu_V1 = cpu_F1d;
 +    cpu_V0 = tcg_temp_new_i64();
 +    cpu_V1 = tcg_temp_new_i64();
      /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
      cpu_M0 = tcg_temp_new_i64();
  }
 --
 .20.1

-[Qemu-devel] [PULL 04/12] arm: Move system_clock_scale to armv7m_systick.h
+[Qemu-devel] [PULL 23/24] target/arm: Fix typos in trans function prototypes
-The system_clock_scale global is used only by the armv7m systick
+In several places cut and paste errors meant we were using the wrong
-device; move the extern declaration to the armv7m_systick.h header,
+type for the 'arg' struct in trans_ functions called by the
-and expand the comment to explain what it is and that it should
+decodetree decoder, because we were using the _sp version of the
-ideally be replaced with a different approach.
+struct in the _dp function.  These were harmless, because the two
 structs were identical and so decodetree made them typedefs of the
 same underlying structure (and we'd have had a compile error if they
 were not harmless), but we should clean them up anyway.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
 Message-id: 20190516163857.6430-2-peter.maydell@linaro.org
 ---
- include/hw/arm/arm.h              |  4 ----
+ target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
- include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++++++++
+file changed, 14 insertions(+), 14 deletions(-)
 files changed, 22 insertions(+), 4 deletions(-)
-diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/arm.h
+--- a/target/arm/translate-vfp.inc.c
-+++ b/include/hw/arm/arm.h
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
-                                             const struct arm_boot_info *info,
+     return true;
-                                             hwaddr mvbar_addr);
+ }
--/* Multiplication factor to convert from system clock ticks to qemu timer
+-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
--   ticks.  */
++static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
--extern int system_clock_scale;
+ {
--
+     TCGv_i32 tmp;
- #endif /* HW_ARM_H */
-diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
+@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-index XXXXXXX..XXXXXXX 100644
+     return true;
---- a/include/hw/timer/armv7m_systick.h
+ }
-+++ b/include/hw/timer/armv7m_systick.h
-@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
+-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-     qemu_irq irq;
++static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
- } SysTickState;
+ {
+     uint32_t offset;
-+/*
+     TCGv_i32 addr;
-+ * Multiplication factor to convert from system clock ticks to qemu timer
+@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+ * ticks. This should be set (by board code, usually) to a value
+     tcg_temp_free_i64(tmp);
-+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ }
-+ * in Hz of the CPU.
-+ *
+-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
-+ * This value is used by the systick device when it is running in
++static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
-+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ {
-+ * set how fast the timer should tick.
+     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
-+ *
+ }
-+ * TODO: we should refactor this so that rather than using a global
+@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+ * we use a device property or something similar. This is complicated
+     tcg_temp_free_i64(tmp);
-+ * because (a) the property would need to be plumbed through from the
+ }
-+ * board code down through various layers to the systick device
-+ * and (b) the property needs to be modifiable after realize, because
+-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
-+ * the stellaris board uses this to implement the behaviour where the
++static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
-+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ {
-+ * systick device needs to react accordingly. Possibly this should
+     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
-+ * be deferred until we have a good API for modelling clock trees.
+ }
-+ */
+@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-+extern int system_clock_scale;
+     tcg_temp_free_i64(tmp);
-+
+ }
- #endif
 -static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
 +static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
  {
      return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
      tcg_temp_free_i64(tmp);
  }
 -static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
 +static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
  {
      return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
 +static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
      gen_helper_vfp_negd(vd, vd);
  }
 -static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
 +static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
  {
      return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
 +static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
 +static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
 +static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
      return true;
  }
 -static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
 +static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
  {
      /*
       * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
      return true;
  }
 -static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
 +static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
      return true;
  }
 -static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
 +static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 --
 .20.1

-[Qemu-devel] [PULL 11/12] hw/arm/exynos4210: Add DMA support for the Exynos4210
+[Qemu-devel] [PULL 24/24] target/arm: Only implement doubles if the FPU supports them
-From: Guenter Roeck <linux@roeck-us.net>
+The architecture permits FPUs which have only single-precision
+support, not double-precision; Cortex-M4 and Cortex-M33 are
-QEMU already supports pl330. Instantiate it for Exynos4210.
+both like that. Add the necessary checks on the MVFR0 FPDP
+field so that we UNDEF any double-precision instructions on
-Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:
+CPUs like this.
-/ {
+Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
-    soc: soc {
+VLDM/VSTM, VLDR/VSTR which take double precision registers
-        amba {
+still exist.
-            pdma0: pdma@12680000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12680000 0x1000>;
                 interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA0>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             pdma1: pdma@12690000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12690000 0x1000>;
                 interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_PDMA1>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <32>;
             };
             mdma1: mdma@12850000 {
                 compatible = "arm,pl330", "arm,primecell";
                 reg = <0x12850000 0x1000>;
                 interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                 clocks = <&clock CLK_MDMA>;
                 clock-names = "apb_pclk";
                 #dma-cells = <1>;
                 #dma-channels = <8>;
                 #dma-requests = <1>;
             };
         };
     };
 };
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20190520214342.13709-4-philmd@redhat.com
 [PMD: Do not set default qdev properties, create the controllers in the SoC
       rather than the board (Peter Maydell), add dtsi in commit message]
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
 ---
- hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
+ target/arm/cpu.h               |  6 +++
-file changed, 26 insertions(+)
+ target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
+files changed, 90 insertions(+)
-diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4210.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/exynos4210.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
- /* EHCI */
+     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
  #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 +/* DMA */
 +#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
 +#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
 +#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
 +
  static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
 x09, 0x00, 0x00, 0x00 };
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
      return (0x9 << ARM_AFF1_SHIFT) | cpu;
  }
-+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
++static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
 +{
-+    SysBusDevice *busdev;
++    /* Return true if CPU supports double precision floating point */
-+    DeviceState *dev;
++    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
 +
 +    dev = qdev_create(NULL, "pl330");
 +    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
 +    qdev_init_nofail(dev);
 +    busdev = SYS_BUS_DEVICE(dev);
 +    sysbus_mmio_map(busdev, 0, base);
 +    sysbus_connect_irq(busdev, 0, irq);
 +}
 +
- Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+ /*
- {
+  * We always set the FP and SIMD FP16 fields to indicate identical
-     Exynos4210State *s = g_new0(Exynos4210State, 1);
+  * levels of support (assuming SIMD is implemented at all), so
-@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
-     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
+index XXXXXXX..XXXXXXX 100644
-             s->irq_table[exynos4210_get_irq(28, 3)]);
+--- a/target/arm/translate-vfp.inc.c
++++ b/target/arm/translate-vfp.inc.c
-+    /*** DMA controllers ***/
+@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
-+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+         ((a->vm | a->vn | a->vd) & 0x10)) {
-+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+         return false;
-+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+     }
-+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
++
-+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
++    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
-+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
++        return false;
-+
++    }
-     return s;
++
- }
+     rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          ((a->vm | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
      if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

Not very much here, but several people have fallen over
the vector operation segfault bug, so let's get the fix
into master.

thanks
-- PMM

The following changes since commit d418238dca7b4e0b124135827ead3076233052b1:

Merge remote-tracking branch 'remotes/rth/tags/pull-rng-20190522' into staging (2019-05-23 12:57:17 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190523

for you to fetch changes up to 98e4f4fdb8ea05d840f51f47125924c2bb9df2df:

hw/arm/exynos4210: QOM'ify the Exynos4210 SoC (2019-05-23 14:47:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * exynos4210: QOM'ify the Exynos4210 SoC
 * exynos4210: Add DMA support for the Exynos4210
 * arm_gicv3: Fix writes to ICC_CTLR_EL3
 * arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
 * target/arm: Fix vector operation segfault
 * target/arm: Minor improvements to BFXIL, EXTR

----------------------------------------------------------------
Alistair Francis (1):
      target/arm: Fix vector operation segfault

Guenter Roeck (1):
      hw/arm/exynos4210: Add DMA support for the Exynos4210

Peter Maydell (5):
      arm: Move system_clock_scale to armv7m_systick.h
      arm: Remove unnecessary includes of hw/arm/arm.h
      arm: Rename hw/arm/arm.h to hw/arm/boot.h
      hw/intc/arm_gicv3: Fix write of ICH_VMCR_EL2.{VBPR0, VBPR1}
      hw/intc/arm_gicv3: Fix writes to ICC_CTLR_EL3

Philippe Mathieu-Daudé (3):
      hw/arm/exynos4: Remove unuseful debug code
      hw/arm/exynos4: Use the IEC binary prefix definitions
      hw/arm/exynos4210: QOM'ify the Exynos4210 SoC

