Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[PULL 00/39] target-arm queue
-Latest arm queue, half minor code cleanups and half minor
+Most of this is the Neon decodetree patches, followed by Edgar's versal cleanups.
 bug fixes.
+thanks
 -- PMM
-The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)
+The following changes since commit 2ef486e76d64436be90f7359a3071fb2a56ce835:
   Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging (2020-05-03 14:12:56 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200504
-for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:
+for you to fetch changes up to 9aefc6cf9b73f66062d2f914a0136756e7a28211:
-  target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)
+  target/arm: Move gen_ function typedefs to translate.h (2020-05-04 12:59:26 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * support large kernel images in bootloader (by avoiding
+ * Start of conversion of Neon insns to decodetree
-   putting the initrd over the top of them)
+ * versal board: support SD and RTC
- * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
+ * Implement ARMv8.2-TTS2UXN
- * arm_gicv3: Fix decoding of ID register range
+ * Make VQDMULL undefined when U=1
- * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+ * Some minor code cleanups
  * some code cleanups following on from the VFP decodetree conversion
  * Only implement doubles if the FPU supports them
    (so we now correctly model Cortex-M4, -M33 as single precision only)
 ----------------------------------------------------------------
-Peter Maydell (24):
+Edgar E. Iglesias (11):
-      hw/arm/boot: Don't assume RAM starts at address zero
+      hw/arm: versal: Remove inclusion of arm_gicv3_common.h
-      hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
+      hw/arm: versal: Move misplaced comment
-      hw/arm/boot: Avoid placing the initrd on top of the kernel
+      hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal
-      hw/arm/boot: Honour image size field in AArch64 Image format kernels
+      hw/arm: versal: Embed the UARTs into the SoC type
-      target/arm: Allow VFP and Neon to be disabled via a CPU property
+      hw/arm: versal: Embed the GEMs into the SoC type
-      target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
+      hw/arm: versal: Embed the ADMAs into the SoC type
-      hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
+      hw/arm: versal: Embed the APUs into the SoC type
-      hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
+      hw/arm: versal: Add support for SD
-      hw/intc/arm_gicv3: Fix decoding of ID register range
+      hw/arm: versal: Add support for the RTC
-      hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+      hw/arm: versal-virt: Add support for SD
-      target/arm: Move vfp_expand_imm() to translate.[ch]
+      hw/arm: versal-virt: Add support for the RTC
       target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
       target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
       target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
       target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
       target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
       target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
       target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
       target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
       target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
       target/arm: Fix typos in trans function prototypes
       target/arm: Only implement doubles if the FPU supports them
- include/hw/arm/armsse.h        |   7 ++
+Fredrik Strupe (1):
- include/hw/arm/armv7m.h        |   4 +
+      target/arm: Make VQDMULL undefined when U=1
  target/arm/cpu.h               |  12 +++
  target/arm/translate-a64.h     |   1 -
  target/arm/translate.h         |   7 ++
  hw/arm/armsse.c                |  58 +++++++---
  hw/arm/armv7m.c                |  18 ++++
  hw/arm/boot.c                  |  83 ++++++++++----
  hw/arm/musca.c                 |   8 ++
  hw/intc/arm_gicv3_dist.c       |  12 ++-
  hw/intc/arm_gicv3_redist.c     |   4 +-
  target/arm/cpu.c               | 179 ++++++++++++++++++++++++++++--
  target/arm/translate-a64.c     |  32 ------
  target/arm/translate-vfp.inc.c | 173 ++++++++++++++++++++++-------
  target/arm/translate.c         | 240 ++++++++++++++---------------------------
  target/arm/vfp.decode          |  10 +-
 files changed, 572 insertions(+), 276 deletions(-)
+Peter Maydell (25):
+      target/arm: Don't use a TLB for ARMMMUIdx_Stage2
+      target/arm: Use enum constant in get_phys_addr_lpae() call
+      target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()
+      target/arm: Implement ARMv8.2-TTS2UXN
+      target/arm: Use correct variable for setting 'max' cpu's ID_AA64DFR0
+      target/arm/translate-vfp.inc.c: Remove duplicate simd_r32 check
+      target/arm: Don't allow Thumb Neon insns without FEATURE_NEON
+      target/arm: Add stubs for AArch32 Neon decodetree
+      target/arm: Convert VCMLA (vector) to decodetree
+      target/arm: Convert VCADD (vector) to decodetree
+      target/arm: Convert V[US]DOT (vector) to decodetree
+      target/arm: Convert VFM[AS]L (vector) to decodetree
+      target/arm: Convert VCMLA (scalar) to decodetree
+      target/arm: Convert V[US]DOT (scalar) to decodetree
+      target/arm: Convert VFM[AS]L (scalar) to decodetree
+      target/arm: Convert Neon load/store multiple structures to decodetree
+      target/arm: Convert Neon 'load single structure to all lanes' to decodetree
+      target/arm: Convert Neon 'load/store single structure' to decodetree
+      target/arm: Convert Neon 3-reg-same VADD/VSUB to decodetree
+      target/arm: Convert Neon 3-reg-same logic ops to decodetree
+      target/arm: Convert Neon 3-reg-same VMAX/VMIN to decodetree
+      target/arm: Convert Neon 3-reg-same comparisons to decodetree
+      target/arm: Convert Neon 3-reg-same VQADD/VQSUB to decodetree
+      target/arm: Convert Neon 3-reg-same VMUL, VMLA, VMLS, VSHL to decodetree
+      target/arm: Move gen_ function typedefs to translate.h
+Philippe Mathieu-Daudé (2):
+      hw/arm/mps2-tz: Use TYPE_IOTKIT instead of hardcoded string
+      target/arm: Use uint64_t for midr field in CPU state struct
+ include/hw/arm/xlnx-versal.h    |  31 +-
+ target/arm/cpu-param.h          |   2 +-
+ target/arm/cpu.h                |  38 ++-
+ target/arm/translate-a64.h      |   9 -
+ target/arm/translate.h          |  26 ++
+ target/arm/neon-dp.decode       |  86 +++++
+ target/arm/neon-ls.decode       |  52 +++
+ target/arm/neon-shared.decode   |  66 ++++
+ hw/arm/mps2-tz.c                |   2 +-
+ hw/arm/xlnx-versal-virt.c       |  74 ++++-
+ hw/arm/xlnx-versal.c            | 115 +++++--
+ target/arm/cpu.c                |   3 +-
+ target/arm/cpu64.c              |   8 +-
+ target/arm/helper.c             | 183 ++++------
+ target/arm/translate-a64.c      |  17 -
+ target/arm/translate-neon.inc.c | 714 +++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-vfp.inc.c  |   6 -
+ target/arm/translate.c          | 716 +++-------------------------------------
+ target/arm/Makefile.objs        |  18 +
+files changed, 1302 insertions(+), 864 deletions(-)
+ create mode 100644 target/arm/neon-dp.decode
+ create mode 100644 target/arm/neon-ls.decode
+ create mode 100644 target/arm/neon-shared.decode
+ create mode 100644 target/arm/translate-neon.inc.c

-New patch
+[PULL 01/39] target/arm: Make VQDMULL undefined when U=1
+From: Fredrik Strupe <fredrik@strupe.net>
+According to Arm ARM, VQDMULL is only valid when U=0, while having
+U=1 is unallocated.
+Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
+Fixes: 695272dcb976 ("target-arm: Handle UNDEF cases for Neon 3-regs-different-widths")
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+                     {0, 0, 0, 0}, /* VMLSL */
+                     {0, 0, 0, 9}, /* VQDMLSL */
+                     {0, 0, 0, 0}, /* Integer VMULL */
+-                    {0, 0, 0, 1}, /* VQDMULL */
++                    {0, 0, 0, 9}, /* VQDMULL */
+                     {0, 0, 0, 0xa}, /* Polynomial VMULL */
+                     {0, 0, 0, 7}, /* Reserved: always UNDEF */
+                 };
+--
+.20.1

-New patch
+[PULL 02/39] hw/arm/mps2-tz: Use TYPE_IOTKIT instead of hardcoded string
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+By using the TYPE_* definitions for devices, we can:
+ - quickly find where devices are used with 'git-grep'
+ - easily rename a device (one-line change).
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200428154650.21991-1-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/mps2-tz.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+         exit(EXIT_FAILURE);
+     }
+-    sysbus_init_child_obj(OBJECT(machine), "iotkit", &mms->iotkit,
++    sysbus_init_child_obj(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
+                           sizeof(mms->iotkit), mmc->armsse_type);
+     iotkitdev = DEVICE(&mms->iotkit);
+     object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
+--
+.20.1

-New patch
+[PULL 03/39] target/arm: Don't use a TLB for ARMMMUIdx_Stage2
+We define ARMMMUIdx_Stage2 as being an MMU index which uses a QEMU
 TLB.  However we never actually use the TLB -- all stage 2 lookups
 are done by direct calls to get_phys_addr_lpae() followed by a
 physical address load via address_space_ld*().
 Remove Stage2 from the list of ARM MMU indexes which correspond to
 real core MMU indexes, and instead put it in the set of "NOTLB" ARM
 MMU indexes.
 This allows us to drop NB_MMU_MODES to 11.  It also means we can
 safely add support for the ARMv8.3-TTS2UXN extension, which adds
 permission bits to the stage 2 descriptors which define execute
 permission separatel for EL0 and EL1; supporting that while keeping
 Stage2 in a QEMU TLB would require us to use separate TLBs for
 "Stage2 for an EL0 access" and "Stage2 for an EL1 access", which is a
 lot of extra complication given we aren't even using the QEMU TLB.
 In the process of updating the comment on our MMU index use,
 fix a couple of other minor errors:
  * NS EL2 EL2&0 was missing from the list in the comment
  * some text hadn't been updated from when we bumped NB_MMU_MODES
    above 8
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200330210400.11724-2-peter.maydell@linaro.org
 ---
  target/arm/cpu-param.h |   2 +-
  target/arm/cpu.h       |  21 +++++---
  target/arm/helper.c    | 112 ++++-------------------------------------
 files changed, 27 insertions(+), 108 deletions(-)
 diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu-param.h
 +++ b/target/arm/cpu-param.h
@@ -XXX,XX +XXX,XX @@
  # define TARGET_PAGE_BITS_MIN  10
  #endif
 -#define NB_MMU_MODES 12
 +#define NB_MMU_MODES 11
  #endif
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
   *     handling via the TLB. The only way to do a stage 1 translation without
   *     the immediate stage 2 translation is via the ATS or AT system insns,
   *     which can be slow-pathed and always do a page table walk.
 + *     The only use of stage 2 translations is either as part of an s1+2
 + *     lookup or when loading the descriptors during a stage 1 page table walk,
 + *     and in both those cases we don't use the TLB.
   *  4. we can also safely fold together the "32 bit EL3" and "64 bit EL3"
   *     translation regimes, because they map reasonably well to each other
   *     and they can't both be active at the same time.
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
   * NS EL1 EL1&0 stage 1+2 (aka NS PL1)
   * NS EL1 EL1&0 stage 1+2 +PAN
   * NS EL0 EL2&0
 + * NS EL2 EL2&0
   * NS EL2 EL2&0 +PAN
   * NS EL2 (aka NS PL2)
   * S EL0 EL1&0 (aka S PL0)
   * S EL1 EL1&0 (not used if EL3 is 32 bit)
   * S EL1 EL1&0 +PAN
   * S EL3 (aka S PL1)
 - * NS EL1&0 stage 2
   *
 - * for a total of 12 different mmu_idx.
 + * for a total of 11 different mmu_idx.
   *
   * R profile CPUs have an MPU, but can use the same set of MMU indexes
   * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
   * are not quite the same -- different CPU types (most notably M profile
   * vs A/R profile) would like to use MMU indexes with different semantics,
   * but since we don't ever need to use all of those in a single CPU we
 - * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
 + * can avoid having to set NB_MMU_MODES to "total number of A profile MMU
 + * modes + total number of M profile MMU modes". The lower bits of
   * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
   * the same for any particular CPU.
   * Variables of type ARMMUIdx are always full values, and the core
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
      ARMMMUIdx_SE10_1_PAN = 9 | ARM_MMU_IDX_A,
      ARMMMUIdx_SE3        = 10 | ARM_MMU_IDX_A,
 -    ARMMMUIdx_Stage2     = 11 | ARM_MMU_IDX_A,
 -
      /*
       * These are not allocated TLBs and are used only for AT system
       * instructions or for the first stage of an S12 page table walk.
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
      ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
      ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
      ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
 +    /*
 +     * Not allocated a TLB: used only for second stage of an S12 page
 +     * table walk, or for descriptor loads during first stage of an S1
 +     * page table walk. Note that if we ever want to have a TLB for this
 +     * then various TLB flush insns which currently are no-ops or flush
 +     * only stage 1 MMU indexes will need to change to flush stage 2.
 +     */
 +    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
      /*
       * M-profile.
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
      TO_CORE_BIT(SE10_1),
      TO_CORE_BIT(SE10_1_PAN),
      TO_CORE_BIT(SE3),
 -    TO_CORE_BIT(Stage2),
      TO_CORE_BIT(MUser),
      TO_CORE_BIT(MPriv),
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
      tlb_flush_by_mmuidx(cs,
                          ARMMMUIdxBit_E10_1 |
                          ARMMMUIdxBit_E10_1_PAN |
 -                        ARMMMUIdxBit_E10_0 |
 -                        ARMMMUIdxBit_Stage2);
 +                        ARMMMUIdxBit_E10_0);
  }
  static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
      tlb_flush_by_mmuidx_all_cpus_synced(cs,
                                          ARMMMUIdxBit_E10_1 |
                                          ARMMMUIdxBit_E10_1_PAN |
 -                                        ARMMMUIdxBit_E10_0 |
 -                                        ARMMMUIdxBit_Stage2);
 +                                        ARMMMUIdxBit_E10_0);
  }
 -static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                            uint64_t value)
 -{
 -    /* Invalidate by IPA. This has to invalidate any structures that
 -     * contain only stage 2 translation information, but does not need
 -     * to apply to structures that contain combined stage 1 and stage 2
 -     * translation information.
 -     * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
 -     */
 -    CPUState *cs = env_cpu(env);
 -    uint64_t pageaddr;
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
 -        return;
 -    }
 -
 -    pageaddr = sextract64(value << 12, 0, 40);
 -
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);
 -}
 -
 -static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                               uint64_t value)
 -{
 -    CPUState *cs = env_cpu(env);
 -    uint64_t pageaddr;
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
 -        return;
 -    }
 -
 -    pageaddr = sextract64(value << 12, 0, 40);
 -
 -    tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             ARMMMUIdxBit_Stage2);
 -}
  static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                uint64_t value)
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
          tlb_flush_by_mmuidx(cs,
                              ARMMMUIdxBit_E10_1 |
                              ARMMMUIdxBit_E10_1_PAN |
 -                            ARMMMUIdxBit_E10_0 |
 -                            ARMMMUIdxBit_Stage2);
 +                            ARMMMUIdxBit_E10_0);
          raw_write(env, ri, value);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
          return ARMMMUIdxBit_SE10_1 |
                 ARMMMUIdxBit_SE10_1_PAN |
                 ARMMMUIdxBit_SE10_0;
 -    } else if (arm_feature(env, ARM_FEATURE_EL2)) {
 -        return ARMMMUIdxBit_E10_1 |
 -               ARMMMUIdxBit_E10_1_PAN |
 -               ARMMMUIdxBit_E10_0 |
 -               ARMMMUIdxBit_Stage2;
      } else {
          return ARMMMUIdxBit_E10_1 |
                 ARMMMUIdxBit_E10_1_PAN |
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                               ARMMMUIdxBit_SE3);
  }
 -static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                                    uint64_t value)
 -{
 -    /* Invalidate by IPA. This has to invalidate any structures that
 -     * contain only stage 2 translation information, but does not need
 -     * to apply to structures that contain combined stage 1 and stage 2
 -     * translation information.
 -     * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
 -     */
 -    ARMCPU *cpu = env_archcpu(env);
 -    CPUState *cs = CPU(cpu);
 -    uint64_t pageaddr;
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
 -        return;
 -    }
 -
 -    pageaddr = sextract64(value << 12, 0, 48);
 -
 -    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);
 -}
 -
 -static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                                      uint64_t value)
 -{
 -    CPUState *cs = env_cpu(env);
 -    uint64_t pageaddr;
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
 -        return;
 -    }
 -
 -    pageaddr = sextract64(value << 12, 0, 48);
 -
 -    tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
 -                                             ARMMMUIdxBit_Stage2);
 -}
 -
  static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                        bool isread)
  {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
        .writefn = tlbi_aa64_vae1_write },
      { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 -      .writefn = tlbi_aa64_ipas2e1is_write },
 +      .access = PL2_W, .type = ARM_CP_NOP },
      { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 -      .writefn = tlbi_aa64_ipas2e1is_write },
 +      .access = PL2_W, .type = ARM_CP_NOP },
      { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
        .access = PL2_W, .type = ARM_CP_NO_RAW,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
        .writefn = tlbi_aa64_alle1is_write },
      { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 -      .writefn = tlbi_aa64_ipas2e1_write },
 +      .access = PL2_W, .type = ARM_CP_NOP },
      { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 -      .writefn = tlbi_aa64_ipas2e1_write },
 +      .access = PL2_W, .type = ARM_CP_NOP },
      { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
        .access = PL2_W, .type = ARM_CP_NO_RAW,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
        .writefn = tlbimva_hyp_is_write },
      { .name = "TLBIIPAS2",
        .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 -      .writefn = tlbiipas2_write },
 +      .type = ARM_CP_NOP, .access = PL2_W },
      { .name = "TLBIIPAS2IS",
        .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 -      .writefn = tlbiipas2_is_write },
 +      .type = ARM_CP_NOP, .access = PL2_W },
      { .name = "TLBIIPAS2L",
        .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 -      .writefn = tlbiipas2_write },
 +      .type = ARM_CP_NOP, .access = PL2_W },
      { .name = "TLBIIPAS2LIS",
        .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 -      .writefn = tlbiipas2_is_write },
 +      .type = ARM_CP_NOP, .access = PL2_W },
      /* 32 bit cache operations */
      { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
        .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_pou_access },
 --
 .20.1