Richard Henderson (2):
      target/arm: Use extract2 for EXTR
      target/arm: Simplify BFXIL expansion

include/hw/arm/allwinner-a10.h    |  2 +-
 include/hw/arm/aspeed_soc.h       |  1 -
 include/hw/arm/bcm2836.h          |  1 -
 include/hw/arm/{arm.h => boot.h}  | 12 +++------
 include/hw/arm/exynos4210.h       |  9 +++++--
 include/hw/arm/fsl-imx25.h        |  2 +-
 include/hw/arm/fsl-imx31.h        |  2 +-
 include/hw/arm/fsl-imx6.h         |  2 +-
 include/hw/arm/fsl-imx6ul.h       |  2 +-
 include/hw/arm/fsl-imx7.h         |  2 +-
 include/hw/arm/virt.h             |  2 +-
 include/hw/arm/xlnx-versal.h      |  2 +-
 include/hw/arm/xlnx-zynqmp.h      |  2 +-
 include/hw/timer/armv7m_systick.h | 22 ++++++++++++++++
 hw/arm/armsse.c                   |  2 +-
 hw/arm/armv7m.c                   |  2 +-
 hw/arm/aspeed.c                   |  2 +-
 hw/arm/boot.c                     |  2 +-
 hw/arm/collie.c                   |  2 +-
 hw/arm/exynos4210.c               | 54 ++++++++++++++++++++++++++++++++++++---
 hw/arm/exynos4_boards.c           | 40 ++++++++---------------------
 hw/arm/highbank.c                 |  2 +-
 hw/arm/integratorcp.c             |  2 +-
 hw/arm/mainstone.c                |  2 +-
 hw/arm/microbit.c                 |  2 +-
 hw/arm/mps2-tz.c                  |  2 +-
 hw/arm/mps2.c                     |  2 +-
 hw/arm/msf2-soc.c                 |  1 -
 hw/arm/msf2-som.c                 |  2 +-
 hw/arm/musca.c                    |  2 +-
 hw/arm/musicpal.c                 |  2 +-
 hw/arm/netduino2.c                |  2 +-
 hw/arm/nrf51_soc.c                |  2 +-
 hw/arm/nseries.c                  |  2 +-
 hw/arm/omap1.c                    |  2 +-
 hw/arm/omap2.c                    |  2 +-
 hw/arm/omap_sx1.c                 |  2 +-
 hw/arm/palm.c                     |  2 +-
 hw/arm/raspi.c                    |  2 +-
 hw/arm/realview.c                 |  2 +-
 hw/arm/spitz.c                    |  2 +-
 hw/arm/stellaris.c                |  2 +-
 hw/arm/stm32f205_soc.c            |  2 +-
 hw/arm/strongarm.c                |  2 +-
 hw/arm/tosa.c                     |  2 +-
 hw/arm/versatilepb.c              |  2 +-
 hw/arm/vexpress.c                 |  2 +-
 hw/arm/virt.c                     |  2 +-
 hw/arm/xilinx_zynq.c              |  2 +-
 hw/arm/xlnx-versal.c              |  2 +-
 hw/arm/z2.c                       |  2 +-
 hw/intc/arm_gicv3_cpuif.c         |  6 ++---
 hw/intc/armv7m_nvic.c             |  1 -
 target/arm/arm-semi.c             |  1 -
 target/arm/cpu.c                  |  1 -
 target/arm/cpu64.c                |  1 -
 target/arm/kvm.c                  |  1 -
 target/arm/kvm32.c                |  1 -
 target/arm/kvm64.c                |  1 -
 target/arm/translate-a64.c        | 44 ++++++++++++++++---------------
 target/arm/translate.c            |  4 +--
 61 files changed, 164 insertions(+), 123 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (96%)

From: Richard Henderson <richard.henderson@linaro.org>

This is, after all, how we implement extract2 in tcg/aarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_extract(DisasContext *s, uint32_t insn)
             } else {
                 tcg_gen_ext32u_i64(tcg_rd, cpu_reg(s, rm));
             }
-        } else if (rm == rn) { /* ROR */
-            tcg_rm = cpu_reg(s, rm);
-            if (sf) {
-                tcg_gen_rotri_i64(tcg_rd, tcg_rm, imm);
-            } else {
-                TCGv_i32 tmp = tcg_temp_new_i32();
-                tcg_gen_extrl_i64_i32(tmp, tcg_rm);
-                tcg_gen_rotri_i32(tmp, tmp, imm);
-                tcg_gen_extu_i32_i64(tcg_rd, tmp);
-                tcg_temp_free_i32(tmp);
-            }
         } else {
-            tcg_rm = read_cpu_reg(s, rm, sf);
-            tcg_rn = read_cpu_reg(s, rn, sf);
-            tcg_gen_shri_i64(tcg_rm, tcg_rm, imm);
-            tcg_gen_shli_i64(tcg_rn, tcg_rn, bitsize - imm);
-            tcg_gen_or_i64(tcg_rd, tcg_rm, tcg_rn);
-            if (!sf) {
-                tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+            tcg_rm = cpu_reg(s, rm);
+            tcg_rn = cpu_reg(s, rn);
+
+            if (sf) {
+                /* Specialization to ROR happens in EXTRACT2.  */
+                tcg_gen_extract2_i64(tcg_rd, tcg_rm, tcg_rn, imm);
+            } else {
+                TCGv_i32 t0 = tcg_temp_new_i32();
+
+                tcg_gen_extrl_i64_i32(t0, tcg_rm);
+                if (rm == rn) {
+                    tcg_gen_rotri_i32(t0, t0, imm);
+                } else {
+                    TCGv_i32 t1 = tcg_temp_new_i32();
+                    tcg_gen_extrl_i64_i32(t1, tcg_rn);
+                    tcg_gen_extract2_i32(t0, t0, t1, imm);
+                    tcg_temp_free_i32(t1);
+                }
+                tcg_gen_extu_i32_i64(tcg_rd, t0);
+                tcg_temp_free_i32(t0);
             }
         }
     }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The mask implied by the extract is redundant with the one
implied by the deposit.  Also, fix spelling of BFXIL.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190514011129.11330-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

From: Alistair Francis <alistair.francis@wdc.com>

Commit 89e68b575 "target/arm: Use vector operations for saturation"
causes this abort() when booting QEMU ARM with a Cortex-A15:

0  0x00007ffff4c2382f in raise () at /usr/lib/libc.so.6
1  0x00007ffff4c0e672 in abort () at /usr/lib/libc.so.6
2  0x00005555559c1839 in disas_neon_data_insn (insn=<optimized out>, s=<optimized out>) at ./target/arm/translate.c:6673
3  0x00005555559c1839 in disas_neon_data_insn (s=<optimized out>, insn=<optimized out>) at ./target/arm/translate.c:6386
4  0x00005555559cd8a4 in disas_arm_insn (insn=4081107068, s=0x7fffe59a9510) at ./target/arm/translate.c:9289
5  0x00005555559cd8a4 in arm_tr_translate_insn (dcbase=0x7fffe59a9510, cpu=<optimized out>) at ./target/arm/translate.c:13612
6  0x00005555558d1d39 in translator_loop (ops=0x5555561cc580 <arm_translator_ops>, db=0x7fffe59a9510, cpu=0x55555686a2f0, tb=<optimized out>, max_insns=<optimized out>) at ./accel/tcg/translator.c:96
7  0x00005555559d10d4 in gen_intermediate_code (cpu=cpu@entry=0x55555686a2f0, tb=tb@entry=0x7fffd7840080 <code_gen_buffer+126091347>, max_insns=max_insns@entry=512) at ./target/arm/translate.c:13901
8  0x00005555558d06b9 in tb_gen_code (cpu=cpu@entry=0x55555686a2f0, pc=3067096216, cs_base=0, flags=192, cflags=-16252928, cflags@entry=524288) at ./accel/tcg/translate-all.c:1736
9  0x00005555558ce467 in tb_find (cf_mask=524288, tb_exit=1, last_tb=0x7fffd783e640 <code_gen_buffer+126084627>, cpu=0x1) at ./accel/tcg/cpu-exec.c:407
10 0x00005555558ce467 in cpu_exec (cpu=cpu@entry=0x55555686a2f0) at ./accel/tcg/cpu-exec.c:728
11 0x000055555588b0cf in tcg_cpu_exec (cpu=0x55555686a2f0) at ./cpus.c:1431
12 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=0x55555686a2f0) at ./cpus.c:1735
13 0x000055555588d223 in qemu_tcg_cpu_thread_fn (arg=arg@entry=0x55555686a2f0) at ./cpus.c:1709
14 0x0000555555d2629a in qemu_thread_start (args=<optimized out>) at ./util/qemu-thread-posix.c:502
15 0x00007ffff4db8a92 in start_thread () at /usr/lib/libpthread.

This patch ensures that we don't hit the abort() in the second switch
case in disas_neon_data_insn() as we will return from the first case.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: ad91b397f360b2fc7f4087e476f7df5b04d42ddb.1558021877.git.alistair.francis@wdc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqadd_op : sqadd_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VQSUB:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
                            (u ? uqsub_op : sqsub_op) + size);
-            break;
+            return 0;
 
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
-- 
2.20.1

The system_clock_scale global is used only by the armv7m systick
device; move the extern declaration to the armv7m_systick.h header,
and expand the comment to explain what it is and that it should
ideally be replaced with a different approach.

diff --git a/include/hw/arm/arm.h b/include/hw/arm/arm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/arm.h
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-/* Multiplication factor to convert from system clock ticks to qemu timer
-   ticks.  */
-extern int system_clock_scale;
-
 #endif /* HW_ARM_H */
diff --git a/include/hw/timer/armv7m_systick.h b/include/hw/timer/armv7m_systick.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/timer/armv7m_systick.h
+++ b/include/hw/timer/armv7m_systick.h
@@ -XXX,XX +XXX,XX @@ typedef struct SysTickState {
     qemu_irq irq;
 } SysTickState;
 
+/*
+ * Multiplication factor to convert from system clock ticks to qemu timer
+ * ticks. This should be set (by board code, usually) to a value
+ * equal to NANOSECONDS_PER_SECOND / frq, where frq is the clock frequency
+ * in Hz of the CPU.
+ *
+ * This value is used by the systick device when it is running in
+ * its "use the CPU clock" mode (ie when SYST_CSR.CLKSOURCE == 1) to
+ * set how fast the timer should tick.
+ *
+ * TODO: we should refactor this so that rather than using a global
+ * we use a device property or something similar. This is complicated
+ * because (a) the property would need to be plumbed through from the
+ * board code down through various layers to the systick device
+ * and (b) the property needs to be modifiable after realize, because
+ * the stellaris board uses this to implement the behaviour where the
+ * guest can reprogram the PLL registers to downclock the CPU, and the
+ * systick device needs to react accordingly. Possibly this should
+ * be deferred until we have a good API for modelling clock trees.
+ */
+extern int system_clock_scale;
+
 #endif
-- 
2.20.1

The hw/arm/arm.h header now only includes declarations relating
to boot.c code, so it is only needed by Arm board or SoC code.
Remove some unnecessary inclusions of it from target/arm files
and from hw/intc/armv7m_nvic.c.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
-#include "hw/arm/arm.h"
 #include "hw/intc/armv7m_nvic.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@
 #else
 #include "qemu-common.h"
 #include "exec/gdbstub.h"
-#include "hw/arm/arm.h"
 #include "qemu/cutils.h"
 #endif
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #endif
-#include "hw/arm/arm.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "trace.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 #include "qemu/log.h"
 
 static inline void set_feature(uint64_t *features, int feature)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "internals.h"
-#include "hw/arm/arm.h"
 
 static bool have_guest_debug;
 
-- 
2.20.1

The header file hw/arm/arm.h now includes only declarations
relating to hw/arm/boot.c functionality. Rename it accordingly,
and adjust its header comment.

The bulk of this commit was created via
 perl -pi -e 's|hw/arm/arm.h|hw/arm/boot.h|' hw/arm/*.c include/hw/arm/*.h

In a few cases we can just delete the #include:
hw/arm/msf2-soc.c, include/hw/arm/aspeed_soc.h and
include/hw/arm/bcm2836.h did not require it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190516163857.6430-4-peter.maydell@linaro.org
---
 include/hw/arm/allwinner-a10.h   | 2 +-
 include/hw/arm/aspeed_soc.h      | 1 -
 include/hw/arm/bcm2836.h         | 1 -
 include/hw/arm/{arm.h => boot.h} | 8 ++++----
 include/hw/arm/fsl-imx25.h       | 2 +-
 include/hw/arm/fsl-imx31.h       | 2 +-
 include/hw/arm/fsl-imx6.h        | 2 +-
 include/hw/arm/fsl-imx6ul.h      | 2 +-
 include/hw/arm/fsl-imx7.h        | 2 +-
 include/hw/arm/virt.h            | 2 +-
 include/hw/arm/xlnx-versal.h     | 2 +-
 include/hw/arm/xlnx-zynqmp.h     | 2 +-
 hw/arm/armsse.c                  | 2 +-
 hw/arm/armv7m.c                  | 2 +-
 hw/arm/aspeed.c                  | 2 +-
 hw/arm/boot.c                    | 2 +-
 hw/arm/collie.c                  | 2 +-
 hw/arm/exynos4210.c              | 2 +-
 hw/arm/exynos4_boards.c          | 2 +-
 hw/arm/highbank.c                | 2 +-
 hw/arm/integratorcp.c            | 2 +-
 hw/arm/mainstone.c               | 2 +-
 hw/arm/microbit.c                | 2 +-
 hw/arm/mps2-tz.c                 | 2 +-
 hw/arm/mps2.c                    | 2 +-
 hw/arm/msf2-soc.c                | 1 -
 hw/arm/msf2-som.c                | 2 +-
 hw/arm/musca.c                   | 2 +-
 hw/arm/musicpal.c                | 2 +-
 hw/arm/netduino2.c               | 2 +-
 hw/arm/nrf51_soc.c               | 2 +-
 hw/arm/nseries.c                 | 2 +-
 hw/arm/omap1.c                   | 2 +-
 hw/arm/omap2.c                   | 2 +-
 hw/arm/omap_sx1.c                | 2 +-
 hw/arm/palm.c                    | 2 +-
 hw/arm/raspi.c                   | 2 +-
 hw/arm/realview.c                | 2 +-
 hw/arm/spitz.c                   | 2 +-
 hw/arm/stellaris.c               | 2 +-
 hw/arm/stm32f205_soc.c           | 2 +-
 hw/arm/strongarm.c               | 2 +-
 hw/arm/tosa.c                    | 2 +-
 hw/arm/versatilepb.c             | 2 +-
 hw/arm/vexpress.c                | 2 +-
 hw/arm/virt.c                    | 2 +-
 hw/arm/xilinx_zynq.c             | 2 +-
 hw/arm/xlnx-versal.c             | 2 +-
 hw/arm/z2.c                      | 2 +-
 49 files changed, 49 insertions(+), 52 deletions(-)
 rename include/hw/arm/{arm.h => boot.h} (98%)

diff --git a/include/hw/arm/allwinner-a10.h b/include/hw/arm/allwinner-a10.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-a10.h
+++ b/include/hw/arm/allwinner-a10.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "hw/char/serial.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/timer/allwinner-a10-pit.h"
 #include "hw/intc/allwinner-a10-pic.h"
 #include "hw/net/allwinner_emac.h"
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #ifndef ASPEED_SOC_H
 #define ASPEED_SOC_H
 
-#include "hw/arm/arm.h"
 #include "hw/intc/aspeed_vic.h"
 #include "hw/misc/aspeed_scu.h"
 #include "hw/misc/aspeed_sdmc.h"
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #ifndef BCM2836_H
 #define BCM2836_H
 
-#include "hw/arm/arm.h"
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
diff --git a/include/hw/arm/arm.h b/include/hw/arm/boot.h
similarity index 98%
rename from include/hw/arm/arm.h
rename to include/hw/arm/boot.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/arm.h
+++ b/include/hw/arm/boot.h
@@ -XXX,XX +XXX,XX @@
 /*
- * Misc ARM declarations
+ * ARM kernel loader.
  *
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
@@ -XXX,XX +XXX,XX @@
  *
  */
 
-#ifndef HW_ARM_H
-#define HW_ARM_H
+#ifndef HW_ARM_BOOT_H
+#define HW_ARM_BOOT_H
 
 #include "exec/memory.h"
 #include "target/arm/cpu-qom.h"
@@ -XXX,XX +XXX,XX @@ void arm_write_secure_board_setup_dummy_smc(ARMCPU *cpu,
                                             const struct arm_boot_info *info,
                                             hwaddr mvbar_addr);
 
-#endif /* HW_ARM_H */
+#endif /* HW_ARM_BOOT_H */
diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX25_H
 #define FSL_IMX25_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx25_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx31.h b/include/hw/arm/fsl-imx31.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx31.h
+++ b/include/hw/arm/fsl-imx31.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX31_H
 #define FSL_IMX31_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/imx_avic.h"
 #include "hw/misc/imx31_ccm.h"
 #include "hw/char/imx_serial.h"
diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6_H
 #define FSL_IMX6_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx6ul.h b/include/hw/arm/fsl-imx6ul.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6ul.h
+++ b/include/hw/arm/fsl-imx6ul.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX6UL_H
 #define FSL_IMX6UL_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/misc/imx6ul_ccm.h"
 #include "hw/misc/imx6_src.h"
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #ifndef FSL_IMX7_H
 #define FSL_IMX7_H
 