-New patch
+[PULL 04/39] target/arm: Use enum constant in get_phys_addr_lpae() call
+The access_type argument to get_phys_addr_lpae() is an MMUAccessType;
+use the enum constant MMU_DATA_LOAD rather than a literal 0 when we
+call it in S1_ptw_translate().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200330210400.11724-3-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+             pcacheattrs = &cacheattrs;
+         }
+-        ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_Stage2, &s2pa,
+-                                 &txattrs, &s2prot, &s2size, fi, pcacheattrs);
++        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
++                                 &s2pa, &txattrs, &s2prot, &s2size, fi,
++                                 pcacheattrs);
+         if (ret) {
+             assert(fi->type != ARMFault_None);
+             fi->s2addr = addr;
+--
+.20.1

-[Qemu-devel] [PULL 10/24] hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+[PULL 05/39] target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()
-The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
+For ARMv8.2-TTS2UXN, the stage 2 page table walk wants to know
-is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
+whether the stage 1 access is for EL0 or not, because whether
-if the security extension is unsupported. "Security extension
+exec permission is given can depend on whether this is an EL0
-unsupported" always implies GICD_CTLR.DS == 1, but the guest can
+or EL1 access. Add a new argument to get_phys_addr_lpae() so
-also set DS on a GIC which does support the security extension.
+the call sites can pass this information in.
-Fix the condition to correctly check the GICD_CTLR.DS bit.
 Since get_phys_addr_lpae() doesn't already have a doc comment,
 add one so we have a place to put the documentation of the
 semantics of the new s1_is_el0 argument.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200330210400.11724-4-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_dist.c | 8 +++++++-
+ target/arm/helper.c | 29 ++++++++++++++++++++++++++++-
-file changed, 7 insertions(+), 1 deletion(-)
+file changed, 28 insertions(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
+--- a/target/arm/helper.c
-+++ b/hw/intc/arm_gicv3_dist.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@
-          * ITLinesNumber == (num external irqs / 32) - 1
-          */
+ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
-         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
-+        /*
++                               bool s1_is_el0,
-+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
+                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
-+         * "security extensions not supported" always implies DS == 1,
+                                target_ulong *page_size_ptr,
-+         * so we only need to check the DS bit.
+                                ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
-+         */
+@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
+         }
--        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
-+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
++                                 false,
-             (0xf << 19) | itlinesnumber;
+                                  &s2pa, &txattrs, &s2prot, &s2size, fi,
-         return MEMTX_OK;
+                                  pcacheattrs);
          if (ret) {
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
      };
  }
 +/**
 + * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
 + *
 + * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
 + * prot and page_size may not be filled in, and the populated fsr value provides
 + * information on why the translation aborted, in the format of a long-format
 + * DFSR/IFSR fault register, with the following caveats:
 + *  * the WnR bit is never set (the caller must do this).
 + *
 + * @env: CPUARMState
 + * @address: virtual address to get physical address for
 + * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
 + * @mmu_idx: MMU index indicating required translation regime
 + * @s1_is_el0: if @mmu_idx is ARMMMUIdx_Stage2 (so this is a stage 2 page table
 + *             walk), must be true if this is stage 2 of a stage 1+2 walk for an
 + *             EL0 access). If @mmu_idx is anything else, @s1_is_el0 is ignored.
 + * @phys_ptr: set to the physical address corresponding to the virtual address
 + * @attrs: set to the memory transaction attributes to use
 + * @prot: set to the permissions for the page containing phys_ptr
 + * @page_size_ptr: set to the size of the page containing phys_ptr
 + * @fi: set to fault info if the translation fails
 + * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
 + */
  static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 MMUAccessType access_type, ARMMMUIdx mmu_idx,
 +                               bool s1_is_el0,
                                 hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                 target_ulong *page_size_ptr,
                                 ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              /* S1 is done. Now do S2 translation.  */
              ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2,
 +                                     mmu_idx == ARMMMUIdx_E10_0,
                                       phys_ptr, attrs, &s2_prot,
                                       page_size, fi,
                                       cacheattrs != NULL ? &cacheattrs2 : NULL);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
      }
+     if (regime_using_lpae_format(env, mmu_idx)) {
+-        return get_phys_addr_lpae(env, address, access_type, mmu_idx,
++        return get_phys_addr_lpae(env, address, access_type, mmu_idx, false,
+                                   phys_ptr, attrs, prot, page_size,
+                                   fi, cacheattrs);
+     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
 --
 .20.1

-[Qemu-devel] [PULL 06/24] target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
+[PULL 06/39] target/arm: Implement ARMv8.2-TTS2UXN
-Allow the DSP extension to be disabled via a CPU property for
+The ARMv8.2-TTS2UXN feature extends the XN field in stage 2
-M-profile CPUs. (A and R-profile CPUs don't have this extension
+translation table descriptors from just bit [54] to bits [54:53],
-as a defined separate optional architecture extension, so
+allowing stage 2 to control execution permissions separately for EL0
-they don't need the property.)
+and EL1. Implement the new semantics of the XN field and enable
 the feature for our 'max' CPU.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
+Message-id: 20200330210400.11724-5-peter.maydell@linaro.org
 ---
- target/arm/cpu.h |  2 ++
+ target/arm/cpu.h    | 15 +++++++++++++++
- target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
+ target/arm/cpu.c    |  1 +
-files changed, 31 insertions(+)
+ target/arm/cpu64.c  |  2 ++
  target/arm/helper.c | 37 +++++++++++++++++++++++++++++++------
 files changed, 49 insertions(+), 6 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
-     bool has_vfp;
+     return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
-     /* CPU has Neon */
+ }
-     bool has_neon;
-+    /* CPU has M-profile DSP extension */
++static inline bool isar_feature_aa32_tts2uxn(const ARMISARegisters *id)
-+    bool has_dsp;
++{
++    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, XNX) != 0;
-     /* CPU has memory protection unit */
++}
-     bool has_mpu;
++
  /*
   * 64-bit feature tests via id registers.
   */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
  }
 +static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
 +}
 +
  /*
   * Feature tests for "does this exist in either 32-bit or 64-bit?"
   */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
      return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
  }
 +static inline bool isar_feature_any_tts2uxn(const ARMISARegisters *id)
 +{
 +    return isar_feature_aa64_tts2uxn(id) || isar_feature_aa32_tts2uxn(id);
 +}
 +
  /*
   * Forward to the above feature tests given an ARMCPU pointer.
   */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
+@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
- static Property arm_cpu_has_neon_property =
+             t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+             t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+             t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
-+static Property arm_cpu_has_dsp_property =
++            t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
-+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
+             cpu->isar.id_mmfr4 = t;
          }
  #endif
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);
          t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2); /* ATS1E1 */
          t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* VMID16 */
 +        t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* TTS2UXN */
          cpu->isar.id_aa64mmfr1 = t;
          t = cpu->isar.id_aa64mmfr2;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
          u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
          u = FIELD_DP32(u, ID_MMFR4, CNP, 1); /* TTCNP */
 +        u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
          cpu->isar.id_mmfr4 = u;
          u = cpu->isar.id_aa64dfr0;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
   *
   * @env:     CPUARMState
   * @s2ap:    The 2-bit stage2 access permissions (S2AP)
 - * @xn:      XN (execute-never) bit
 + * @xn:      XN (execute-never) bits
 + * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
   */
 -static int get_S2prot(CPUARMState *env, int s2ap, int xn)
 +static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
  {
      int prot = 0;
@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn)
      if (s2ap & 2) {
          prot |= PAGE_WRITE;
      }
 -    if (!xn) {
 -        if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
 +
- static Property arm_cpu_has_mpu_property =
++    if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
-             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
++        switch (xn) {
++        case 0:
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
+             prot |= PAGE_EXEC;
 +            break;
 +        case 1:
 +            if (s1_is_el0) {
 +                prot |= PAGE_EXEC;
 +            }
 +            break;
 +        case 2:
 +            break;
 +        case 3:
 +            if (!s1_is_el0) {
 +                prot |= PAGE_EXEC;
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
 +    } else {
 +        if (!extract32(xn, 1, 1)) {
 +            if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
 +                prot |= PAGE_EXEC;
 +            }
          }
      }
+     return prot;
-+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
 +        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
 +        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
 +                                 &error_abort);
 +    }
 +
      if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          cpu->isar.mvfr0 = u;
      }
-+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+     ap = extract32(attrs, 4, 2);
-+        uint32_t u;
+-    xn = extract32(attrs, 12, 1);
-+
-+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
+     if (mmu_idx == ARMMMUIdx_Stage2) {
-+
+         ns = true;
-+        u = cpu->isar.id_isar1;
+-        *prot = get_S2prot(env, ap, xn);
-+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
++        xn = extract32(attrs, 11, 2);
-+        cpu->isar.id_isar1 = u;
++        *prot = get_S2prot(env, ap, xn, s1_is_el0);
-+
+     } else {
-+        u = cpu->isar.id_isar2;
+         ns = extract32(attrs, 3, 1);
-+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
++        xn = extract32(attrs, 12, 1);
-+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
+         pxn = extract32(attrs, 11, 1);
-+        cpu->isar.id_isar2 = u;
+         *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
-+
+     }
 +        u = cpu->isar.id_isar3;
 +        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
 +        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
 +        cpu->isar.id_isar3 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
 --
 .20.1

-New patch
+[PULL 07/39] target/arm: Use correct variable for setting 'max' cpu's ID_AA64DFR0
+In aarch64_max_initfn() we update both 32-bit and 64-bit ID
+registers.  The intended pattern is that for 64-bit ID registers we
+use FIELD_DP64 and the uint64_t 't' register, while 32-bit ID
+registers use FIELD_DP32 and the uint32_t 'u' register.  For
+ID_AA64DFR0 we accidentally used 'u', meaning that the top 32 bits of
+this 64-bit ID register would end up always zero.  Luckily at the
+moment that's what they should be anyway, so this bug has no visible
+effects.
+Use the right-sized variable.
+Fixes: 3bec78447a958d481991
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20200423110915.10527-1-peter.maydell@linaro.org
+---
+ target/arm/cpu64.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+         u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
+         cpu->isar.id_mmfr4 = u;
+-        u = cpu->isar.id_aa64dfr0;
+-        u = FIELD_DP64(u, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
+-        cpu->isar.id_aa64dfr0 = u;
++        t = cpu->isar.id_aa64dfr0;
++        t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
++        cpu->isar.id_aa64dfr0 = t;
+         u = cpu->isar.id_dfr0;
+         u = FIELD_DP32(u, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
+--
+.20.1

-[Qemu-devel] [PULL 05/24] target/arm: Allow VFP and Neon to be disabled via a CPU property
+[PULL 08/39] target/arm: Use uint64_t for midr field in CPU state struct
-Allow VFP and neon to be disabled via a CPU property. As with
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 the "pmu" property, we only allow these features to be removed
 from CPUs which have it by default, not added to CPUs which
 don't have it.
-The primary motivation here is to be able to optionally
+MIDR_EL1 is a 64-bit system register with the top 32-bit being RES0.
-create Cortex-M33 CPUs with no FPU, but we provide switches
+Represent it in QEMU's ARMCPU struct with a uint64_t, not a
-for both VFP and Neon because the two interact:
+uint32_t.
  * AArch64 can't have one without the other
  * Some ID register fields only change if both are disabled
+This fixes an error when compiling with -Werror=conversion
+because we were manipulating the register value using a
+local uint64_t variable:
+  target/arm/cpu64.c: In function ‘aarch64_max_initfn’:
+  target/arm/cpu64.c:628:21: error: conversion from ‘uint64_t’ {aka ‘long unsigned int’} to ‘uint32_t’ {aka ‘unsigned int’} may change value [-Werror=conversion]
+|         cpu->midr = t;
+        |                     ^
+and future-proofs us against a possible future architecture
+change using some of the top 32 bits.
+Suggested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
+Message-id: 20200428172634.29707-1-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h |   4 ++
+ target/arm/cpu.h | 2 +-
- target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
+ target/arm/cpu.c | 2 +-
-files changed, 148 insertions(+), 6 deletions(-)
+files changed, 2 insertions(+), 2 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
 @@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-     bool has_el3;
+         uint64_t id_aa64dfr0;
-     /* CPU has PMU (Performance Monitor Unit) */
+         uint64_t id_aa64dfr1;
-     bool has_pmu;
+     } isar;
-+    /* CPU has VFP */
+-    uint32_t midr;
-+    bool has_vfp;
++    uint64_t midr;
-+    /* CPU has Neon */
+     uint32_t revidr;
-+    bool has_neon;
+     uint32_t reset_fpsid;
+     uint32_t ctr;
      /* CPU has memory protection unit */
      bool has_mpu;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
+@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_cpus[] = {
- static Property arm_cpu_has_pmu_property =
+ static Property arm_cpu_properties[] = {
-             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
+     DEFINE_PROP_BOOL("start-powered-off", ARMCPU, start_powered_off, false),
+     DEFINE_PROP_UINT32("psci-conduit", ARMCPU, psci_conduit, 0),
-+static Property arm_cpu_has_vfp_property =
+-    DEFINE_PROP_UINT32("midr", ARMCPU, midr, 0),
-+            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
++    DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),
-+
+     DEFINE_PROP_UINT64("mp-affinity", ARMCPU,
-+static Property arm_cpu_has_neon_property =
+                         mp_affinity, ARM64_AFFINITY_INVALID),
-+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+     DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
 +
  static Property arm_cpu_has_mpu_property =
              DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
          set_feature(&cpu->env, ARM_FEATURE_PMSA);
      }
 +    /* Similarly for the VFP feature bits */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP3);
 +    }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP);
 +    }
      if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
          arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                   &error_abort);
      }
 +    /*
 +     * Allow user to turn off VFP and Neon support, but only for TCG --
 +     * KVM does not currently allow us to lie to the guest about its
 +     * ID/feature registers, so the guest always sees what the host has.
 +     */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        cpu->has_vfp = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
 +                                     &error_abort);
 +        }
 +    }
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
 +        cpu->has_neon = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
 +                                     &error_abort);
 +        }
 +    }
 +
      if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          return;
      }
 +    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
 +        cpu->has_vfp != cpu->has_neon) {
 +        /*
 +         * This is an architectural requirement for AArch64; AArch32 is
 +         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
 +         */
 +        error_setg(errp,
 +                   "AArch64 CPUs must have both VFP and Neon or neither");
 +        return;
 +    }
 +
 +    if (!cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_VFP);
 +        unset_feature(env, ARM_FEATURE_VFP3);
 +        unset_feature(env, ARM_FEATURE_VFP4);
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, FPSP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
 +        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
 +        cpu->isar.mvfr0 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
 +        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
 +        u = FIELD_DP32(u, MVFR1, FPHP, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_NEON);
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar5;
 +        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
 +        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
 +        cpu->isar.id_isar5 = u;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
 +        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon && !cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
 +        cpu->isar.mvfr0 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V5)) {
          set_feature(env, ARM_FEATURE_V4T);
      }
 -    if (arm_feature(env, ARM_FEATURE_VFP4)) {
 -        set_feature(env, ARM_FEATURE_VFP3);
 -    }
 -    if (arm_feature(env, ARM_FEATURE_VFP3)) {
 -        set_feature(env, ARM_FEATURE_VFP);
 -    }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
          set_feature(env, ARM_FEATURE_PXN);
 --
 .20.1