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/cpu/a15mpcore.h"
 #include "hw/intc/imx_gpcv2.h"
 #include "hw/misc/imx7_ccm.h"
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/kvm.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #ifndef XLNX_ZYNQMP_H
 
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/char/cadence_uart.h"
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/registerfields.h"
 #include "hw/arm/armsse.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 /* Format of the System Information block SYS_CONFIG register */
 typedef enum SysConfigFormat {
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "elf.h"
 #include "sysemu/qtest.h"
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/boards.h"
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include <libfdt.h>
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/linux-boot-if.h"
 #include "sysemu/kvm.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "strongarm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "exec/address-spaces.h"
 #include "cpu.h"
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/sd/sdhci.h"
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "sysemu/kvm.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mainstone.c
+++ b/hw/arm/mainstone.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "hw/net/smc91c111.h"
 #include "hw/boards.h"
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "exec/address-spaces.h"
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
 #include "exec/address-spaces.h"
 #include "hw/char/serial.h"
 #include "hw/boards.h"
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
 #include "cpu.h"
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "hw/boards.h"
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 
 static void netduino2_init(MachineState *machine)
 {
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/sysbus.h"
 #include "hw/boards.h"
 #include "hw/misc/unimp.h"
diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bswap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/omap.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/irq.h"
 #include "ui/console.h"
 #include "hw/boards.h"
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/soc_dma.h"
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/omap.h"
 #include "sysemu/sysemu.h"
 #include "qemu/timer.h"
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "sysemu/qtest.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/palm.c b/hw/arm/palm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/palm.c
+++ b/hw/arm/palm.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/input/tsc2xxx.h"
 #include "hw/loader.h"
 #include "exec/address-spaces.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/boards.h"
 #include "hw/loader.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 
 #define SMPBOOT_ADDR    0x300 /* this should leave enough space for ATAGS */
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/spitz.c
+++ b/hw/arm/spitz.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "sysemu/sysemu.h"
 #include "hw/pcmcia.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/ssi/ssi.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu-common.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "exec/address-spaces.h"
 #include "hw/arm/stm32f205_soc.h"
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "strongarm.h"
 #include "qemu/error-report.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/tosa.c
+++ b/hw/arm/tosa.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/sharpsl.h"
 #include "hw/pcmcia.h"
 #include "hw/boards.h"
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "net/net.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/kvm.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
diff --git a/hw/arm/z2.c b/hw/arm/z2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/z2.c
+++ b/hw/arm/z2.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/hw.h"
 #include "hw/arm/pxa.h"
-#include "hw/arm/arm.h"
+#include "hw/arm/boot.h"
 #include "hw/i2c/i2c.h"
 #include "hw/ssi/ssi.h"
 #include "hw/boards.h"
-- 
2.20.1

In ich_vmcr_write() we enforce "writes of BPR fields to less than
their minimum sets them to the minimum" by doing a "read vbpr and
write it back" operation.  A typo here meant that we weren't handling
writes to these fields correctly, because we were reading from VBPR0
but writing to VBPR1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

The ICC_CTLR_EL3 register includes some bits which are aliases
of bits in the ICC_CTLR_EL1(S) and (NS) registers. QEMU chooses
to keep those bits in the cs->icc_ctlr_el1[] struct fields.
Unfortunately a missing '~' in the code to update the bits
in those fields meant that writing to ICC_CTLR_EL3 would corrupt
the ICC_CLTR_EL1 register values.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520162809.2677-5-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_cpuif.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_ctlr_el3_write(gicv3_redist_affid(cs), value);
 
     /* *_EL1NS and *_EL1S bits are aliases into the ICC_CTLR_EL1 bits. */
-    cs->icc_ctlr_el1[GICV3_NS] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_NS] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1NS) {
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_EOIMODE;
     }
@@ -XXX,XX +XXX,XX @@ static void icc_ctlr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
         cs->icc_ctlr_el1[GICV3_NS] |= ICC_CTLR_EL1_CBPR;
     }
 
-    cs->icc_ctlr_el1[GICV3_S] &= (ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
+    cs->icc_ctlr_el1[GICV3_S] &= ~(ICC_CTLR_EL1_CBPR | ICC_CTLR_EL1_EOIMODE);
     if (value & ICC_CTLR_EL3_EOIMODE_EL1S) {
         cs->icc_ctlr_el1[GICV3_S] |= ICC_CTLR_EL1_EOIMODE;
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/lan9118.h"
 #include "hw/boards.h"
 
-#undef DEBUG
-
-//#define DEBUG
-
-#ifdef DEBUG
-    #undef PRINT_DEBUG
-    #define  PRINT_DEBUG(fmt, args...) \
-        do { \
-            fprintf(stderr, "  [%s:%d]   "fmt, __func__, __LINE__, ##args); \
-        } while (0)
-#else
-    #define  PRINT_DEBUG(fmt, args...)  do {} while (0)
-#endif
-
 #define SMDK_LAN9118_BASE_ADDR      0x05000000
 
 typedef enum Exynos4BoardType {
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_board_binfo.gic_cpu_if_addr =
             EXYNOS4210_SMP_PRIVATE_BASE_ADDR + 0x100;
 
-    PRINT_DEBUG("\n ram_size: %luMiB [0x%08lx]\n"
-            " kernel_filename: %s\n"
-            " kernel_cmdline: %s\n"
-            " initrd_filename: %s\n",
-            exynos4_board_ram_size[board_type] / 1048576,
-            exynos4_board_ram_size[board_type],
-            machine->kernel_filename,
-            machine->kernel_cmdline,
-            machine->initrd_filename);
-
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

It eases code review, unit is explicit.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4_boards.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/units.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "qemu-common.h"
@@ -XXX,XX +XXX,XX @@ static int exynos4_board_smp_bootreg_addr[EXYNOS4_NUM_OF_BOARDS] = {
 };
 
 static unsigned long exynos4_board_ram_size[EXYNOS4_NUM_OF_BOARDS] = {
-    [EXYNOS4_BOARD_NURI]     = 0x40000000,
-    [EXYNOS4_BOARD_SMDKC210] = 0x40000000,
+    [EXYNOS4_BOARD_NURI]     = 1 * GiB,
+    [EXYNOS4_BOARD_SMDKC210] = 1 * GiB,
 };
 
 static struct arm_boot_info exynos4_board_binfo = {
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

QEMU already supports pl330. Instantiate it for Exynos4210.

Relevant part of Linux arch/arm/boot/dts/exynos4.dtsi:

/ {
    soc: soc {
        amba {
            pdma0: pdma@12680000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12680000 0x1000>;
                interrupts = <GIC_SPI 35 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA0>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            pdma1: pdma@12690000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12690000 0x1000>;
                interrupts = <GIC_SPI 36 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_PDMA1>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <32>;
            };
            mdma1: mdma@12850000 {
                compatible = "arm,pl330", "arm,primecell";
                reg = <0x12850000 0x1000>;
                interrupts = <GIC_SPI 34 IRQ_TYPE_LEVEL_HIGH>;
                clocks = <&clock CLK_MDMA>;
                clock-names = "apb_pclk";
                #dma-cells = <1>;
                #dma-channels = <8>;
                #dma-requests = <1>;
            };
        };
    };
};

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190520214342.13709-4-philmd@redhat.com
[PMD: Do not set default qdev properties, create the controllers in the SoC
      rather than the board (Peter Maydell), add dtsi in commit message]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/exynos4210.c | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@
 /* EHCI */
 #define EXYNOS4210_EHCI_BASE_ADDR           0x12580000
 
+/* DMA */
+#define EXYNOS4210_PL330_BASE0_ADDR         0x12680000
+#define EXYNOS4210_PL330_BASE1_ADDR         0x12690000
+#define EXYNOS4210_PL330_BASE2_ADDR         0x12850000
+
 static uint8_t chipid_and_omr[] = { 0x11, 0x02, 0x21, 0x43,
                                     0x09, 0x00, 0x00, 0x00 };
 
@@ -XXX,XX +XXX,XX @@ static uint64_t exynos4210_calc_affinity(int cpu)
     return (0x9 << ARM_AFF1_SHIFT) | cpu;
 }
 
+static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
+{
+    SysBusDevice *busdev;
+    DeviceState *dev;
+
+    dev = qdev_create(NULL, "pl330");
+    qdev_prop_set_uint8(dev, "num_periph_req",  nreq);
+    qdev_init_nofail(dev);
+    busdev = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(busdev, 0, base);
+    sysbus_connect_irq(busdev, 0, irq);
+}
+
 Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
 {
     Exynos4210State *s = g_new0(Exynos4210State, 1);
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
     sysbus_create_simple(TYPE_EXYNOS4210_EHCI, EXYNOS4210_EHCI_BASE_ADDR,
             s->irq_table[exynos4210_get_irq(28, 3)]);
 
+    /*** DMA controllers ***/
+    pl330_create(EXYNOS4210_PL330_BASE0_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(35, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE1_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
+    pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
+                 qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
+
     return s;
 }
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20190520214342.13709-5-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/exynos4210.h |  9 +++++++--
 hw/arm/exynos4210.c         | 28 ++++++++++++++++++++++++----
 hw/arm/exynos4_boards.c     |  9 ++++++---
 3 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/exynos4210.h b/include/hw/arm/exynos4210.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/exynos4210.h
+++ b/include/hw/arm/exynos4210.h
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210Irq {
 } Exynos4210Irq;
 
 typedef struct Exynos4210State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+    /*< public >*/
     ARMCPU *cpu[EXYNOS4210_NCPUS];
     Exynos4210Irq irqs;
     qemu_irq *irq_table;
@@ -XXX,XX +XXX,XX @@ typedef struct Exynos4210State {
     I2CBus *i2c_if[EXYNOS4210_I2C_NUMBER];
 } Exynos4210State;
 
+#define TYPE_EXYNOS4210_SOC "exynos4210"
+#define EXYNOS4210_SOC(obj) \
+    OBJECT_CHECK(Exynos4210State, obj, TYPE_EXYNOS4210_SOC)
+
 void exynos4210_write_secondary(ARMCPU *cpu,
         const struct arm_boot_info *info);
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem);
-
 /* Initialize exynos4210 IRQ subsystem stub */
 qemu_irq *exynos4210_init_irq(Exynos4210Irq *env);
 
diff --git a/hw/arm/exynos4210.c b/hw/arm/exynos4210.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4210.c
+++ b/hw/arm/exynos4210.c
@@ -XXX,XX +XXX,XX @@ static void pl330_create(uint32_t base, qemu_irq irq, int nreq)
     sysbus_connect_irq(busdev, 0, irq);
 }
 
-Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
+static void exynos4210_realize(DeviceState *socdev, Error **errp)
 {
-    Exynos4210State *s = g_new0(Exynos4210State, 1);
+    Exynos4210State *s = EXYNOS4210_SOC(socdev);
+    MemoryRegion *system_mem = get_system_memory();
     qemu_irq gate_irq[EXYNOS4210_NCPUS][EXYNOS4210_IRQ_GATE_NINPUTS];
     SysBusDevice *busdev;
     DeviceState *dev;
@@ -XXX,XX +XXX,XX @@ Exynos4210State *exynos4210_init(MemoryRegion *system_mem)
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(36, 1)]), 32);
     pl330_create(EXYNOS4210_PL330_BASE2_ADDR,
                  qemu_irq_invert(s->irq_table[exynos4210_get_irq(34, 1)]), 1);
-
-    return s;
 }
+
+static void exynos4210_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = exynos4210_realize;
+}
+
+static const TypeInfo exynos4210_info = {
+    .name = TYPE_EXYNOS4210_SOC,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(Exynos4210State),
+    .class_init = exynos4210_class_init,
+};
+
+static void exynos4210_register_types(void)
+{
+    type_register_static(&exynos4210_info);
+}
+
+type_init(exynos4210_register_types)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@ typedef enum Exynos4BoardType {
 } Exynos4BoardType;
 
 typedef struct Exynos4BoardState {
-    Exynos4210State *soc;
+    Exynos4210State soc;
     MemoryRegion dram0_mem;
     MemoryRegion dram1_mem;
 } Exynos4BoardState;
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
     exynos4_boards_init_ram(s, get_system_memory(),
                             exynos4_board_ram_size[board_type]);
 
-    s->soc = exynos4210_init(get_system_memory());
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_EXYNOS4210_SOC);
+    qdev_set_parent_bus(DEVICE(&s->soc), sysbus_get_default());
+    object_property_set_bool(OBJECT(&s->soc), true, "realized",
+                             &error_fatal);
 
     return s;
 }
@@ -XXX,XX +XXX,XX @@ static void smdkc210_init(MachineState *machine)
                                                       EXYNOS4_BOARD_SMDKC210);
 
     lan9215_init(SMDK_LAN9118_BASE_ADDR,
-            qemu_irq_invert(s->soc->irq_table[exynos4210_get_irq(37, 1)]));
+            qemu_irq_invert(s->soc.irq_table[exynos4210_get_irq(37, 1)]));
     arm_load_kernel(ARM_CPU(first_cpu), &exynos4_board_binfo);
 }
 
-- 
2.20.1

Latest arm queue, half minor code cleanups and half minor
bug fixes.

-- PMM

The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617

for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:

target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)

----------------------------------------------------------------
target-arm queue:
 * support large kernel images in bootloader (by avoiding
   putting the initrd over the top of them)
 * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
 * arm_gicv3: Fix decoding of ID register range
 * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
 * some code cleanups following on from the VFP decodetree conversion
 * Only implement doubles if the FPU supports them
   (so we now correctly model Cortex-M4, -M33 as single precision only)

----------------------------------------------------------------
Peter Maydell (24):
      hw/arm/boot: Don't assume RAM starts at address zero
      hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
      hw/arm/boot: Avoid placing the initrd on top of the kernel
      hw/arm/boot: Honour image size field in AArch64 Image format kernels
      target/arm: Allow VFP and Neon to be disabled via a CPU property
      target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
      hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
      hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
      hw/intc/arm_gicv3: Fix decoding of ID register range
      hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
      target/arm: Move vfp_expand_imm() to translate.[ch]
      target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
      target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
      target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
      target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
      target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
      target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
      target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
      target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
      target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
      target/arm: Fix typos in trans function prototypes
      target/arm: Only implement doubles if the FPU supports them

In the Arm kernel/initrd loading code, in some places we make the
incorrect assumption that info->ram_size can be treated as the
address of the end of RAM, as for instance when we calculate the
available space for the initrd using "info->ram_size - info->initrd_start".
This is wrong, because many Arm boards (including "virt") specify
a non-zero info->loader_start to indicate that their RAM area
starts at a non-zero physical address.

Correct the places which make this incorrect assumption.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
+    uint64_t ram_end = info->loader_start + info->ram_size;
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         primary_loader = bootloader_aarch64;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
-                                             info->ram_size - KERNEL_LOAD_ADDR,
-                                             as);
+                                             ram_end - KERNEL_LOAD_ADDR, as);
         is_linux = 1;
     }
     if (kernel_size < 0) {
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         if (info->initrd_filename) {
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
-                                          info->ram_size - info->initrd_start,
-                                          as);
+                                          ram_end - info->initrd_start, as);
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys_as(info->initrd_filename,
                                                      info->initrd_start,
-                                                     info->ram_size -
+                                                     ram_end -
                                                      info->initrd_start,
                                                      as);
             }
-- 
2.20.1

We calculate the locations in memory where we want to put the
initrd and the DTB based on the size of the kernel, since they
come after it. Add some explicit checks that these aren't off the
end of RAM entirely.

(At the moment the way we calculate the initrd_start means that
it can't ever be off the end of RAM, but that will change with
the next commit.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         error_report("could not load kernel '%s'", info->kernel_filename);
         exit(1);
     }
+
+    if (kernel_size > info->ram_size) {
+        error_report("kernel '%s' is too large to fit in RAM "
+                     "(kernel size %d, RAM size %" PRId64 ")",
+                     info->kernel_filename, kernel_size, info->ram_size);
+        exit(1);
+    }
+
     info->entry = entry;
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
         if (info->initrd_filename) {
+
+            if (info->initrd_start >= ram_end) {
+                error_report("not enough space after kernel to load initrd");
+                exit(1);
+            }
+
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
                                           ram_end - info->initrd_start, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                              info->initrd_filename);
                 exit(1);
             }
+            if (info->initrd_start + initrd_size > info->ram_size) {
+                error_report("could not load initrd '%s': "
+                             "too big to fit into RAM after the kernel",
+                             info->initrd_filename);
+            }
         } else {
             initrd_size = 0;
         }
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
             /* Place the DTB after the initrd in memory with alignment. */
             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
                                            align);
+            if (info->dtb_start >= ram_end) {
+                error_report("Not enough space for DTB after kernel/initrd");
+                exit(1);
+            }
             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
         } else {
-- 
2.20.1

We currently put the initrd at the smaller of:
 * 128MB into RAM
 * halfway into the RAM
(with the dtb following it).