-New patch
+[PULL 09/39] hw/arm: versal: Remove inclusion of arm_gicv3_common.h
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Remove inclusion of arm_gicv3_common.h, this already gets
+included via xlnx-versal.h.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-2-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xlnx-versal.c | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/boot.h"
+ #include "kvm_arm.h"
+ #include "hw/misc/unimp.h"
+-#include "hw/intc/arm_gicv3_common.h"
+ #include "hw/arm/xlnx-versal.h"
+ #include "hw/char/pl011.h"
+--
+.20.1

-New patch
+[PULL 10/39] hw/arm: versal: Move misplaced comment
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Move misplaced comment.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-3-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xlnx-versal.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+         obj = object_new(XLNX_VERSAL_ACPU_TYPE);
+         if (!obj) {
+-            /* Secondary CPUs start in PSCI powered-down state */
+             error_report("Unable to create apu.cpu[%d] of type %s",
+                          i, XLNX_VERSAL_ACPU_TYPE);
+             exit(EXIT_FAILURE);
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+         object_property_set_int(obj, s->cfg.psci_conduit,
+                                 "psci-conduit", &error_abort);
+         if (i) {
++            /* Secondary CPUs start in PSCI powered-down state */
+             object_property_set_bool(obj, true,
+                                      "start-powered-off", &error_abort);
+         }
+--
+.20.1

-New patch
+[PULL 11/39] hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Fix typo xlnx-ve -> xlnx-versal.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-4-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xlnx-versal-virt.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal-virt.c
++++ b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+         psci_conduit = QEMU_PSCI_CONDUIT_SMC;
+     }
+-    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
++    sysbus_init_child_obj(OBJECT(machine), "xlnx-versal", &s->soc,
+                           sizeof(s->soc), TYPE_XLNX_VERSAL);
+     object_property_set_link(OBJECT(&s->soc), OBJECT(machine->ram),
+                              "ddr", &error_abort);
+--
+.20.1

-New patch
+[PULL 12/39] hw/arm: versal: Embed the UARTs into the SoC type
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Embed the UARTs into the SoC type.
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-5-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h |  3 ++-
+ hw/arm/xlnx-versal.c         | 12 ++++++------
+files changed, 8 insertions(+), 7 deletions(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
++#include "hw/char/pl011.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+ #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+         MemoryRegion mr_ocm;
+         struct {
+-            SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];
++            PL011State uart[XLNX_VERSAL_NR_UARTS];
+             SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
+             SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
+         } iou;
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@
+ #include "kvm_arm.h"
+ #include "hw/misc/unimp.h"
+ #include "hw/arm/xlnx-versal.h"
+-#include "hw/char/pl011.h"
+ #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
+ #define GEM_REVISION        0x40070106
+@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
+         DeviceState *dev;
+         MemoryRegion *mr;
+-        dev = qdev_create(NULL, TYPE_PL011);
+-        s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
++        sysbus_init_child_obj(OBJECT(s), name,
++                              &s->lpd.iou.uart[i], sizeof(s->lpd.iou.uart[i]),
++                              TYPE_PL011);
++        dev = DEVICE(&s->lpd.iou.uart[i]);
+         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
+-        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+         qdev_init_nofail(dev);
+-        mr = sysbus_mmio_get_region(s->lpd.iou.uart[i], 0);
++        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+         memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+-        sysbus_connect_irq(s->lpd.iou.uart[i], 0, pic[irqs[i]]);
++        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
+         g_free(name);
+     }
+ }
+--
+.20.1

-New patch
+[PULL 13/39] hw/arm: versal: Embed the GEMs into the SoC type
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Embed the GEMs into the SoC type.
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-6-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h |  3 ++-
+ hw/arm/xlnx-versal.c         | 15 ++++++++-------
+files changed, 10 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #include "hw/char/pl011.h"
++#include "hw/net/cadence_gem.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+ #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+         struct {
+             PL011State uart[XLNX_VERSAL_NR_UARTS];
+-            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
++            CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
+             SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
+         } iou;
+     } lpd;
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
+         DeviceState *dev;
+         MemoryRegion *mr;
+-        dev = qdev_create(NULL, "cadence_gem");
+-        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
+-        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
++        sysbus_init_child_obj(OBJECT(s), name,
++                              &s->lpd.iou.gem[i], sizeof(s->lpd.iou.gem[i]),
++                              TYPE_CADENCE_GEM);
++        dev = DEVICE(&s->lpd.iou.gem[i]);
+         if (nd->used) {
+             qemu_check_nic_model(nd, "cadence_gem");
+             qdev_set_nic_properties(dev, nd);
+         }
+-        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
++        object_property_set_int(OBJECT(dev),
+, "num-priority-queues",
+                                 &error_abort);
+-        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
++        object_property_set_link(OBJECT(dev),
+                                  OBJECT(&s->mr_ps), "dma",
+                                  &error_abort);
+         qdev_init_nofail(dev);
+-        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
++        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+         memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+-        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
++        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
+         g_free(name);
+     }
+ }
+--
+.20.1

-New patch
+[PULL 14/39] hw/arm: versal: Embed the ADMAs into the SoC type
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Embed the ADMAs into the SoC type.
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-7-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h |  3 ++-
+ hw/arm/xlnx-versal.c         | 14 +++++++-------
+files changed, 9 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/boot.h"
+ #include "hw/intc/arm_gicv3.h"
+ #include "hw/char/pl011.h"
++#include "hw/dma/xlnx-zdma.h"
+ #include "hw/net/cadence_gem.h"
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+         struct {
+             PL011State uart[XLNX_VERSAL_NR_UARTS];
+             CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
+-            SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
++            XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
+         } iou;
+     } lpd;
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
+         DeviceState *dev;
+         MemoryRegion *mr;
+-        dev = qdev_create(NULL, "xlnx.zdma");
+-        s->lpd.iou.adma[i] = SYS_BUS_DEVICE(dev);
+-        object_property_set_int(OBJECT(s->lpd.iou.adma[i]), 128, "bus-width",
+-                                &error_abort);
+-        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
++        sysbus_init_child_obj(OBJECT(s), name,
++                              &s->lpd.iou.adma[i], sizeof(s->lpd.iou.adma[i]),
++                              TYPE_XLNX_ZDMA);
++        dev = DEVICE(&s->lpd.iou.adma[i]);
++        object_property_set_int(OBJECT(dev), 128, "bus-width", &error_abort);
+         qdev_init_nofail(dev);
+-        mr = sysbus_mmio_get_region(s->lpd.iou.adma[i], 0);
++        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+         memory_region_add_subregion(&s->mr_ps,
+                                     MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);
+-        sysbus_connect_irq(s->lpd.iou.adma[i], 0, pic[VERSAL_ADMA_IRQ_0 + i]);
++        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_ADMA_IRQ_0 + i]);
+         g_free(name);
+     }
+ }
+--
+.20.1

-New patch
+[PULL 15/39] hw/arm: versal: Embed the APUs into the SoC type
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Embed the APUs into the SoC type.
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-8-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h |  2 +-
+ hw/arm/xlnx-versal-virt.c    |  4 ++--
+ hw/arm/xlnx-versal.c         | 19 +++++--------------
+files changed, 8 insertions(+), 17 deletions(-)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+     struct {
+         struct {
+             MemoryRegion mr;
+-            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
++            ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
+             GICv3State gic;
+         } apu;
+     } fpd;
+diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal-virt.c
++++ b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+     s->binfo.get_dtb = versal_virt_get_dtb;
+     s->binfo.modify_dtb = versal_virt_modify_dtb;
+     if (machine->kernel_filename) {
+-        arm_load_kernel(s->soc.fpd.apu.cpu[0], machine, &s->binfo);
++        arm_load_kernel(&s->soc.fpd.apu.cpu[0], machine, &s->binfo);
+     } else {
+-        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
++        AddressSpace *as = arm_boot_address_space(&s->soc.fpd.apu.cpu[0],
+                                                   &s->binfo);
+         /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
+          * Offset things by 4K.  */
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
+         Object *obj;
+-        char *name;
+-
+-        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
+-        if (!obj) {
+-            error_report("Unable to create apu.cpu[%d] of type %s",
+-                         i, XLNX_VERSAL_ACPU_TYPE);
+-            exit(EXIT_FAILURE);
+-        }
+-
+-        name = g_strdup_printf("apu-cpu[%d]", i);
+-        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
+-        g_free(name);
++        object_initialize_child(OBJECT(s), "apu-cpu[*]",
++                                &s->fpd.apu.cpu[i], sizeof(s->fpd.apu.cpu[i]),
++                                XLNX_VERSAL_ACPU_TYPE, &error_abort, NULL);
++        obj = OBJECT(&s->fpd.apu.cpu[i]);
+         object_property_set_int(obj, s->cfg.psci_conduit,
+                                 "psci-conduit", &error_abort);
+         if (i) {
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
+         object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
+                                  &error_abort);
+         object_property_set_bool(obj, true, "realized", &error_fatal);
+-        s->fpd.apu.cpu[i] = ARM_CPU(obj);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+     }
+     for (i = 0; i < nr_apu_cpus; i++) {
+-        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
++        DeviceState *cpudev = DEVICE(&s->fpd.apu.cpu[i]);
+         int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
+         qemu_irq maint_irq;
+         int ti;
+--
+.20.1

-New patch
+[PULL 16/39] hw/arm: versal: Add support for SD
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Add support for SD.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-9-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/xlnx-versal.h | 12 ++++++++++++
+ hw/arm/xlnx-versal.c         | 31 +++++++++++++++++++++++++++++++
+files changed, 43 insertions(+)
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/xlnx-versal.h
++++ b/include/hw/arm/xlnx-versal.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/sysbus.h"
+ #include "hw/arm/boot.h"
++#include "hw/sd/sdhci.h"
+ #include "hw/intc/arm_gicv3.h"
+ #include "hw/char/pl011.h"
+ #include "hw/dma/xlnx-zdma.h"
+@@ -XXX,XX +XXX,XX @@
+ #define XLNX_VERSAL_NR_UARTS   2
+ #define XLNX_VERSAL_NR_GEMS    2
+ #define XLNX_VERSAL_NR_ADMAS   8
++#define XLNX_VERSAL_NR_SDS     2
+ #define XLNX_VERSAL_NR_IRQS    192
+ typedef struct Versal {
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+         } iou;
+     } lpd;
++    /* The Platform Management Controller subsystem.  */
++    struct {
++        struct {
++            SDHCIState sd[XLNX_VERSAL_NR_SDS];
++        } iou;
++    } pmc;
++
+     struct {
+         MemoryRegion *mr_ddr;
+         uint32_t psci_conduit;
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+ #define VERSAL_GEM1_IRQ_0          58
+ #define VERSAL_GEM1_WAKE_IRQ_0     59
+ #define VERSAL_ADMA_IRQ_0          60
++#define VERSAL_SD0_IRQ_0           126
+ /* Architecturally reserved IRQs suitable for virtualization.  */
+ #define VERSAL_RSVD_IRQ_FIRST 111
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+ #define MM_FPD_CRF                  0xfd1a0000U
+ #define MM_FPD_CRF_SIZE             0x140000
++#define MM_PMC_SD0                  0xf1040000U
++#define MM_PMC_SD0_SIZE             0x10000
+ #define MM_PMC_CRP                  0xf1260000U
+ #define MM_PMC_CRP_SIZE             0x10000
+ #endif
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal.c
++++ b/hw/arm/xlnx-versal.c
+@@ -XXX,XX +XXX,XX @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
+     }
+ }
++#define SDHCI_CAPABILITIES  0x280737ec6481 /* Same as on ZynqMP.  */
++static void versal_create_sds(Versal *s, qemu_irq *pic)
++{
++    int i;
++
++    for (i = 0; i < ARRAY_SIZE(s->pmc.iou.sd); i++) {
++        DeviceState *dev;
++        MemoryRegion *mr;
++
++        sysbus_init_child_obj(OBJECT(s), "sd[*]",
++                              &s->pmc.iou.sd[i], sizeof(s->pmc.iou.sd[i]),
++                              TYPE_SYSBUS_SDHCI);
++        dev = DEVICE(&s->pmc.iou.sd[i]);
++
++        object_property_set_uint(OBJECT(dev),
++                                 3, "sd-spec-version", &error_fatal);
++        object_property_set_uint(OBJECT(dev), SDHCI_CAPABILITIES, "capareg",
++                                 &error_fatal);
++        object_property_set_uint(OBJECT(dev), UHS_I, "uhs", &error_fatal);
++        qdev_init_nofail(dev);
++
++        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
++        memory_region_add_subregion(&s->mr_ps,
++                                    MM_PMC_SD0 + i * MM_PMC_SD0_SIZE, mr);
++
++        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
++                           pic[VERSAL_SD0_IRQ_0 + i * 2]);
++    }
++}
++
+ /* This takes the board allocated linear DDR memory and creates aliases
+  * for each split DDR range/aperture on the Versal address map.
+  */
+@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+     versal_create_uarts(s, pic);
+     versal_create_gems(s, pic);
+     versal_create_admas(s, pic);
++    versal_create_sds(s, pic);
+     versal_map_ddr(s);
+     versal_unimp(s);
+--
+.20.1

-[Qemu-devel] [PULL 03/24] hw/arm/boot: Avoid placing the initrd on top of the kernel
+[PULL 17/39] hw/arm: versal: Add support for the RTC
-We currently put the initrd at the smaller of:
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
  * 128MB into RAM
  * halfway into the RAM
 (with the dtb following it).
-However for large kernels this might mean that the kernel
+hw/arm: versal: Add support for the RTC.
 overlaps the initrd. For some kinds of kernel (self-decompressing
 -bit kernels, and ELF images with a BSS section at the end)
 we don't know the exact size, but even there we have a
 minimum size. Put the initrd at least further into RAM than
 that. For image formats that can give us an exact kernel size, this
 will mean that we definitely avoid overlaying kernel and initrd.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-10-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 34 ++++++++++++++++++++--------------
+ include/hw/arm/xlnx-versal.h |  8 ++++++++
-file changed, 20 insertions(+), 14 deletions(-)
+ hw/arm/xlnx-versal.c         | 21 +++++++++++++++++++++
 files changed, 29 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/include/hw/arm/xlnx-versal.h
-+++ b/hw/arm/boot.c
++++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@
-     if (info->nb_cpus == 0)
+ #include "hw/char/pl011.h"
-         info->nb_cpus = 1;
+ #include "hw/dma/xlnx-zdma.h"
+ #include "hw/net/cadence_gem.h"
--    /*
++#include "hw/rtc/xlnx-zynqmp-rtc.h"
--     * We want to put the initrd far enough into RAM that when the
--     * kernel is uncompressed it will not clobber the initrd. However
+ #define TYPE_XLNX_VERSAL "xlnx-versal"
--     * on boards without much RAM we must ensure that we still leave
+ #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
--     * enough room for a decent sized initrd, and on boards with large
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
--     * amounts of RAM we must avoid the initrd being so far up in RAM
+         struct {
--     * that it is outside lowmem and inaccessible to the kernel.
+             SDHCIState sd[XLNX_VERSAL_NR_SDS];
--     * So for boards with less  than 256MB of RAM we put the initrd
+         } iou;
--     * halfway into RAM, and for boards with 256MB of RAM or more we put
++
--     * the initrd at 128MB.
++        XlnxZynqMPRTC rtc;
--     */
+     } pmc;
--    info->initrd_start = info->loader_start +
--        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+     struct {
--
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
-     /* Assume that raw images are linux kernels, and ELF images are not.  */
+ #define VERSAL_GEM1_IRQ_0          58
-     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
+ #define VERSAL_GEM1_WAKE_IRQ_0     59
-                                &elf_high_addr, elf_machine, as);
+ #define VERSAL_ADMA_IRQ_0          60
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
++#define VERSAL_RTC_APB_ERR_IRQ     121
  #define VERSAL_SD0_IRQ_0           126
 +#define VERSAL_RTC_ALARM_IRQ       142
 +#define VERSAL_RTC_SECONDS_IRQ     143
  /* Architecturally reserved IRQs suitable for virtualization.  */
  #define VERSAL_RSVD_IRQ_FIRST 111
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
  #define MM_PMC_SD0_SIZE             0x10000
  #define MM_PMC_CRP                  0xf1260000U
  #define MM_PMC_CRP_SIZE             0x10000
 +#define MM_PMC_RTC                  0xf12a0000
 +#define MM_PMC_RTC_SIZE             0x10000
  #endif
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_sds(Versal *s, qemu_irq *pic)
      }
+ }
-     info->entry = entry;
 +static void versal_create_rtc(Versal *s, qemu_irq *pic)
 +{
 +    SysBusDevice *sbd;
 +    MemoryRegion *mr;
 +
 +    sysbus_init_child_obj(OBJECT(s), "rtc", &s->pmc.rtc, sizeof(s->pmc.rtc),
 +                          TYPE_XLNX_ZYNQMP_RTC);
 +    sbd = SYS_BUS_DEVICE(&s->pmc.rtc);
 +    qdev_init_nofail(DEVICE(sbd));
 +
 +    mr = sysbus_mmio_get_region(sbd, 0);
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_RTC, mr);
 +
 +    /*
-+     * We want to put the initrd far enough into RAM that when the
++     * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
-+     * kernel is uncompressed it will not clobber the initrd. However
++     * supports them.
 +     * on boards without much RAM we must ensure that we still leave
 +     * enough room for a decent sized initrd, and on boards with large
 +     * amounts of RAM we must avoid the initrd being so far up in RAM
 +     * that it is outside lowmem and inaccessible to the kernel.
 +     * So for boards with less  than 256MB of RAM we put the initrd
 +     * halfway into RAM, and for boards with 256MB of RAM or more we put
 +     * the initrd at 128MB.
 +     * We also refuse to put the initrd somewhere that will definitely
 +     * overlay the kernel we just loaded, though for kernel formats which
 +     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
 +     * we might still make a bad choice here.
 +     */
-+    info->initrd_start = info->loader_start +
++    sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
-+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
++}
 +    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
 +
-     if (is_linux) {
+ /* This takes the board allocated linear DDR memory and creates aliases
-         uint32_t fixupcontext[FIXUP_MAX];
+  * for each split DDR range/aperture on the Versal address map.
   */
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
      versal_create_gems(s, pic);
      versal_create_admas(s, pic);
      versal_create_sds(s, pic);
 +    versal_create_rtc(s, pic);
      versal_map_ddr(s);
      versal_unimp(s);
 --
 .20.1

-New patch
+[PULL 18/39] hw/arm: versal-virt: Add support for SD
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Add support for SD.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-11-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xlnx-versal-virt.c | 46 +++++++++++++++++++++++++++++++++++++++
+file changed, 46 insertions(+)
+diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal-virt.c
++++ b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/arm/sysbus-fdt.h"
+ #include "hw/arm/fdt.h"
+ #include "cpu.h"
++#include "hw/qdev-properties.h"
+ #include "hw/arm/xlnx-versal.h"
+ #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_zdma_nodes(VersalVirt *s)
+     }
+ }
++static void fdt_add_sd_nodes(VersalVirt *s)
++{
++    const char clocknames[] = "clk_xin\0clk_ahb";
++    const char compat[] = "arasan,sdhci-8.9a";
++    int i;
++
++    for (i = ARRAY_SIZE(s->soc.pmc.iou.sd) - 1; i >= 0; i--) {
++        uint64_t addr = MM_PMC_SD0 + MM_PMC_SD0_SIZE * i;
++        char *name = g_strdup_printf("/sdhci@%" PRIx64, addr);
++
++        qemu_fdt_add_subnode(s->fdt, name);
++
++        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
++                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
++        qemu_fdt_setprop(s->fdt, name, "clock-names",
++                         clocknames, sizeof(clocknames));
++        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
++                               GIC_FDT_IRQ_TYPE_SPI, VERSAL_SD0_IRQ_0 + i * 2,
++                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
++        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
++                                     2, addr, 2, MM_PMC_SD0_SIZE);
++        qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
++        g_free(name);
++    }
++}
++
+ static void fdt_nop_memory_nodes(void *fdt, Error **errp)
+ {
+     Error *err = NULL;
+@@ -XXX,XX +XXX,XX @@ static void create_virtio_regions(VersalVirt *s)
+     }
+ }
++static void sd_plugin_card(SDHCIState *sd, DriveInfo *di)
++{
++    BlockBackend *blk = di ? blk_by_legacy_dinfo(di) : NULL;
++    DeviceState *card;
++
++    card = qdev_create(qdev_get_child_bus(DEVICE(sd), "sd-bus"), TYPE_SD_CARD);
++    object_property_add_child(OBJECT(sd), "card[*]", OBJECT(card),
++                              &error_fatal);
++    qdev_prop_set_drive(card, "drive", blk, &error_fatal);
++    object_property_set_bool(OBJECT(card), true, "realized", &error_fatal);
++}
++
+ static void versal_virt_init(MachineState *machine)
+ {
+     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
+     int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
++    int i;
+     /*
+      * If the user provides an Operating System to be loaded, we expect them
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+     fdt_add_gic_nodes(s);
+     fdt_add_timer_nodes(s);
+     fdt_add_zdma_nodes(s);
++    fdt_add_sd_nodes(s);
+     fdt_add_cpu_nodes(s, psci_conduit);
+     fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
+     fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+     memory_region_add_subregion_overlap(get_system_memory(),
+, &s->soc.fpd.apu.mr, 0);
++    /* Plugin SD cards.  */
++    for (i = 0; i < ARRAY_SIZE(s->soc.pmc.iou.sd); i++) {
++        sd_plugin_card(&s->soc.pmc.iou.sd[i], drive_get_next(IF_SD));
++    }
++
+     s->binfo.ram_size = machine->ram_size;
+     s->binfo.loader_start = 0x0;
+     s->binfo.get_dtb = versal_virt_get_dtb;
+--
+.20.1

-New patch
+[PULL 19/39] hw/arm: versal-virt: Add support for the RTC
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Add support for the RTC.
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20200427181649.26851-12-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/xlnx-versal-virt.c | 22 ++++++++++++++++++++++
+file changed, 22 insertions(+)
+diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/xlnx-versal-virt.c
++++ b/hw/arm/xlnx-versal-virt.c
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_sd_nodes(VersalVirt *s)
+     }
+ }
++static void fdt_add_rtc_node(VersalVirt *s)
++{
++    const char compat[] = "xlnx,zynqmp-rtc";
++    const char interrupt_names[] = "alarm\0sec";
++    char *name = g_strdup_printf("/rtc@%x", MM_PMC_RTC);
++
++    qemu_fdt_add_subnode(s->fdt, name);
++
++    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
++                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_ALARM_IRQ,
++                           GIC_FDT_IRQ_FLAGS_LEVEL_HI,
++                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_SECONDS_IRQ,
++                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
++    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
++                     interrupt_names, sizeof(interrupt_names));
++    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
++                                 2, MM_PMC_RTC, 2, MM_PMC_RTC_SIZE);
++    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
++    g_free(name);
++}
++
+ static void fdt_nop_memory_nodes(void *fdt, Error **errp)
+ {
+     Error *err = NULL;
+@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+     fdt_add_timer_nodes(s);
+     fdt_add_zdma_nodes(s);
+     fdt_add_sd_nodes(s);
++    fdt_add_rtc_node(s);
+     fdt_add_cpu_nodes(s, psci_conduit);
+     fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
+     fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
+--
+.20.1

-[Qemu-devel] [PULL 12/24] target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
+[PULL 20/39] target/arm/translate-vfp.inc.c: Remove duplicate simd_r32 check
-The AArch32 VMOV (immediate) instruction uses the same VFP encoded
+Somewhere along theline we accidentally added a duplicate
-immediate format we already handle in vfp_expand_imm().  Use that
+"using D16-D31 when they don't exist" check to do_vfm_dp()
-function rather than hand-decoding it.
+(probably an artifact of a patchseries rebase). Remove it.
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-2-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.inc.c | 28 ++++------------------------
+ target/arm/translate-vfp.inc.c | 6 ------
- target/arm/vfp.decode          | 10 ++++++----
+file changed, 6 deletions(-)
 files changed, 10 insertions(+), 28 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
-     uint32_t delta_d = 0;
+         return false;
      int veclen = s->vec_len;
      TCGv_i32 fd;
 -    uint32_t n, i, vd;
 +    uint32_t vd;
      vd = a->vd;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
          }
      }
--    n = (a->imm4h << 28) & 0x80000000;
+-    /* UNDEF accesses to D16-D31 if they don't exist. */
--    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
+-    if (!dc_isar_feature(aa32_simd_r32, s) &&
--    if (i & 0x40) {
+-        ((a->vd | a->vn | a->vm) & 0x10)) {
--        i |= 0x780;
+-        return false;
 -    } else {
 -        i |= 0x800;
 -    }
--    n |= i << 19;
 -
--    fd = tcg_temp_new_i32();
+     if (!vfp_access_check(s)) {
--    tcg_gen_movi_i32(fd, n);
+         return true;
 +    fd = tcg_const_i32(vfp_expand_imm(MO_32, a->imm));
      for (;;) {
          neon_store_reg32(fd, vd);
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
      uint32_t delta_d = 0;
      int veclen = s->vec_len;
      TCGv_i64 fd;
 -    uint32_t n, i, vd;
 +    uint32_t vd;
      vd = a->vd;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          }
      }
--    n = (a->imm4h << 28) & 0x80000000;
--    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
--    if (i & 0x40) {
--        i |= 0x3f80;
--    } else {
--        i |= 0x4000;
--    }
--    n |= i << 16;
--
--    fd = tcg_temp_new_i64();
--    tcg_gen_movi_i64(fd, ((uint64_t)n) << 32);
-+    fd = tcg_const_i64(vfp_expand_imm(MO_64, a->imm));
-     for (;;) {
-         neon_store_reg64(fd, vd);
-diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/vfp.decode
-+++ b/target/arm/vfp.decode
-@@ -XXX,XX +XXX,XX @@
- %vmov_idx_b     21:1 5:2
- %vmov_idx_h     21:1 6:1
-+%vmov_imm 16:4 0:4
-+
- # VMOV scalar to general-purpose register; note that this does
- # include some Neon cases.
- VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
-@@ -XXX,XX +XXX,XX @@ VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
- VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
-              vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
--VMOV_imm_sp  ---- 1110 1.11 imm4h:4 .... 1010 0000 imm4l:4 \
--             vd=%vd_sp
--VMOV_imm_dp  ---- 1110 1.11 imm4h:4 .... 1011 0000 imm4l:4 \
--             vd=%vd_dp
-+VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
-+             vd=%vd_sp imm=%vmov_imm
-+VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
-+             vd=%vd_dp imm=%vmov_imm
- VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
-              vd=%vd_sp vm=%vm_sp
 --
 .20.1

-[Qemu-devel] [PULL 19/24] target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
+[PULL 21/39] target/arm: Don't allow Thumb Neon insns without FEATURE_NEON
-Stop using cpu_F0s in the Neon VCVT fixed-point operations.
+We were accidentally permitting decode of Thumb Neon insns even if
 the CPU didn't have the FEATURE_NEON bit set, because the feature
 check was being done before the call to disas_neon_data_insn() and
 disas_neon_ls_insn() in the Arm decoder but was omitted from the
 Thumb decoder.  Push the feature bit check down into the called
 functions so it is done for both Arm and Thumb encodings.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-3-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 62 +++++++++++++++++++-----------------------
+ target/arm/translate.c | 16 ++++++++--------
-file changed, 28 insertions(+), 34 deletions(-)
+file changed, 8 insertions(+), 8 deletions(-)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
- /* Function prototypes for gen_ functions calling Neon helpers.  */
+     TCGv_i32 tmp2;
- typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
+     TCGv_i64 tmp64;
-                                  TCGv_i32, TCGv_i32);
-+/* Function prototypes for gen_ functions for fix point conversions */
++    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
++        return 1;
++    }
- /* initialize TCG globals.  */
++
- void arm_translate_init(void)
+     /* FIXME: this access check should not take precedence over UNDEF
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+      * for invalid encodings; we will generate incorrect syndrome information
-     return statusptr;
+      * for attempts to execute invalid vfp/neon encodings with FP disabled.
- }
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+     TCGv_ptr ptr1, ptr2, ptr3;
--#define VFP_GEN_FIX(name, round) \
+     TCGv_i64 tmp64;
--static inline void gen_vfp_##name(int dp, int shift, int neon) \
--{ \
++    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
--    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
++        return 1;
--    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
++    }
--    if (dp) { \
++
--        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
+     /* FIXME: this access check should not take precedence over UNDEF
--                                        statusptr); \
+      * for invalid encodings; we will generate incorrect syndrome information
--    } else { \
+      * for attempts to execute invalid vfp/neon encodings with FP disabled.
--        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
--                                        statusptr); \
--    } \
+         if (((insn >> 25) & 7) == 1) {
--    tcg_temp_free_i32(tmp_shift); \
+             /* NEON Data processing.  */
--    tcg_temp_free_ptr(statusptr); \
+-            if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
--}
+-                goto illegal_op;
--VFP_GEN_FIX(tosl, _round_to_zero)
+-            }
 -VFP_GEN_FIX(toul, _round_to_zero)
 -VFP_GEN_FIX(slto, )
 -VFP_GEN_FIX(ulto, )
 -#undef VFP_GEN_FIX
 -
- static inline long vfp_reg_offset(bool dp, unsigned reg)
+             if (disas_neon_data_insn(s, insn)) {
- {
+                 goto illegal_op;
-     if (dp) {
+             }
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-                 }
+         }
-             } else if (op >= 14) {
+         if ((insn & 0x0f100000) == 0x04000000) {
-                 /* VCVT fixed-point.  */
+             /* NEON load/store.  */
-+                TCGv_ptr fpst;
+-            if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-+                TCGv_i32 shiftv;
+-                goto illegal_op;
-+                VFPGenFixPointFn *fn;
+-            }
-+
+-
-                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
+             if (disas_neon_ls_insn(s, insn)) {
-                     return 1;
+                 goto illegal_op;
                  }
 +
 +                if (!(op & 1)) {
 +                    if (u) {
 +                        fn = gen_helper_vfp_ultos;
 +                    } else {
 +                        fn = gen_helper_vfp_sltos;
 +                    }
 +                } else {
 +                    if (u) {
 +                        fn = gen_helper_vfp_touls_round_to_zero;
 +                    } else {
 +                        fn = gen_helper_vfp_tosls_round_to_zero;
 +                    }
 +                }
 +
                  /* We have already masked out the must-be-1 top bit of imm6,
                   * hence this 32-shift where the ARM ARM has 64-imm6.
                   */
                  shift = 32 - shift;
 +                fpst = get_fpstatus_ptr(1);
 +                shiftv = tcg_const_i32(shift);
                  for (pass = 0; pass < (q ? 4 : 2); pass++) {
 -                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
 -                    if (!(op & 1)) {
 -                        if (u)
 -                            gen_vfp_ulto(0, shift, 1);
 -                        else
 -                            gen_vfp_slto(0, shift, 1);
 -                    } else {
 -                        if (u)
 -                            gen_vfp_toul(0, shift, 1);
 -                        else
 -                            gen_vfp_tosl(0, shift, 1);
 -                    }
 -                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
 +                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
 +                    fn(tmpf, tmpf, shiftv, fpst);
 +                    neon_store_reg(rd, pass, tmpf);
                  }
 +                tcg_temp_free_ptr(fpst);
 +                tcg_temp_free_i32(shiftv);
              } else {
                  return 1;
              }
 --
 .20.1