However for large kernels this might mean that the kernel
overlaps the initrd. For some kinds of kernel (self-decompressing
32-bit kernels, and ELF images with a BSS section at the end)
we don't know the exact size, but even there we have a
minimum size. Put the initrd at least further into RAM than
that. For image formats that can give us an exact kernel size, this
will mean that we definitely avoid overlaying kernel and initrd.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     if (info->nb_cpus == 0)
         info->nb_cpus = 1;
 
-    /*
-     * We want to put the initrd far enough into RAM that when the
-     * kernel is uncompressed it will not clobber the initrd. However
-     * on boards without much RAM we must ensure that we still leave
-     * enough room for a decent sized initrd, and on boards with large
-     * amounts of RAM we must avoid the initrd being so far up in RAM
-     * that it is outside lowmem and inaccessible to the kernel.
-     * So for boards with less  than 256MB of RAM we put the initrd
-     * halfway into RAM, and for boards with 256MB of RAM or more we put
-     * the initrd at 128MB.
-     */
-    info->initrd_start = info->loader_start +
-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
-
     /* Assume that raw images are linux kernels, and ELF images are not.  */
     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
                                &elf_high_addr, elf_machine, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
 
     info->entry = entry;
+
+    /*
+     * We want to put the initrd far enough into RAM that when the
+     * kernel is uncompressed it will not clobber the initrd. However
+     * on boards without much RAM we must ensure that we still leave
+     * enough room for a decent sized initrd, and on boards with large
+     * amounts of RAM we must avoid the initrd being so far up in RAM
+     * that it is outside lowmem and inaccessible to the kernel.
+     * So for boards with less  than 256MB of RAM we put the initrd
+     * halfway into RAM, and for boards with 256MB of RAM or more we put
+     * the initrd at 128MB.
+     * We also refuse to put the initrd somewhere that will definitely
+     * overlay the kernel we just loaded, though for kernel formats which
+     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
+     * we might still make a bad choice here.
+     */
+    info->initrd_start = info->loader_start +
+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
+
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
-- 
2.20.1

Since Linux v3.17, the kernel's Image header includes a field image_size,
which gives the total size of the kernel including unpopulated data
sections such as the BSS). If this is present, then return it from
load_aarch64_image() as the true size of the kernel rather than
just using the size of the Image file itself. This allows the code
which calculates where to put the initrd to avoid putting it in
the kernel's BSS area.

This means that we should be able to reliably load kernel images
which are larger than 128MB without accidentally putting the
initrd or dtb in locations that clash with the kernel itself.

Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
---
 hw/arm/boot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
                                    hwaddr *entry, AddressSpace *as)
 {
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+    uint64_t kernel_size = 0;
     uint8_t *buffer;
     int size;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          * is only valid if the image_size is non-zero.
          */
         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
-        if (hdrvals[1] != 0) {
+
+        kernel_size = le64_to_cpu(hdrvals[1]);
+
+        if (kernel_size != 0) {
             kernel_load_offset = le64_to_cpu(hdrvals[0]);
 
             /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
         }
     }
 
+    /*
+     * Kernels before v3.17 don't populate the image_size field, and
+     * raw images have no header. For those our best guess at the size
+     * is the size of the Image file itself.
+     */
+    if (kernel_size == 0) {
+        kernel_size = size;
+    }
+
     *entry = mem_base + kernel_load_offset;
     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
 
     g_free(buffer);
 
-    return size;
+    return kernel_size;
 }
 
 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-- 
2.20.1

Allow VFP and neon to be disabled via a CPU property. As with
the "pmu" property, we only allow these features to be removed
from CPUs which have it by default, not added to CPUs which
don't have it.

The primary motivation here is to be able to optionally
create Cortex-M33 CPUs with no FPU, but we provide switches
for both VFP and Neon because the two interact:
 * AArch64 can't have one without the other
 * Some ID register fields only change if both are disabled

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
---
 target/arm/cpu.h |   4 ++
 target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 148 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_el3;
     /* CPU has PMU (Performance Monitor Unit) */
     bool has_pmu;
+    /* CPU has VFP */
+    bool has_vfp;
+    /* CPU has Neon */
+    bool has_neon;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
 static Property arm_cpu_has_pmu_property =
             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 
+static Property arm_cpu_has_vfp_property =
+            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
+
+static Property arm_cpu_has_neon_property =
+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
+    /* Similarly for the VFP feature bits */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP3);
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP);
+    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
+    /*
+     * Allow user to turn off VFP and Neon support, but only for TCG --
+     * KVM does not currently allow us to lie to the guest about its
+     * ID/feature registers, so the guest always sees what the host has.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        cpu->has_vfp = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
+                                     &error_abort);
+        }
+    }
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
+        cpu->has_neon = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
+                                     &error_abort);
+        }
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+        cpu->has_vfp != cpu->has_neon) {
+        /*
+         * This is an architectural requirement for AArch64; AArch32 is
+         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
+         */
+        error_setg(errp,
+                   "AArch64 CPUs must have both VFP and Neon or neither");
+        return;
+    }
+
+    if (!cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_VFP);
+        unset_feature(env, ARM_FEATURE_VFP3);
+        unset_feature(env, ARM_FEATURE_VFP4);
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, FPSP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDP, 0);
+        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
+        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
+        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
+        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
+        cpu->isar.mvfr0 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
+        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
+        u = FIELD_DP32(u, MVFR1, FPHP, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_NEON);
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar5;
+        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
+        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
+        cpu->isar.id_isar5 = u;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
+        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon && !cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
+        cpu->isar.mvfr0 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     if (arm_feature(env, ARM_FEATURE_V5)) {
         set_feature(env, ARM_FEATURE_V4T);
     }
-    if (arm_feature(env, ARM_FEATURE_VFP4)) {
-        set_feature(env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(env, ARM_FEATURE_VFP3)) {
-        set_feature(env, ARM_FEATURE_VFP);
-    }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
         set_feature(env, ARM_FEATURE_PXN);
-- 
2.20.1

Allow the DSP extension to be disabled via a CPU property for
M-profile CPUs. (A and R-profile CPUs don't have this extension
as a defined separate optional architecture extension, so
they don't need the property.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
---
 target/arm/cpu.h |  2 ++
 target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_vfp;
     /* CPU has Neon */
     bool has_neon;
+    /* CPU has M-profile DSP extension */
+    bool has_dsp;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
 static Property arm_cpu_has_neon_property =
             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 
+static Property arm_cpu_has_dsp_property =
+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
         }
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
+        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
+                                 &error_abort);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.mvfr0 = u;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
+
+        u = cpu->isar.id_isar1;
+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
+        cpu->isar.id_isar1 = u;
+
+        u = cpu->isar.id_isar2;
+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
+        cpu->isar.id_isar2 = u;
+
+        u = cpu->isar.id_isar3;
+        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
+        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
+        cpu->isar.id_isar3 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
-- 
2.20.1

Create "vfp" and "dsp" properties on the armv7m container object
which will be forwarded to its CPU object, so that SoCs can
configure whether the CPU has these features.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 ++++
 hw/arm/armv7m.c         | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  *   devices will be automatically layered on top of this view.)
  * + Property "idau": IDAU interface (forwarded to CPU object)
  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
+ * + Property "vfp": enable VFP (forwarded to CPU object)
+ * + Property "dsp": enable DSP (forwarded to CPU object)
  * + Property "enable-bitband": expose bitbanded IO
  */
 typedef struct ARMv7MState {
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     uint32_t init_svtor;
     bool enable_bitband;
     bool start_powered_off;
+    bool vfp;
+    bool dsp;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
+                                 "vfp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
+                                 "dsp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
 
     /*
      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
                      false),
+    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
+    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

The SSE-200 hardware has configurable integration settings which
determine whether its two CPUs have the FPU and DSP:
 * CPU0_FPU (default 0)
 * CPU0_DSP (default 0)
 * CPU1_FPU (default 1)
 * CPU1_DSP (default 1)

Similarly, the IoTKit has settings for its single CPU:
 * CPU0_FPU (default 1)
 * CPU0_DSP (default 1)

Of our four boards that use either the IoTKit or the SSE-200:
 * mps2-an505, mps2-an521 and musca-a use the default settings
 * musca-b1 enables FPU and DSP on both CPUs

Currently QEMU models all these boards using CPUs with
both FPU and DSP enabled. This means that we are incorrect
for mps2-an521 and musca-a, which should not have FPU or DSP
on CPU0.