-[Qemu-devel] [PULL 07/24] hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
+[PULL 22/39] target/arm: Add stubs for AArch32 Neon decodetree
-Create "vfp" and "dsp" properties on the armv7m container object
+Add the infrastructure for building and invoking a decodetree decoder
-which will be forwarded to its CPU object, so that SoCs can
+for the AArch32 Neon encodings.  At the moment the new decoder covers
-configure whether the CPU has these features.
+nothing, so we always fall back to the existing hand-written decode.
 We follow the same pattern we did for the VFP decodetree conversion
 (commit 78e138bc1f672c145ef6ace74617d and following): code that deals
 with Neon will be moving gradually out to translate-neon.vfp.inc,
 which we #include into translate.c.
 In order to share the decode files between A32 and T32, we
 split Neon into 3 parts:
  * data-processing
  * load-store
  * 'shared' encodings
 The first two groups of instructions have similar but not identical
 A32 and T32 encodings, so we need to manually transform the T32
 encoding into the A32 one before calling the decoder; the third group
 covers the Neon instructions which are identical in A32 and T32.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200430181003.21682-4-peter.maydell@linaro.org
 Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
 ---
- include/hw/arm/armv7m.h |  4 ++++
+ target/arm/neon-dp.decode       | 29 ++++++++++++++++++++++++++
- hw/arm/armv7m.c         | 18 ++++++++++++++++++
+ target/arm/neon-ls.decode       | 29 ++++++++++++++++++++++++++
-files changed, 22 insertions(+)
+ target/arm/neon-shared.decode   | 27 +++++++++++++++++++++++++
+ target/arm/translate-neon.inc.c | 32 +++++++++++++++++++++++++++++
-diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
+ target/arm/translate.c          | 36 +++++++++++++++++++++++++++++++--
  target/arm/Makefile.objs        | 18 +++++++++++++++++
 files changed, 169 insertions(+), 2 deletions(-)
  create mode 100644 target/arm/neon-dp.decode
  create mode 100644 target/arm/neon-ls.decode
  create mode 100644 target/arm/neon-shared.decode
  create mode 100644 target/arm/translate-neon.inc.c
 diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
 +# AArch32 Neon data-processing instruction descriptions
 +#
 +#  Copyright (c) 2020 Linaro, Ltd
 +#
 +# This library is free software; you can redistribute it and/or
 +# modify it under the terms of the GNU Lesser General Public
 +# License as published by the Free Software Foundation; either
 +# version 2 of the License, or (at your option) any later version.
 +#
 +# This library is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# Lesser General Public License for more details.
 +#
 +# You should have received a copy of the GNU Lesser General Public
 +# License along with this library; if not, see <http://www.gnu.org/licenses/>.
 +
 +#
 +# This file is processed by scripts/decodetree.py
 +#
 +
 +# Encodings for Neon data processing instructions where the T32 encoding
 +# is a simple transformation of the A32 encoding.
 +# More specifically, this file covers instructions where the A32 encoding is
 +#   0b1111_001p_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
 +# and the T32 encoding is
 +#   0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
 +# This file works on the A32 encoding only; calling code for T32 has to
 +# transform the insn into the A32 version first.
 diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/neon-ls.decode
@@ -XXX,XX +XXX,XX @@
 +# AArch32 Neon load/store instruction descriptions
 +#
 +#  Copyright (c) 2020 Linaro, Ltd
 +#
 +# This library is free software; you can redistribute it and/or
 +# modify it under the terms of the GNU Lesser General Public
 +# License as published by the Free Software Foundation; either
 +# version 2 of the License, or (at your option) any later version.
 +#
 +# This library is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# Lesser General Public License for more details.
 +#
 +# You should have received a copy of the GNU Lesser General Public
 +# License along with this library; if not, see <http://www.gnu.org/licenses/>.
 +
 +#
 +# This file is processed by scripts/decodetree.py
 +#
 +
 +# Encodings for Neon load/store instructions where the T32 encoding
 +# is a simple transformation of the A32 encoding.
 +# More specifically, this file covers instructions where the A32 encoding is
 +#   0b1111_0100_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
 +# and the T32 encoding is
 +#   0b1111_1001_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
 +# This file works on the A32 encoding only; calling code for T32 has to
 +# transform the insn into the A32 version first.
 diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@
 +# AArch32 Neon instruction descriptions
 +#
 +#  Copyright (c) 2020 Linaro, Ltd
 +#
 +# This library is free software; you can redistribute it and/or
 +# modify it under the terms of the GNU Lesser General Public
 +# License as published by the Free Software Foundation; either
 +# version 2 of the License, or (at your option) any later version.
 +#
 +# This library is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 +# Lesser General Public License for more details.
 +#
 +# You should have received a copy of the GNU Lesser General Public
 +# License along with this library; if not, see <http://www.gnu.org/licenses/>.
 +
 +#
 +# This file is processed by scripts/decodetree.py
 +#
 +
 +# Encodings for Neon instructions whose encoding is the same for
 +# both A32 and T32.
 +
 +# More specifically, this covers:
 +# 2reg scalar ext: 0b1111_1110_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
 +# 3same ext:       0b1111_110x_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  ARM translation: AArch32 Neon instructions
 + *
 + *  Copyright (c) 2003 Fabrice Bellard
 + *  Copyright (c) 2005-2007 CodeSourcery
 + *  Copyright (c) 2007 OpenedHand, Ltd.
 + *  Copyright (c) 2020 Linaro, Ltd.
 + *
 + * This library is free software; you can redistribute it and/or
 + * modify it under the terms of the GNU Lesser General Public
 + * License as published by the Free Software Foundation; either
 + * version 2 of the License, or (at your option) any later version.
 + *
 + * This library is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 + * Lesser General Public License for more details.
 + *
 + * You should have received a copy of the GNU Lesser General Public
 + * License along with this library; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +/*
 + * This file is intended to be included from translate.c; it uses
 + * some macros and definitions provided by that file.
 + * It might be possible to convert it to a standalone .c file eventually.
 + */
 +
 +/* Include the generated Neon decoder */
 +#include "decode-neon-dp.inc.c"
 +#include "decode-neon-ls.inc.c"
 +#include "decode-neon-shared.inc.c"
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/armv7m.h
+--- a/target/arm/translate.c
-+++ b/include/hw/arm/armv7m.h
++++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-  *   devices will be automatically layered on top of this view.)
-  * + Property "idau": IDAU interface (forwarded to CPU object)
+ #define ARM_CP_RW_BIT   (1 << 20)
-  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
-+ * + Property "vfp": enable VFP (forwarded to CPU object)
+-/* Include the VFP decoder */
-+ * + Property "dsp": enable DSP (forwarded to CPU object)
++/* Include the VFP and Neon decoders */
-  * + Property "enable-bitband": expose bitbanded IO
+ #include "translate-vfp.inc.c"
-  */
++#include "translate-neon.inc.c"
- typedef struct ARMv7MState {
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
+ static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
-     uint32_t init_svtor;
+ {
-     bool enable_bitband;
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     bool start_powered_off;
+         /* Unconditional instructions.  */
-+    bool vfp;
+         /* TODO: Perhaps merge these into one decodetree output file.  */
-+    bool dsp;
+         if (disas_a32_uncond(s, insn) ||
- } ARMv7MState;
+-            disas_vfp_uncond(s, insn)) {
++            disas_vfp_uncond(s, insn) ||
- #endif
++            disas_neon_dp(s, insn) ||
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
++            disas_neon_ls(s, insn) ||
-index XXXXXXX..XXXXXXX 100644
++            disas_neon_shared(s, insn)) {
 --- a/hw/arm/armv7m.c
 +++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
              return;
          }
+         /* fall back to legacy decoder */
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+         ARCH(6T2);
      }
-+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
-+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
++    if ((insn & 0xef000000) == 0xef000000) {
-+                                 "vfp", &err);
++        /*
-+        if (err != NULL) {
++         * T32 encodings 0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
-+            error_propagate(errp, err);
++         * transform into
 +         * A32 encodings 0b1111_001p_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
 +         */
 +        uint32_t a32_insn = (insn & 0xe2ffffff) |
 +            ((insn & (1 << 28)) >> 4) | (1 << 28);
 +
 +        if (disas_neon_dp(s, a32_insn)) {
 +            return;
 +        }
 +    }
-+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
++
-+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
++    if ((insn & 0xff100000) == 0xf9000000) {
-+                                 "dsp", &err);
++        /*
-+        if (err != NULL) {
++         * T32 encodings 0b1111_1001_ppp0_qqqq_qqqq_qqqq_qqqq_qqqq
-+            error_propagate(errp, err);
++         * transform into
 +         * A32 encodings 0b1111_0100_ppp0_qqqq_qqqq_qqqq_qqqq_qqqq
 +         */
 +        uint32_t a32_insn = (insn & 0x00ffffff) | 0xf4000000;
 +
 +        if (disas_neon_ls(s, a32_insn)) {
 +            return;
 +        }
 +    }
++
      /*
-      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
+      * TODO: Perhaps merge these into one decodetree output file.
-@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
+      * Note disas_vfp is written for a32 with cond field in the
-     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
+      */
-                      false),
+     if (disas_t32(s, insn) ||
-+    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
+         disas_vfp_uncond(s, insn) ||
-+    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
++        disas_neon_shared(s, insn) ||
-     DEFINE_PROP_END_OF_LIST(),
+         ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
- };
+         return;
+     }
 diff --git a/target/arm/Makefile.objs b/target/arm/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/Makefile.objs
 +++ b/target/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ target/arm/decode-sve.inc.c: $(SRC_PATH)/target/arm/sve.decode $(DECODETREE)
        $(PYTHON) $(DECODETREE) --decode disas_sve -o $@ $<,\
        "GEN", $(TARGET_DIR)$@)
 +target/arm/decode-neon-shared.inc.c: $(SRC_PATH)/target/arm/neon-shared.decode $(DECODETREE)
 +    $(call quiet-command,\
 +      $(PYTHON) $(DECODETREE) --static-decode disas_neon_shared -o $@ $<,\
 +      "GEN", $(TARGET_DIR)$@)
 +
 +target/arm/decode-neon-dp.inc.c: $(SRC_PATH)/target/arm/neon-dp.decode $(DECODETREE)
 +    $(call quiet-command,\
 +      $(PYTHON) $(DECODETREE) --static-decode disas_neon_dp -o $@ $<,\
 +      "GEN", $(TARGET_DIR)$@)
 +
 +target/arm/decode-neon-ls.inc.c: $(SRC_PATH)/target/arm/neon-ls.decode $(DECODETREE)
 +    $(call quiet-command,\
 +      $(PYTHON) $(DECODETREE) --static-decode disas_neon_ls -o $@ $<,\
 +      "GEN", $(TARGET_DIR)$@)
 +
  target/arm/decode-vfp.inc.c: $(SRC_PATH)/target/arm/vfp.decode $(DECODETREE)
      $(call quiet-command,\
        $(PYTHON) $(DECODETREE) --static-decode disas_vfp -o $@ $<,\
@@ -XXX,XX +XXX,XX @@ target/arm/decode-t16.inc.c: $(SRC_PATH)/target/arm/t16.decode $(DECODETREE)
        "GEN", $(TARGET_DIR)$@)
  target/arm/translate-sve.o: target/arm/decode-sve.inc.c
 +target/arm/translate.o: target/arm/decode-neon-shared.inc.c
 +target/arm/translate.o: target/arm/decode-neon-dp.inc.c
 +target/arm/translate.o: target/arm/decode-neon-ls.inc.c
  target/arm/translate.o: target/arm/decode-vfp.inc.c
  target/arm/translate.o: target/arm/decode-vfp-uncond.inc.c
  target/arm/translate.o: target/arm/decode-a32.inc.c
 --
 .20.1