Create QOM properties on the ARMSSE devices corresponding to the
default h/w integration settings, and make the Musca-B1 board
enable FPU and DSP on both CPUs. This fixes the mps2-an521
and musca-a behaviour, and leaves the musca-b1 and mps2-an505
behaviour unchanged.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h |  7 +++++
 hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
 hw/arm/musca.c          |  8 ++++++
 3 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *    address of each SRAM bank (and thus the total amount of internal SRAM)
  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
  *    (where it expects to load the PC and SP from the vector table on reset)
+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
+ *    set whether the CPUs have the FPU and DSP features present. The default
+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
  *    which are wired to its NVIC lines 32 .. n+32
  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
     uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
+    bool cpu_fpu[SSE_MAX_CPUS];
+    bool cpu_dsp[SSE_MAX_CPUS];
 } ARMSSE;
 
 typedef struct ARMSSEInfo ARMSSEInfo;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
     bool has_cachectrl;
     bool has_cpusecctrl;
     bool has_cpuid;
+    Property *props;
+};
+
+static Property iotkit_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static Property armsse_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
+    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
+    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
+    DEFINE_PROP_END_OF_LIST()
 };
 
 static const ARMSSEInfo armsse_variants[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = false,
         .has_cpusecctrl = false,
         .has_cpuid = false,
+        .props = iotkit_properties,
     },
     {
         .name = TYPE_SSE200,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = true,
         .has_cpusecctrl = true,
         .has_cpuid = true,
+        .props = armsse_properties,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 return;
             }
         }
+        if (!s->cpu_fpu[i]) {
+            object_property_set_bool(cpuobj, false, "vfp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
+        if (!s->cpu_dsp[i]) {
+            object_property_set_bool(cpuobj, false, "dsp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
 
         if (i > 0) {
             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
     }
 };
 
-static Property armsse_properties[] = {
-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-    DEFINE_PROP_END_OF_LIST()
-};
-
 static void armsse_reset(DeviceState *dev)
 {
     ARMSSE *s = ARMSSE(dev);
@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
     ARMSSEClass *asc = ARMSSE_CLASS(klass);
+    const ARMSSEInfo *info = data;
 
     dc->realize = armsse_realize;
     dc->vmsd = &armsse_vmstate;
-    dc->props = armsse_properties;
+    dc->props = info->props;
     dc->reset = armsse_reset;
     iic->check = armsse_idau_check;
-    asc->info = data;
+    asc->info = info;
 }
 
 static const TypeInfo armsse_info = {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    /*
+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+     */
+    if (mmc->type == MUSCA_B1) {
+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
+    }
     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
                              &error_fatal);
 
-- 
2.20.1

The GIC ID registers cover an area 0x30 bytes in size
(12 registers, 4 bytes each). We were incorrectly decoding
only the first 0x20 bytes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c   | 4 ++--
 hw/intc/arm_gicv3_redist.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
         }
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
         /* ID registers */
         *data = gicv3_idreg(offset - GICD_IDREGS);
         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
         gicd_write_irouter(s, attrs, irq, r);
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
     case GICD_TYPER:
     case GICD_IIDR:
         /* RO registers, ignore the write */
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
         }
         *data = cs->gicr_nsacr;
         return MEMTX_OK;
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         *data = gicv3_idreg(offset - GICR_IDREGS);
         return MEMTX_OK;
     default:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         return MEMTX_OK;
     case GICR_IIDR:
     case GICR_TYPER:
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         /* RO registers, ignore the write */
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest write to RO register at offset "
-- 
2.20.1

The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
if the security extension is unsupported. "Security extension
unsupported" always implies GICD_CTLR.DS == 1, but the guest can
also set DS on a GIC which does support the security extension.
Fix the condition to correctly check the GICD_CTLR.DS bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
          * ITLinesNumber == (num external irqs / 32) - 1
          */
         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+        /*
+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
+         * "security extensions not supported" always implies DS == 1,
+         * so we only need to check the DS bit.
+         */
+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
             (0xf << 19) | itlinesnumber;
         return MEMTX_OK;
     }
-- 
2.20.1

We want to use vfp_expand_imm() in the AArch32 VFP decode;
move it from the a64-only header/source file to the
AArch32 one (which is always compiled even for AArch64).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
---
 target/arm/translate-a64.h     |  1 -
 target/arm/translate.h         |  7 +++++++
 target/arm/translate-a64.c     | 32 --------------------------------
 target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 33 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
 TCGv_ptr get_fpstatus_ptr(bool);
 bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
                             unsigned int imms, unsigned int immr);
-uint64_t vfp_expand_imm(int size, uint8_t imm8);
 bool sve_access_check(DisasContext *s);
 
 /* We should have at some point before trying to access an FP register
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
+/*
+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
+ * instruction, expand it to the actual constant value of the specified
+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8);
+
 /* Vector operations shared between ARM and AArch64.  */
 extern const GVecGen3 mla_op[4];
 extern const GVecGen3 mls_op[4];
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
- */
-uint64_t vfp_expand_imm(int size, uint8_t imm8)
-{
-    uint64_t imm;
-
-    switch (size) {
-    case MO_64:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-        break;
-    case MO_32:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-        break;
-    case MO_16:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
-            (extract32(imm8, 0, 6) << 6);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    return imm;
-}
-
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.inc.c"
 #include "decode-vfp-uncond.inc.c"
 
+/*
+ * The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    case MO_16:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+            (extract32(imm8, 0, 6) << 6);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /*
  * Return the offset of a 16-bit half of the specified VFP single-precision
  * register. If top is true, returns the top 16 bits; otherwise the bottom
-- 
2.20.1

The AArch32 VMOV (immediate) instruction uses the same VFP encoded
immediate format we already handle in vfp_expand_imm().  Use that
function rather than hand-decoding it.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++------------------------
 target/arm/vfp.decode          | 10 ++++++----
 2 files changed, 10 insertions(+), 28 deletions(-)

Where Neon instructions are floating point operations, we
mostly use the old VFP utility functions like gen_vfp_abs()
which work on the TCG globals cpu_F0s and cpu_F1s. The
Neon for-each-element loop conditionally loads the inputs
into either a plain old TCG temporary for most operations
or into cpu_F0s for float operations, and similarly stores
back either cpu_F0s or the temporary.

Switch NEON_2RM_VABS_F away from using cpu_F0s, and
update neon_2rm_is_float_op() accordingly.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_abs(int dp)
-{
-    if (dp)
-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
-}
-
 static inline void gen_vfp_neg(int dp)
 {
     if (dp)
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 
 static int neon_2rm_is_float_op(int op)
 {
-    /* Return true if this neon 2reg-misc op is float-to-float */
-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
+    /*
+     * Return true if this neon 2reg-misc op is float-to-float.
+     * This is not a property of the operation but of our code --
+     * what we are asking here is "does the code for this case in
+     * the Neon for-each-pass loop use cpu_F0s?".
+     */
+    return (op == NEON_2RM_VNEG_F ||
             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VABS_F:
-                            gen_vfp_abs(0);
+                            gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
                             gen_vfp_neg(0);
-- 
2.20.1

Switch NEON_2RM_VABS_F away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_neg(int dp)
-{
-    if (dp)
-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
-}
-
 #define VFP_GEN_ITOF(name) \
 static inline void gen_vfp_##name(int dp, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return (op == NEON_2RM_VNEG_F ||
-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
-                            gen_vfp_neg(0);
+                            gen_helper_vfp_negs(tmp, tmp);
                             break;
                         case NEON_2RM_VSWP:
                             tmp2 = neon_load_reg(rd, pass);
-- 
2.20.1

Switch NEON_2RM_VRINT* away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-            op == NEON_2RM_VRINTM ||
-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
 }
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
-                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints(tmp, tmp, fpstatus);
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
                             tcg_temp_free_ptr(fpstatus);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRINTX:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-            op >= NEON_2RM_VRECPE_F);
+    return op >= NEON_2RM_VRECPE_F;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                                       cpu_env);
 
                             if (is_signed) {
-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_tosls(tmp, tmp,
                                                      tcg_shift, fpst);
                             } else {
-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_touls(tmp, tmp,
                                                      tcg_shift, fpst);
                             }
 
-- 
2.20.1

Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return op >= NEON_2RM_VRECPE_F;
+    return op >= NEON_2RM_VCVT_FS;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRECPE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
                         case NEON_2RM_VRSQRTE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
Since this is the last user of cpu_F0s in the Neon 2rm-op
loop, we can remove the handling code for it too.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_ITOF(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_ITOF(uito)
-VFP_GEN_ITOF(sito)
-#undef VFP_GEN_ITOF
-
-#define VFP_GEN_FTOI(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_FTOI(touiz)
-VFP_GEN_FTOI(tosiz)
-#undef VFP_GEN_FTOI
-
 #define VFP_GEN_FIX(name, round) \
 static inline void gen_vfp_##name(int dp, int shift, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 #define NEON_2RM_VCVT_SF 62
 #define NEON_2RM_VCVT_UF 63
 