-[Qemu-devel] [PULL 04/24] hw/arm/boot: Honour image size field in AArch64 Image format kernels
+[PULL 23/39] target/arm: Convert VCMLA (vector) to decodetree
-Since Linux v3.17, the kernel's Image header includes a field image_size,
+Convert the VCMLA (vector) insns in the 3same extension group to
-which gives the total size of the kernel including unpopulated data
+decodetree.
 sections such as the BSS). If this is present, then return it from
 load_aarch64_image() as the true size of the kernel rather than
 just using the size of the Image file itself. This allows the code
 which calculates where to put the initrd to avoid putting it in
 the kernel's BSS area.
-This means that we should be able to reliably load kernel images
-which are larger than 128MB without accidentally putting the
-initrd or dtb in locations that clash with the kernel itself.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200430181003.21682-5-peter.maydell@linaro.org
 Tested-by: Mark Rutland <mark.rutland@arm.com>
 Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 17 +++++++++++++++--
+ target/arm/neon-shared.decode   | 11 ++++++++++
-file changed, 15 insertions(+), 2 deletions(-)
+ target/arm/translate-neon.inc.c | 37 +++++++++++++++++++++++++++++++++
  target/arm/translate.c          | 11 +---------
 files changed, 49 insertions(+), 10 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/neon-shared.decode
-+++ b/hw/arm/boot.c
++++ b/target/arm/neon-shared.decode
-@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+@@ -XXX,XX +XXX,XX @@
-                                    hwaddr *entry, AddressSpace *as)
+ # More specifically, this covers:
- {
+ # 2reg scalar ext: 0b1111_1110_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
-     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+ # 3same ext:       0b1111_110x_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
 +    uint64_t kernel_size = 0;
      uint8_t *buffer;
      int size;
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
           * is only valid if the image_size is non-zero.
           */
          memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
 -        if (hdrvals[1] != 0) {
 +
-+        kernel_size = le64_to_cpu(hdrvals[1]);
++# VFP/Neon register fields; same as vfp.decode
 +%vm_dp  5:1 0:4
 +%vm_sp  0:4 5:1
 +%vn_dp  7:1 16:4
 +%vn_sp  16:4 7:1
 +%vd_dp  22:1 12:4
 +%vd_sp  12:4 22:1
 +
-+        if (kernel_size != 0) {
++VCMLA          1111 110 rot:2 . 1 size:1 .... .... 1000 . q:1 . 0 .... \
-             kernel_load_offset = le64_to_cpu(hdrvals[0]);
++               vm=%vm_dp vn=%vn_dp vd=%vd_dp
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
-             /*
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+--- a/target/arm/translate-neon.inc.c
-         }
++++ b/target/arm/translate-neon.inc.c
-     }
+@@ -XXX,XX +XXX,XX @@
+ #include "decode-neon-dp.inc.c"
-+    /*
+ #include "decode-neon-ls.inc.c"
-+     * Kernels before v3.17 don't populate the image_size field, and
+ #include "decode-neon-shared.inc.c"
-+     * raw images have no header. For those our best guess at the size
++
-+     * is the size of the Image file itself.
++static bool trans_VCMLA(DisasContext *s, arg_VCMLA *a)
-+     */
++{
-+    if (kernel_size == 0) {
++    int opr_sz;
-+        kernel_size = size;
++    TCGv_ptr fpst;
 +    gen_helper_gvec_3_ptr *fn_gvec_ptr;
 +
 +    if (!dc_isar_feature(aa32_vcma, s)
 +        || (!a->size && !dc_isar_feature(aa32_fp16_arith, s))) {
 +        return false;
 +    }
 +
-     *entry = mem_base + kernel_load_offset;
++    /* UNDEF accesses to D16-D31 if they don't exist. */
-     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
++        ((a->vd | a->vn | a->vm) & 0x10)) {
-     g_free(buffer);
++        return false;
++    }
--    return size;
++
-+    return kernel_size;
++    if ((a->vn | a->vm | a->vd) & a->q) {
- }
++        return false;
++    }
- static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
++
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    opr_sz = (1 + a->q) * 8;
 +    fpst = get_fpstatus_ptr(1);
 +    fn_gvec_ptr = a->size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
 +    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
 +                       vfp_reg_offset(1, a->vn),
 +                       vfp_reg_offset(1, a->vm),
 +                       fpst, opr_sz, opr_sz, a->rot,
 +                       fn_gvec_ptr);
 +    tcg_temp_free_ptr(fpst);
 +    return true;
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
      bool is_long = false, q = extract32(insn, 6, 1);
      bool ptr_is_env = false;
 -    if ((insn & 0xfe200f10) == 0xfc200800) {
 -        /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
 -        int size = extract32(insn, 20, 1);
 -        data = extract32(insn, 23, 2); /* rot */
 -        if (!dc_isar_feature(aa32_vcma, s)
 -            || (!size && !dc_isar_feature(aa32_fp16_arith, s))) {
 -            return 1;
 -        }
 -        fn_gvec_ptr = size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
 -    } else if ((insn & 0xfea00f10) == 0xfc800800) {
 +    if ((insn & 0xfea00f10) == 0xfc800800) {
          /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
          int size = extract32(insn, 20, 1);
          data = extract32(insn, 24, 1); /* rot */
 --
 .20.1

-[Qemu-devel] [PULL 22/24] target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
+[PULL 24/39] target/arm: Convert VCADD (vector) to decodetree
-Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.
+Convert the VCADD (vector) insns to decodetree.
 cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
 cpu_V1 are used by both iwmmxt and Neon.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-6-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-13-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 12 ++----------
+ target/arm/neon-shared.decode   |  3 +++
-file changed, 2 insertions(+), 10 deletions(-)
+ target/arm/translate-neon.inc.c | 37 +++++++++++++++++++++++++++++++++
  target/arm/translate.c          | 11 +---------
 files changed, 41 insertions(+), 10 deletions(-)
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-shared.decode
++++ b/target/arm/neon-shared.decode
+@@ -XXX,XX +XXX,XX @@
+ VCMLA          1111 110 rot:2 . 1 size:1 .... .... 1000 . q:1 . 0 .... \
+                vm=%vm_dp vn=%vn_dp vd=%vd_dp
++
++VCADD          1111 110 rot:1 1 . 0 size:1 .... .... 1000 . q:1 . 0 .... \
++               vm=%vm_dp vn=%vn_dp vd=%vd_dp
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCMLA(DisasContext *s, arg_VCMLA *a)
+     tcg_temp_free_ptr(fpst);
+     return true;
+ }
++
++static bool trans_VCADD(DisasContext *s, arg_VCADD *a)
++{
++    int opr_sz;
++    TCGv_ptr fpst;
++    gen_helper_gvec_3_ptr *fn_gvec_ptr;
++
++    if (!dc_isar_feature(aa32_vcma, s)
++        || (!a->size && !dc_isar_feature(aa32_fp16_arith, s))) {
++        return false;
++    }
++
++    /* UNDEF accesses to D16-D31 if they don't exist. */
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
++        ((a->vd | a->vn | a->vm) & 0x10)) {
++        return false;
++    }
++
++    if ((a->vn | a->vm | a->vd) & a->q) {
++        return false;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    opr_sz = (1 + a->q) * 8;
++    fpst = get_fpstatus_ptr(1);
++    fn_gvec_ptr = a->size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
++    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
++                       vfp_reg_offset(1, a->vn),
++                       vfp_reg_offset(1, a->vm),
++                       fpst, opr_sz, opr_sz, a->rot,
++                       fn_gvec_ptr);
++    tcg_temp_free_ptr(fpst);
++    return true;
++}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
- TCGv_i64 cpu_exclusive_addr;
+     bool is_long = false, q = extract32(insn, 6, 1);
- TCGv_i64 cpu_exclusive_val;
+     bool ptr_is_env = false;
--/* FIXME:  These should be removed.  */
+-    if ((insn & 0xfea00f10) == 0xfc800800) {
--static TCGv_i32 cpu_F0s, cpu_F1s;
+-        /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
--static TCGv_i64 cpu_F0d, cpu_F1d;
+-        int size = extract32(insn, 20, 1);
--
+-        data = extract32(insn, 24, 1); /* rot */
- #include "exec/gen-icount.h"
+-        if (!dc_isar_feature(aa32_vcma, s)
+-            || (!size && !dc_isar_feature(aa32_fp16_arith, s))) {
- static const char * const regnames[] =
+-            return 1;
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+-        }
-         dc->base.max_insns = MIN(dc->base.max_insns, bound);
+-        fn_gvec_ptr = size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
-     }
+-    } else if ((insn & 0xfeb00f00) == 0xfc200d00) {
++    if ((insn & 0xfeb00f00) == 0xfc200d00) {
--    cpu_F0s = tcg_temp_new_i32();
+         /* V[US]DOT -- 1111 1100 0.10 .... .... 1101 .Q.U .... */
--    cpu_F1s = tcg_temp_new_i32();
+         bool u = extract32(insn, 4, 1);
--    cpu_F0d = tcg_temp_new_i64();
+         if (!dc_isar_feature(aa32_dp, s)) {
 -    cpu_F1d = tcg_temp_new_i64();
 -    cpu_V0 = cpu_F0d;
 -    cpu_V1 = cpu_F1d;
 +    cpu_V0 = tcg_temp_new_i64();
 +    cpu_V1 = tcg_temp_new_i64();
      /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
      cpu_M0 = tcg_temp_new_i64();
  }
 --
 .20.1

-[Qemu-devel] [PULL 24/24] target/arm: Only implement doubles if the FPU supports them
+[PULL 25/39] target/arm: Convert V[US]DOT (vector) to decodetree
-The architecture permits FPUs which have only single-precision
+Convert the V[US]DOT (vector) insns to decodetree.
 support, not double-precision; Cortex-M4 and Cortex-M33 are
 both like that. Add the necessary checks on the MVFR0 FPDP
 field so that we UNDEF any double-precision instructions on
 CPUs like this.
 Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
 VLDM/VSTM, VLDR/VSTR which take double precision registers
 still exist.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-7-peter.maydell@linaro.org
 ---
- target/arm/cpu.h               |  6 +++
+ target/arm/neon-shared.decode   |  4 ++++
- target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
+ target/arm/translate-neon.inc.c | 32 ++++++++++++++++++++++++++++++++
-files changed, 90 insertions(+)
+ target/arm/translate.c          |  9 +--------
 files changed, 37 insertions(+), 8 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/neon-shared.decode
-+++ b/target/arm/cpu.h
++++ b/target/arm/neon-shared.decode
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ VCMLA          1111 110 rot:2 . 1 size:1 .... .... 1000 . q:1 . 0 .... \
-     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
  VCADD          1111 110 rot:1 1 . 0 size:1 .... .... 1000 . q:1 . 0 .... \
                 vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +
 +# VUDOT and VSDOT
 +VDOT           1111 110 00 . 10 .... .... 1101 . q:1 . u:1 .... \
 +               vm=%vm_dp vn=%vn_dp vd=%vd_dp
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VCADD(DisasContext *s, arg_VCADD *a)
      tcg_temp_free_ptr(fpst);
      return true;
  }
++
-+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
++static bool trans_VDOT(DisasContext *s, arg_VDOT *a)
 +{
-+    /* Return true if CPU supports double precision floating point */
++    int opr_sz;
-+    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
++    gen_helper_gvec_3 *fn_gvec;
 +}
 +
- /*
++    if (!dc_isar_feature(aa32_dp, s)) {
   * We always set the FP and SIMD FP16 fields to indicate identical
   * levels of support (assuming SIMD is implemented at all), so
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
-     rd = a->vd;
++    /* UNDEF accesses to D16-D31 if they don't exist. */
-     rn = a->vn;
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
-     rm = a->vm;
++        ((a->vd | a->vn | a->vm) & 0x10)) {
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
-     rd = a->vd;
++    if ((a->vn | a->vm | a->vd) & a->q) {
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          ((a->vm | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
-     rd = a->vd;
++    if (!vfp_access_check(s)) {
-     rm = a->vm;
++        return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
      if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
-     rd = a->vd;
++    opr_sz = (1 + a->q) * 8;
-     rm = a->vm;
++    fn_gvec = a->u ? gen_helper_gvec_udot_b : gen_helper_gvec_sdot_b;
++    tcg_gen_gvec_3_ool(vfp_reg_offset(1, a->vd),
-@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
++                       vfp_reg_offset(1, a->vn),
-         return false;
++                       vfp_reg_offset(1, a->vm),
-     }
++                       opr_sz, opr_sz, 0, fn_gvec);
++    return true;
-+    if (!dc_isar_feature(aa32_fpdp, s)) {
++}
-+        return false;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-+    }
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/arm/translate.c
-     if (!dc_isar_feature(aa32_fpshvec, s) &&
++++ b/target/arm/translate.c
-         (veclen != 0 || s->vec_stride != 0)) {
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
-         return false;
+     bool is_long = false, q = extract32(insn, 6, 1);
-@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
+     bool ptr_is_env = false;
-         return false;
-     }
+-    if ((insn & 0xfeb00f00) == 0xfc200d00) {
+-        /* V[US]DOT -- 1111 1100 0.10 .... .... 1101 .Q.U .... */
-+    if (!dc_isar_feature(aa32_fpdp, s)) {
+-        bool u = extract32(insn, 4, 1);
-+        return false;
+-        if (!dc_isar_feature(aa32_dp, s)) {
-+    }
+-            return 1;
-+
+-        }
-     if (!dc_isar_feature(aa32_fpshvec, s) &&
+-        fn_gvec = u ? gen_helper_gvec_udot_b : gen_helper_gvec_sdot_b;
-         (veclen != 0 || s->vec_stride != 0)) {
+-    } else if ((insn & 0xff300f10) == 0xfc200810) {
-         return false;
++    if ((insn & 0xff300f10) == 0xfc200810) {
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
+         /* VFM[AS]L -- 1111 1100 S.10 .... .... 1000 .Q.1 .... */
-         return false;
+         int is_s = extract32(insn, 23, 1);
-     }
+         if (!dc_isar_feature(aa32_fhm, s)) {
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