-static int neon_2rm_is_float_op(int op)
-{
-    /*
-     * Return true if this neon 2reg-misc op is float-to-float.
-     * This is not a property of the operation but of our code --
-     * what we are asking here is "does the code for this case in
-     * the Neon for-each-pass loop use cpu_F0s?".
-     */
-    return op >= NEON_2RM_VCVT_FS;
-}
-
 static bool neon_2rm_is_v8_op(int op)
 {
     /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 default:
                 elementwise:
                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rm, pass));
-                            tmp = NULL;
-                        } else {
-                            tmp = neon_load_reg(rm, pass);
-                        }
+                        tmp = neon_load_reg(rm, pass);
                         switch (op) {
                         case NEON_2RM_VREV32:
                             switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
-                            gen_vfp_sito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
-                            gen_vfp_uito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
-                            gen_vfp_tosiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
-                            gen_vfp_touiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         default:
                             /* Reserved op values were caught by the
                              * neon_2rm_sizes[] check earlier.
                              */
                             abort();
                         }
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rd, pass));
-                        } else {
-                            neon_store_reg(rd, pass, tmp);
-                        }
+                        neon_store_reg(rd, pass, tmp);
                     }
                     break;
                 }
-- 
2.20.1

Stop using cpu_F0s in the Neon VCVT fixed-point operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
---
 target/arm/translate.c | 62 +++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
 /* Function prototypes for gen_ functions calling Neon helpers.  */
 typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
                                  TCGv_i32, TCGv_i32);
+/* Function prototypes for gen_ functions for fix point conversions */
+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_FIX(name, round) \
-static inline void gen_vfp_##name(int dp, int shift, int neon) \
-{ \
-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
-                                        statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
-                                        statusptr); \
-    } \
-    tcg_temp_free_i32(tmp_shift); \
-    tcg_temp_free_ptr(statusptr); \
-}
-VFP_GEN_FIX(tosl, _round_to_zero)
-VFP_GEN_FIX(toul, _round_to_zero)
-VFP_GEN_FIX(slto, )
-VFP_GEN_FIX(ulto, )
-#undef VFP_GEN_FIX
-
 static inline long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 }
             } else if (op >= 14) {
                 /* VCVT fixed-point.  */
+                TCGv_ptr fpst;
+                TCGv_i32 shiftv;
+                VFPGenFixPointFn *fn;
+
                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
                     return 1;
                 }
+
+                if (!(op & 1)) {
+                    if (u) {
+                        fn = gen_helper_vfp_ultos;
+                    } else {
+                        fn = gen_helper_vfp_sltos;
+                    }
+                } else {
+                    if (u) {
+                        fn = gen_helper_vfp_touls_round_to_zero;
+                    } else {
+                        fn = gen_helper_vfp_tosls_round_to_zero;
+                    }
+                }
+
                 /* We have already masked out the must-be-1 top bit of imm6,
                  * hence this 32-shift where the ARM ARM has 64-imm6.
                  */
                 shift = 32 - shift;
+                fpst = get_fpstatus_ptr(1);
+                shiftv = tcg_const_i32(shift);
                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
-                    if (!(op & 1)) {
-                        if (u)
-                            gen_vfp_ulto(0, shift, 1);
-                        else
-                            gen_vfp_slto(0, shift, 1);
-                    } else {
-                        if (u)
-                            gen_vfp_toul(0, shift, 1);
-                        else
-                            gen_vfp_tosl(0, shift, 1);
-                    }
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
+                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
+                    fn(tmpf, tmpf, shiftv, fpst);
+                    neon_store_reg(rd, pass, tmpf);
                 }
+                tcg_temp_free_ptr(fpst);
+                tcg_temp_free_i32(shiftv);
             } else {
                 return 1;
             }
-- 
2.20.1

Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
 * don't use cpu_F0s
 * don't use tcg_gen_ld_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_st_f32 tcg_gen_st_i32
 
 #define ARM_CP_RW_BIT   (1 << 20)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         q || (rm & 1)) {
                         return 1;
                     }
-                    tmp = tcg_temp_new_i32();
-                    tmp2 = tcg_temp_new_i32();
                     fpst = get_fpstatus_ptr(true);
                     ahp = get_ahp_flag();
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+                    tmp = neon_load_reg(rm, 0);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp2 = neon_load_reg(rm, 1);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
                     tcg_gen_shli_i32(tmp2, tmp2, 16);
                     tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
+                    tcg_temp_free_i32(tmp);
+                    tmp = neon_load_reg(rm, 2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp3 = neon_load_reg(rm, 3);
                     neon_store_reg(rd, 0, tmp2);
-                    tmp2 = tcg_temp_new_i32();
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
-                    tcg_gen_shli_i32(tmp2, tmp2, 16);
-                    tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    neon_store_reg(rd, 1, tmp2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
+                    neon_store_reg(rd, 1, tmp3);
                     tcg_temp_free_i32(tmp);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
-- 
2.20.1

Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
 * don't use CPU_F0s
 * don't use tcg_gen_st_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_st_f32 tcg_gen_st_i32
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP decoder */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp = neon_load_reg(rm, 0);
                     tmp2 = neon_load_reg(rm, 1);
                     tcg_gen_ext16u_i32(tmp3, tmp);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
-                    tcg_gen_shri_i32(tmp3, tmp, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
-                    tcg_temp_free_i32(tmp);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 0, tmp3);
+                    tcg_gen_shri_i32(tmp, tmp, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
+                    neon_store_reg(rd, 1, tmp);
+                    tmp3 = tcg_temp_new_i32();
                     tcg_gen_ext16u_i32(tmp3, tmp2);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
-                    tcg_gen_shri_i32(tmp3, tmp2, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
-                    tcg_temp_free_i32(tmp2);
-                    tcg_temp_free_i32(tmp3);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 2, tmp3);
+                    tcg_gen_shri_i32(tmp2, tmp2, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
+                    neon_store_reg(rd, 3, tmp2);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
                     break;
-- 
2.20.1

Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.

cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
cpu_V1 are used by both iwmmxt and Neon.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
 TCGv_i64 cpu_exclusive_addr;
 TCGv_i64 cpu_exclusive_val;
 
-/* FIXME:  These should be removed.  */
-static TCGv_i32 cpu_F0s, cpu_F1s;
-static TCGv_i64 cpu_F0d, cpu_F1d;
-
 #include "exec/gen-icount.h"
 
 static const char * const regnames[] =
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->base.max_insns = MIN(dc->base.max_insns, bound);
     }
 
-    cpu_F0s = tcg_temp_new_i32();
-    cpu_F1s = tcg_temp_new_i32();
-    cpu_F0d = tcg_temp_new_i64();
-    cpu_F1d = tcg_temp_new_i64();
-    cpu_V0 = cpu_F0d;
-    cpu_V1 = cpu_F1d;
+    cpu_V0 = tcg_temp_new_i64();
+    cpu_V1 = tcg_temp_new_i64();
     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
     cpu_M0 = tcg_temp_new_i64();
 }
-- 
2.20.1

In several places cut and paste errors meant we were using the wrong
type for the 'arg' struct in trans_ functions called by the
decodetree decoder, because we were using the _sp version of the
struct in the _dp function.  These were harmless, because the two
structs were identical and so decodetree made them typedefs of the
same underlying structure (and we'd have had a compile error if they
were not harmless), but we should clean them up anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
     return true;
 }
 
-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
 {
     TCGv_i32 tmp;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
     return true;
 }
 
-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
 {
     uint32_t offset;
     TCGv_i32 addr;
@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     gen_helper_vfp_negd(vd, vd);
 }
 
-static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
+static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
+static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
+static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
     return true;
 }
 
-static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
+static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 {
     /*
      * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
     return true;
 }
 
-static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
+static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
     return true;
 }
 
-static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
+static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
-- 
2.20.1

The architecture permits FPUs which have only single-precision
support, not double-precision; Cortex-M4 and Cortex-M33 are
both like that. Add the necessary checks on the MVFR0 FPDP
field so that we UNDEF any double-precision instructions on
CPUs like this.

Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
VLDM/VSTM, VLDR/VSTR which take double precision registers
still exist.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
---
 target/arm/cpu.h               |  6 +++
 target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
 }
 
+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
+{
+    /* Return true if CPU supports double precision floating point */
+    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
+}
+
 /*
  * We always set the FP and SIMD FP16 fields to indicate identical
  * levels of support (assuming SIMD is implemented at all), so
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         ((a->vm | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
-- 
2.20.1