-[Qemu-devel] [PULL 18/24] target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
+[PULL 26/39] target/arm: Convert VFM[AS]L (vector) to decodetree
-Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
+Convert the VFM[AS]L (vector) insns to decodetree.  This is the last
-Since this is the last user of cpu_F0s in the Neon 2rm-op
+insn in the legacy decoder for the 3same_ext group, so we can
-loop, we can remove the handling code for it too.
+delete the legacy decoder function for the group entirely.
 Note that in disas_thumb2_insn() the parts of this encoding space
 where the decodetree decoder returns false will correctly be directed
 to illegal_op by the "(insn & (1 << 28))" check so they won't fall
 into disas_coproc_insn() by mistake.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-8-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-9-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 82 ++++++++++++------------------------------
+ target/arm/neon-shared.decode   |  6 +++
-file changed, 22 insertions(+), 60 deletions(-)
+ target/arm/translate-neon.inc.c | 31 +++++++++++
  target/arm/translate.c          | 92 +--------------------------------
 files changed, 38 insertions(+), 91 deletions(-)
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-shared.decode
++++ b/target/arm/neon-shared.decode
+@@ -XXX,XX +XXX,XX @@ VCADD          1111 110 rot:1 1 . 0 size:1 .... .... 1000 . q:1 . 0 .... \
+ # VUDOT and VSDOT
+ VDOT           1111 110 00 . 10 .... .... 1101 . q:1 . u:1 .... \
+                vm=%vm_dp vn=%vn_dp vd=%vd_dp
++
++# VFM[AS]L
++VFML           1111 110 0 s:1 . 10 .... .... 1000 . 0 . 1 .... \
++               vm=%vm_sp vn=%vn_sp vd=%vd_dp q=0
++VFML           1111 110 0 s:1 . 10 .... .... 1000 . 1 . 1 .... \
++               vm=%vm_dp vn=%vn_dp vd=%vd_dp q=1
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VDOT(DisasContext *s, arg_VDOT *a)
+                        opr_sz, opr_sz, 0, fn_gvec);
+     return true;
+ }
++
++static bool trans_VFML(DisasContext *s, arg_VFML *a)
++{
++    int opr_sz;
++
++    if (!dc_isar_feature(aa32_fhm, s)) {
++        return false;
++    }
++
++    /* UNDEF accesses to D16-D31 if they don't exist. */
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
++        (a->vd & 0x10)) {
++        return false;
++    }
++
++    if (a->vd & a->q) {
++        return false;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    opr_sz = (1 + a->q) * 8;
++    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
++                       vfp_reg_offset(a->q, a->vn),
++                       vfp_reg_offset(a->q, a->vm),
++                       cpu_env, opr_sz, opr_sz, a->s, /* is_2 == 0 */
++                       gen_helper_gvec_fmlal_a32);
++    return true;
++}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-     return statusptr;
+     return 0;
  }
--#define VFP_GEN_ITOF(name) \
+-/* Advanced SIMD three registers of the same length extension.
--static inline void gen_vfp_##name(int dp, int neon) \
+- *  31           25    23  22    20   16   12  11   10   9    8        3     0
--{ \
+- * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
--    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+- * | 1 1 1 1 1 1 0 | op1 | D | op2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
--    if (dp) { \
+- * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
--        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
+- */
--    } else { \
+-static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
--        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+-{
--    } \
+-    gen_helper_gvec_3 *fn_gvec = NULL;
--    tcg_temp_free_ptr(statusptr); \
+-    gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
 -    int rd, rn, rm, opr_sz;
 -    int data = 0;
 -    int off_rn, off_rm;
 -    bool is_long = false, q = extract32(insn, 6, 1);
 -    bool ptr_is_env = false;
 -
 -    if ((insn & 0xff300f10) == 0xfc200810) {
 -        /* VFM[AS]L -- 1111 1100 S.10 .... .... 1000 .Q.1 .... */
 -        int is_s = extract32(insn, 23, 1);
 -        if (!dc_isar_feature(aa32_fhm, s)) {
 -            return 1;
 -        }
 -        is_long = true;
 -        data = is_s; /* is_2 == 0 */
 -        fn_gvec_ptr = gen_helper_gvec_fmlal_a32;
 -        ptr_is_env = true;
 -    } else {
 -        return 1;
 -    }
 -
 -    VFP_DREG_D(rd, insn);
 -    if (rd & q) {
 -        return 1;
 -    }
 -    if (q || !is_long) {
 -        VFP_DREG_N(rn, insn);
 -        VFP_DREG_M(rm, insn);
 -        if ((rn | rm) & q & !is_long) {
 -            return 1;
 -        }
 -        off_rn = vfp_reg_offset(1, rn);
 -        off_rm = vfp_reg_offset(1, rm);
 -    } else {
 -        rn = VFP_SREG_N(insn);
 -        rm = VFP_SREG_M(insn);
 -        off_rn = vfp_reg_offset(0, rn);
 -        off_rm = vfp_reg_offset(0, rm);
 -    }
 -
 -    if (s->fp_excp_el) {
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
 -        return 0;
 -    }
 -    if (!s->vfp_enabled) {
 -        return 1;
 -    }
 -
 -    opr_sz = (1 + q) * 8;
 -    if (fn_gvec_ptr) {
 -        TCGv_ptr ptr;
 -        if (ptr_is_env) {
 -            ptr = cpu_env;
 -        } else {
 -            ptr = get_fpstatus_ptr(1);
 -        }
 -        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
 -                           opr_sz, opr_sz, data, fn_gvec_ptr);
 -        if (!ptr_is_env) {
 -            tcg_temp_free_ptr(ptr);
 -        }
 -    } else {
 -        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
 -                           opr_sz, opr_sz, data, fn_gvec);
 -    }
 -    return 0;
 -}
 -
--VFP_GEN_ITOF(uito)
+ /* Advanced SIMD two registers and a scalar extension.
--VFP_GEN_ITOF(sito)
+  *  31             24   23  22   20   16   12  11   10   9    8        3     0
--#undef VFP_GEN_ITOF
+  * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
--
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
 -#define VFP_GEN_FTOI(name) \
 -static inline void gen_vfp_##name(int dp, int neon) \
 -{ \
 -    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
 -    if (dp) { \
 -        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
 -    } else { \
 -        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
 -    } \
 -    tcg_temp_free_ptr(statusptr); \
 -}
 -
 -VFP_GEN_FTOI(touiz)
 -VFP_GEN_FTOI(tosiz)
 -#undef VFP_GEN_FTOI
 -
  #define VFP_GEN_FIX(name, round) \
  static inline void gen_vfp_##name(int dp, int shift, int neon) \
  { \
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
  #define NEON_2RM_VCVT_SF 62
  #define NEON_2RM_VCVT_UF 63
 -static int neon_2rm_is_float_op(int op)
 -{
 -    /*
 -     * Return true if this neon 2reg-misc op is float-to-float.
 -     * This is not a property of the operation but of our code --
 -     * what we are asking here is "does the code for this case in
 -     * the Neon for-each-pass loop use cpu_F0s?".
 -     */
 -    return op >= NEON_2RM_VCVT_FS;
 -}
 -
  static bool neon_2rm_is_v8_op(int op)
  {
      /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                  default:
                  elementwise:
                      for (pass = 0; pass < (q ? 4 : 2); pass++) {
 -                        if (neon_2rm_is_float_op(op)) {
 -                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
 -                                           neon_reg_offset(rm, pass));
 -                            tmp = NULL;
 -                        } else {
 -                            tmp = neon_load_reg(rm, pass);
 -                        }
 +                        tmp = neon_load_reg(rm, pass);
                          switch (op) {
                          case NEON_2RM_VREV32:
                              switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                              break;
                          }
                          case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
 -                            gen_vfp_sito(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
 -                            gen_vfp_uito(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
 -                            gen_vfp_tosiz(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
 -                            gen_vfp_touiz(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          default:
                              /* Reserved op values were caught by the
                               * neon_2rm_sizes[] check earlier.
                               */
                              abort();
                          }
 -                        if (neon_2rm_is_float_op(op)) {
 -                            tcg_gen_st_f32(cpu_F0s, cpu_env,
 -                                           neon_reg_offset(rd, pass));
 -                        } else {
 -                            neon_store_reg(rd, pass, tmp);
 -                        }
 +                        neon_store_reg(rd, pass, tmp);
                      }
-                     break;
                  }
+             }
+-        } else if ((insn & 0x0e000a00) == 0x0c000800
+-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+-            if (disas_neon_insn_3same_ext(s, insn)) {
+-                goto illegal_op;
+-            }
+-            return;
+         } else if ((insn & 0x0f000a00) == 0x0e000800
+                    && arm_dc_feature(s, ARM_FEATURE_V8)) {
+             if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+             }
+             break;
+         }
+-        if ((insn & 0xfe000a00) == 0xfc000800
++        if ((insn & 0xff000a00) == 0xfe000800
+             && arm_dc_feature(s, ARM_FEATURE_V8)) {
+             /* The Thumb2 and ARM encodings are identical.  */
+-            if (disas_neon_insn_3same_ext(s, insn)) {
+-                goto illegal_op;
+-            }
+-        } else if ((insn & 0xff000a00) == 0xfe000800
+-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
+-            /* The Thumb2 and ARM encodings are identical.  */
+             if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
+                 goto illegal_op;
+             }
 --
 .20.1

-[Qemu-devel] [PULL 16/24] target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
+[PULL 27/39] target/arm: Convert VCMLA (scalar) to decodetree
-Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.
+Convert VCMLA (scalar) in the 2reg-scalar-ext group to decodetree.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-9-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-7-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 7 +++----
+ target/arm/neon-shared.decode   |  5 +++++
-file changed, 3 insertions(+), 4 deletions(-)
+ target/arm/translate-neon.inc.c | 40 +++++++++++++++++++++++++++++++++
  target/arm/translate.c          | 26 +--------------------
 files changed, 46 insertions(+), 25 deletions(-)
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-shared.decode
++++ b/target/arm/neon-shared.decode
+@@ -XXX,XX +XXX,XX @@ VFML           1111 110 0 s:1 . 10 .... .... 1000 . 0 . 1 .... \
+                vm=%vm_sp vn=%vn_sp vd=%vd_dp q=0
+ VFML           1111 110 0 s:1 . 10 .... .... 1000 . 1 . 1 .... \
+                vm=%vm_dp vn=%vn_dp vd=%vd_dp q=1
++
++VCMLA_scalar   1111 1110 0 . rot:2 .... .... 1000 . q:1 index:1 0 vm:4 \
++               vn=%vn_dp vd=%vd_dp size=0
++VCMLA_scalar   1111 1110 1 . rot:2 .... .... 1000 . q:1 . 0 .... \
++               vm=%vm_dp vn=%vn_dp vd=%vd_dp size=1 index=0
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFML(DisasContext *s, arg_VFML *a)
+                        gen_helper_gvec_fmlal_a32);
+     return true;
+ }
++
++static bool trans_VCMLA_scalar(DisasContext *s, arg_VCMLA_scalar *a)
++{
++    gen_helper_gvec_3_ptr *fn_gvec_ptr;
++    int opr_sz;
++    TCGv_ptr fpst;
++
++    if (!dc_isar_feature(aa32_vcma, s)) {
++        return false;
++    }
++    if (a->size == 0 && !dc_isar_feature(aa32_fp16_arith, s)) {
++        return false;
++    }
++
++    /* UNDEF accesses to D16-D31 if they don't exist. */
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
++        ((a->vd | a->vn | a->vm) & 0x10)) {
++        return false;
++    }
++
++    if ((a->vd | a->vn) & a->q) {
++        return false;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    fn_gvec_ptr = (a->size ? gen_helper_gvec_fcmlas_idx
++                   : gen_helper_gvec_fcmlah_idx);
++    opr_sz = (1 + a->q) * 8;
++    fpst = get_fpstatus_ptr(1);
++    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
++                       vfp_reg_offset(1, a->vn),
++                       vfp_reg_offset(1, a->vm),
++                       fpst, opr_sz, opr_sz,
++                       (a->index << 2) | a->rot, fn_gvec_ptr);
++    tcg_temp_free_ptr(fpst);
++    return true;
++}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
-      * what we are asking here is "does the code for this case in
+     bool is_long = false, q = extract32(insn, 6, 1);
-      * the Neon for-each-pass loop use cpu_F0s?".
+     bool ptr_is_env = false;
-      */
--    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
+-    if ((insn & 0xff000f10) == 0xfe000800) {
--            op >= NEON_2RM_VRECPE_F);
+-        /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
-+    return op >= NEON_2RM_VRECPE_F;
+-        int rot = extract32(insn, 20, 2);
- }
+-        int size = extract32(insn, 23, 1);
+-        int index;
- static bool neon_2rm_is_v8_op(int op)
+-
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+-        if (!dc_isar_feature(aa32_vcma, s)) {
-                                                       cpu_env);
+-            return 1;
+-        }
-                             if (is_signed) {
+-        if (size == 0) {
--                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
+-            if (!dc_isar_feature(aa32_fp16_arith, s)) {
-+                                gen_helper_vfp_tosls(tmp, tmp,
+-                return 1;
-                                                      tcg_shift, fpst);
+-            }
-                             } else {
+-            /* For fp16, rm is just Vm, and index is M.  */
--                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
+-            rm = extract32(insn, 0, 4);
-+                                gen_helper_vfp_touls(tmp, tmp,
+-            index = extract32(insn, 5, 1);
-                                                      tcg_shift, fpst);
+-        } else {
-                             }
+-            /* For fp32, rm is the usual M:Vm, and index is 0.  */
 -            VFP_DREG_M(rm, insn);
 -            index = 0;
 -        }
 -        data = (index << 2) | rot;
 -        fn_gvec_ptr = (size ? gen_helper_gvec_fcmlas_idx
 -                       : gen_helper_gvec_fcmlah_idx);
 -    } else if ((insn & 0xffb00f00) == 0xfe200d00) {
 +    if ((insn & 0xffb00f00) == 0xfe200d00) {
          /* V[US]DOT -- 1111 1110 0.10 .... .... 1101 .Q.U .... */
          int u = extract32(insn, 4, 1);
 --
 .20.1

-[Qemu-devel] [PULL 21/24] target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
+[PULL 28/39] target/arm: Convert V[US]DOT (scalar) to decodetree
-Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
+Convert the V[US]DOT (scalar) insns in the 2reg-scalar-ext group
- * don't use CPU_F0s
+to decodetree.
  * don't use tcg_gen_st_f32
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-10-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-12-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 26 +++++++++++---------------
+ target/arm/neon-shared.decode   |  3 +++
-file changed, 11 insertions(+), 15 deletions(-)
+ target/arm/translate-neon.inc.c | 35 +++++++++++++++++++++++++++++++++
  target/arm/translate.c          | 13 +-----------
 files changed, 39 insertions(+), 12 deletions(-)
+diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-shared.decode
++++ b/target/arm/neon-shared.decode
+@@ -XXX,XX +XXX,XX @@ VCMLA_scalar   1111 1110 0 . rot:2 .... .... 1000 . q:1 index:1 0 vm:4 \
+                vn=%vn_dp vd=%vd_dp size=0
+ VCMLA_scalar   1111 1110 1 . rot:2 .... .... 1000 . q:1 . 0 .... \
+                vm=%vm_dp vn=%vn_dp vd=%vd_dp size=1 index=0
++
++VDOT_scalar    1111 1110 0 . 10 .... .... 1101 . q:1 index:1 u:1 rm:4 \
++               vm=%vm_dp vn=%vn_dp vd=%vd_dp
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCMLA_scalar(DisasContext *s, arg_VCMLA_scalar *a)
+     tcg_temp_free_ptr(fpst);
+     return true;
+ }
++
++static bool trans_VDOT_scalar(DisasContext *s, arg_VDOT_scalar *a)
++{
++    gen_helper_gvec_3 *fn_gvec;
++    int opr_sz;
++    TCGv_ptr fpst;
++
++    if (!dc_isar_feature(aa32_dp, s)) {
++        return false;
++    }
++
++    /* UNDEF accesses to D16-D31 if they don't exist. */
++    if (!dc_isar_feature(aa32_simd_r32, s) &&
++        ((a->vd | a->vn) & 0x10)) {
++        return false;
++    }
++
++    if ((a->vd | a->vn) & a->q) {
++        return false;
++    }
++
++    if (!vfp_access_check(s)) {
++        return true;
++    }
++
++    fn_gvec = a->u ? gen_helper_gvec_udot_idx_b : gen_helper_gvec_sdot_idx_b;
++    opr_sz = (1 + a->q) * 8;
++    fpst = get_fpstatus_ptr(1);
++    tcg_gen_gvec_3_ool(vfp_reg_offset(1, a->vd),
++                       vfp_reg_offset(1, a->vn),
++                       vfp_reg_offset(1, a->rm),
++                       opr_sz, opr_sz, a->index, fn_gvec);
++    tcg_temp_free_ptr(fpst);
++    return true;
++}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
-     return ret;
+     bool is_long = false, q = extract32(insn, 6, 1);
- }
+     bool ptr_is_env = false;
--#define tcg_gen_st_f32 tcg_gen_st_i32
+-    if ((insn & 0xffb00f00) == 0xfe200d00) {
 -        /* V[US]DOT -- 1111 1110 0.10 .... .... 1101 .Q.U .... */
 -        int u = extract32(insn, 4, 1);
 -
- #define ARM_CP_RW_BIT   (1 << 20)
+-        if (!dc_isar_feature(aa32_dp, s)) {
+-            return 1;
- /* Include the VFP decoder */
+-        }
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+-        fn_gvec = u ? gen_helper_gvec_udot_idx_b : gen_helper_gvec_sdot_idx_b;
-                     tmp = neon_load_reg(rm, 0);
+-        /* rm is just Vm, and index is M.  */
-                     tmp2 = neon_load_reg(rm, 1);
+-        data = extract32(insn, 5, 1); /* index */
-                     tcg_gen_ext16u_i32(tmp3, tmp);
+-        rm = extract32(insn, 0, 4);
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+-    } else if ((insn & 0xffa00f10) == 0xfe000810) {
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
++    if ((insn & 0xffa00f10) == 0xfe000810) {
--                    tcg_gen_shri_i32(tmp3, tmp, 16);
+         /* VFM[AS]L -- 1111 1110 0.0S .... .... 1000 .Q.1 .... */
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
+         int is_s = extract32(insn, 20, 1);
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
+         int vm20 = extract32(insn, 0, 3);
 -                    tcg_temp_free_i32(tmp);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
 +                    neon_store_reg(rd, 0, tmp3);
 +                    tcg_gen_shri_i32(tmp, tmp, 16);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
 +                    neon_store_reg(rd, 1, tmp);
 +                    tmp3 = tcg_temp_new_i32();
                      tcg_gen_ext16u_i32(tmp3, tmp2);
 -                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
 -                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
 -                    tcg_gen_shri_i32(tmp3, tmp2, 16);
 -                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
 -                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
 -                    tcg_temp_free_i32(tmp2);
 -                    tcg_temp_free_i32(tmp3);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
 +                    neon_store_reg(rd, 2, tmp3);
 +                    tcg_gen_shri_i32(tmp2, tmp2, 16);
 +                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
 +                    neon_store_reg(rd, 3, tmp2);
                      tcg_temp_free_i32(ahp);
                      tcg_temp_free_ptr(fpst);
                      break;
 --
 .20.1

-[Qemu-devel] [PULL 14/24] target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
+[PULL 29/39] target/arm: Convert VFM[AS]L (scalar) to decodetree
-Switch NEON_2RM_VABS_F away from using cpu_F0s.
+Convert the VFM[AS]L (scalar) insns in the 2reg-scalar-ext group
 to decodetree. These are the last ones in the group so we can remove
 all the legacy decode for the group.
 Note that in disas_thumb2_insn() the parts of this encoding space
 where the decodetree decoder returns false will correctly be directed
 to illegal_op by the "(insn & (1 << 28))" check so they won't fall
 into disas_coproc_insn() by mistake.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-11-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-5-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 13 ++-----------
+ target/arm/neon-shared.decode   |   7 +++
-file changed, 2 insertions(+), 11 deletions(-)
+ target/arm/translate-neon.inc.c |  32 ++++++++++
+ target/arm/translate.c          | 107 +-------------------------------
 files changed, 40 insertions(+), 106 deletions(-)
 diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/neon-shared.decode
 +++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@ VCMLA_scalar   1111 1110 1 . rot:2 .... .... 1000 . q:1 . 0 .... \
  VDOT_scalar    1111 1110 0 . 10 .... .... 1101 . q:1 index:1 u:1 rm:4 \
                 vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +
 +%vfml_scalar_q0_rm 0:3 5:1
 +%vfml_scalar_q1_index 5:1 3:1
 +VFML_scalar    1111 1110 0 . 0 s:1 .... .... 1000 . 0 . 1 index:1 ... \
 +               rm=%vfml_scalar_q0_rm vn=%vn_sp vd=%vd_dp q=0
 +VFML_scalar    1111 1110 0 . 0 s:1 .... .... 1000 . 1 . 1 . rm:3 \
 +               index=%vfml_scalar_q1_index vn=%vn_dp vd=%vd_dp q=1
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VDOT_scalar(DisasContext *s, arg_VDOT_scalar *a)
      tcg_temp_free_ptr(fpst);
      return true;
  }
 +
 +static bool trans_VFML_scalar(DisasContext *s, arg_VFML_scalar *a)
 +{
 +    int opr_sz;
 +
 +    if (!dc_isar_feature(aa32_fhm, s)) {
 +        return false;
 +    }
 +
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vd & 0x10) || (a->q && (a->vn & 0x10)))) {
 +        return false;
 +    }
 +
 +    if (a->vd & a->q) {
 +        return false;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    opr_sz = (1 + a->q) * 8;
 +    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
 +                       vfp_reg_offset(a->q, a->vn),
 +                       vfp_reg_offset(a->q, a->rm),
 +                       cpu_env, opr_sz, opr_sz,
 +                       (a->index << 2) | a->s, /* is_2 == 0 */
 +                       gen_helper_gvec_fmlal_idx_a32);
 +    return true;
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
      return statusptr;
  }
--static inline void gen_vfp_neg(int dp)
+ #define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
 -#define VFP_SREG(insn, bigbit, smallbit) \
 -  ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
  #define VFP_DREG(reg, insn, bigbit, smallbit) do { \
      if (dc_isar_feature(aa32_simd_r32, s)) { \
          reg = (((insn) >> (bigbit)) & 0x0f) \
@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
          reg = ((insn) >> (bigbit)) & 0x0f; \
      }} while (0)
 -#define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
  #define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
 -#define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
  #define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
 -#define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
  #define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
  static void gen_neon_dup_low16(TCGv_i32 var)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
      return 0;
  }
 -/* Advanced SIMD two registers and a scalar extension.
 - *  31             24   23  22   20   16   12  11   10   9    8        3     0
 - * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
 - * | 1 1 1 1 1 1 1 0 | o1 | D | o2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
 - * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
 - *
 - */
 -
 -static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
 -{
--    if (dp)
+-    gen_helper_gvec_3 *fn_gvec = NULL;
--        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
+-    gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
--    else
+-    int rd, rn, rm, opr_sz, data;
--        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
+-    int off_rn, off_rm;
 -    bool is_long = false, q = extract32(insn, 6, 1);
 -    bool ptr_is_env = false;
 -
 -    if ((insn & 0xffa00f10) == 0xfe000810) {
 -        /* VFM[AS]L -- 1111 1110 0.0S .... .... 1000 .Q.1 .... */
 -        int is_s = extract32(insn, 20, 1);
 -        int vm20 = extract32(insn, 0, 3);
 -        int vm3 = extract32(insn, 3, 1);
 -        int m = extract32(insn, 5, 1);
 -        int index;
 -
 -        if (!dc_isar_feature(aa32_fhm, s)) {
 -            return 1;
 -        }
 -        if (q) {
 -            rm = vm20;
 -            index = m * 2 + vm3;
 -        } else {
 -            rm = vm20 * 2 + m;
 -            index = vm3;
 -        }
 -        is_long = true;
 -        data = (index << 2) | is_s; /* is_2 == 0 */
 -        fn_gvec_ptr = gen_helper_gvec_fmlal_idx_a32;
 -        ptr_is_env = true;
 -    } else {
 -        return 1;
 -    }
 -
 -    VFP_DREG_D(rd, insn);
 -    if (rd & q) {
 -        return 1;
 -    }
 -    if (q || !is_long) {
 -        VFP_DREG_N(rn, insn);
 -        if (rn & q & !is_long) {
 -            return 1;
 -        }
 -        off_rn = vfp_reg_offset(1, rn);
 -        off_rm = vfp_reg_offset(1, rm);
 -    } else {
 -        rn = VFP_SREG_N(insn);
 -        off_rn = vfp_reg_offset(0, rn);
 -        off_rm = vfp_reg_offset(0, rm);
 -    }
 -    if (s->fp_excp_el) {
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
 -        return 0;
 -    }
 -    if (!s->vfp_enabled) {
 -        return 1;
 -    }
 -
 -    opr_sz = (1 + q) * 8;
 -    if (fn_gvec_ptr) {
 -        TCGv_ptr ptr;
 -        if (ptr_is_env) {
 -            ptr = cpu_env;
 -        } else {
 -            ptr = get_fpstatus_ptr(1);
 -        }
 -        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
 -                           opr_sz, opr_sz, data, fn_gvec_ptr);
 -        if (!ptr_is_env) {
 -            tcg_temp_free_ptr(ptr);
 -        }
 -    } else {
 -        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
 -                           opr_sz, opr_sz, data, fn_gvec);
 -    }
 -    return 0;
 -}
 -
- #define VFP_GEN_ITOF(name) \
+ static int disas_coproc_insn(DisasContext *s, uint32_t insn)
- static inline void gen_vfp_##name(int dp, int neon) \
+ {
- { \
+     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-      * what we are asking here is "does the code for this case in
+                     }
-      * the Neon for-each-pass loop use cpu_F0s?".
+                 }
-      */
+             }
--    return (op == NEON_2RM_VNEG_F ||
+-        } else if ((insn & 0x0f000a00) == 0x0e000800
--            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
-+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+-            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
-             op == NEON_2RM_VRINTM ||
+-                goto illegal_op;
-             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+-            }
-             op >= NEON_2RM_VRECPE_F);
+-            return;
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+         }
-                             gen_helper_vfp_abss(tmp, tmp);
+         goto illegal_op;
-                             break;
+     }
-                         case NEON_2RM_VNEG_F:
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
--                            gen_vfp_neg(0);
+             }
-+                            gen_helper_vfp_negs(tmp, tmp);
+             break;
-                             break;
+         }
-                         case NEON_2RM_VSWP:
+-        if ((insn & 0xff000a00) == 0xfe000800
-                             tmp2 = neon_load_reg(rd, pass);
+-            && arm_dc_feature(s, ARM_FEATURE_V8)) {
 -            /* The Thumb2 and ARM encodings are identical.  */
 -            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
 -                goto illegal_op;
 -            }
 -        } else if (((insn >> 24) & 3) == 3) {
 +        if (((insn >> 24) & 3) == 3) {
              /* Translate into the equivalent ARM encoding.  */
              insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
              if (disas_neon_data_insn(s, insn)) {
 --
 .20.1

-[Qemu-devel] [PULL 08/24] hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
+[PULL 30/39] target/arm: Convert Neon load/store multiple structures to decodetree
-The SSE-200 hardware has configurable integration settings which
+Convert the Neon "load/store multiple structures" insns to decodetree.
 determine whether its two CPUs have the FPU and DSP:
  * CPU0_FPU (default 0)
  * CPU0_DSP (default 0)
  * CPU1_FPU (default 1)
  * CPU1_DSP (default 1)
 Similarly, the IoTKit has settings for its single CPU:
  * CPU0_FPU (default 1)
  * CPU0_DSP (default 1)
 Of our four boards that use either the IoTKit or the SSE-200:
  * mps2-an505, mps2-an521 and musca-a use the default settings
  * musca-b1 enables FPU and DSP on both CPUs
 Currently QEMU models all these boards using CPUs with
 both FPU and DSP enabled. This means that we are incorrect
 for mps2-an521 and musca-a, which should not have FPU or DSP
 on CPU0.
 Create QOM properties on the ARMSSE devices corresponding to the
 default h/w integration settings, and make the Musca-B1 board
 enable FPU and DSP on both CPUs. This fixes the mps2-an521
 and musca-a behaviour, and leaves the musca-b1 and mps2-an505
 behaviour unchanged.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-12-peter.maydell@linaro.org
 ---
- include/hw/arm/armsse.h |  7 +++++
+ target/arm/neon-ls.decode       |   7 ++
- hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
+ target/arm/translate-neon.inc.c | 124 ++++++++++++++++++++++++++++++++
- hw/arm/musca.c          |  8 ++++++
+ target/arm/translate.c          |  91 +----------------------
-files changed, 61 insertions(+), 12 deletions(-)
+files changed, 133 insertions(+), 89 deletions(-)
-diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
+diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/armsse.h
+--- a/target/arm/neon-ls.decode
-+++ b/include/hw/arm/armsse.h
++++ b/target/arm/neon-ls.decode
 @@ -XXX,XX +XXX,XX @@
-  *    address of each SRAM bank (and thus the total amount of internal SRAM)
+ #   0b1111_1001_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
-  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
+ # This file works on the A32 encoding only; calling code for T32 has to
-  *    (where it expects to load the PC and SP from the vector table on reset)
+ # transform the insn into the A32 version first.
-+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
++
-+ *    set whether the CPUs have the FPU and DSP features present. The default
++%vd_dp  22:1 12:4
-+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
++
-+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
++# Neon load/store multiple structures
-+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
++
-  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
++VLDST_multiple 1111 0100 0 . l:1 0 rn:4 .... itype:4 size:2 align:2 rm:4 \
-  *    which are wired to its NVIC lines 32 .. n+32
++               vd=%vd_dp
-  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
      uint32_t mainclk_frq;
      uint32_t sram_addr_width;
      uint32_t init_svtor;
 +    bool cpu_fpu[SSE_MAX_CPUS];
 +    bool cpu_dsp[SSE_MAX_CPUS];
  } ARMSSE;
  typedef struct ARMSSEInfo ARMSSEInfo;
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armsse.c
+--- a/target/arm/translate-neon.inc.c
-+++ b/hw/arm/armsse.c
++++ b/target/arm/translate-neon.inc.c
-@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
+@@ -XXX,XX +XXX,XX @@ static bool trans_VFML_scalar(DisasContext *s, arg_VFML_scalar *a)
-     bool has_cachectrl;
+                        gen_helper_gvec_fmlal_idx_a32);
-     bool has_cpusecctrl;
+     return true;
-     bool has_cpuid;
+ }
-+    Property *props;
++
 +static struct {
 +    int nregs;
 +    int interleave;
 +    int spacing;
 +} const neon_ls_element_type[11] = {
 +    {1, 4, 1},
 +    {1, 4, 2},
 +    {4, 1, 1},
 +    {2, 2, 2},
 +    {1, 3, 1},
 +    {1, 3, 2},
 +    {3, 1, 1},
 +    {1, 1, 1},
 +    {1, 2, 1},
 +    {1, 2, 2},
 +    {2, 1, 1}
 +};
 +
-+static Property iotkit_properties[] = {
++static void gen_neon_ldst_base_update(DisasContext *s, int rm, int rn,
-+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
++                                      int stride)
-+                     MemoryRegion *),
++{
-+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
++    if (rm != 15) {
-+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++        TCGv_i32 base;
-+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
++
-+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
++        base = load_reg(s, rn);
-+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
++        if (rm == 13) {
-+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
++            tcg_gen_addi_i32(base, base, stride);
-+    DEFINE_PROP_END_OF_LIST()
++        } else {
-+};
++            TCGv_i32 index;
-+
++            index = load_reg(s, rm);
-+static Property armsse_properties[] = {
++            tcg_gen_add_i32(base, base, index);
-+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
++            tcg_temp_free_i32(index);
-+                     MemoryRegion *),
++        }
-+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
++        store_reg(s, rn, base);
-+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
++    }
-+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
++}
-+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
++
-+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
++static bool trans_VLDST_multiple(DisasContext *s, arg_VLDST_multiple *a)
-+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
++{
-+    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
++    /* Neon load/store multiple structures */
-+    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
++    int nregs, interleave, spacing, reg, n;
-+    DEFINE_PROP_END_OF_LIST()
++    MemOp endian = s->be_data;
- };
++    int mmu_idx = get_mem_index(s);
++    int size = a->size;
- static const ARMSSEInfo armsse_variants[] = {
++    TCGv_i64 tmp64;
-@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
++    TCGv_i32 addr, tmp;
-         .has_cachectrl = false,
++
-         .has_cpusecctrl = false,
++    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-         .has_cpuid = false,
++        return false;
-+        .props = iotkit_properties,
++    }
-     },
++
-     {
++    /* UNDEF accesses to D16-D31 if they don't exist */
-         .name = TYPE_SSE200,
++    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
-@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
++        return false;
-         .has_cachectrl = true,
++    }
-         .has_cpusecctrl = true,
++    if (a->itype > 10) {
-         .has_cpuid = true,
++        return false;
-+        .props = armsse_properties,
++    }
-     },
++    /* Catch UNDEF cases for bad values of align field */
- };
++    switch (a->itype & 0xc) {
++    case 4:
-@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
++        if (a->align >= 2) {
-                 return;
++            return false;
-             }
++        }
-         }
++        break;
-+        if (!s->cpu_fpu[i]) {
++    case 8:
-+            object_property_set_bool(cpuobj, false, "vfp", &err);
++        if (a->align == 3) {
-+            if (err) {
++            return false;
-+                error_propagate(errp, err);
++        }
-+                return;
++        break;
 +    default:
 +        break;
 +    }
 +    nregs = neon_ls_element_type[a->itype].nregs;
 +    interleave = neon_ls_element_type[a->itype].interleave;
 +    spacing = neon_ls_element_type[a->itype].spacing;
 +    if (size == 3 && (interleave | spacing) != 1) {
 +        return false;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    /* For our purposes, bytes are always little-endian.  */
 +    if (size == 0) {
 +        endian = MO_LE;
 +    }
 +    /*
 +     * Consecutive little-endian elements from a single register
 +     * can be promoted to a larger little-endian operation.
 +     */
 +    if (interleave == 1 && endian == MO_LE) {
 +        size = 3;
 +    }
 +    tmp64 = tcg_temp_new_i64();
 +    addr = tcg_temp_new_i32();
 +    tmp = tcg_const_i32(1 << size);
 +    load_reg_var(s, addr, a->rn);
 +    for (reg = 0; reg < nregs; reg++) {
 +        for (n = 0; n < 8 >> size; n++) {
 +            int xs;
 +            for (xs = 0; xs < interleave; xs++) {
 +                int tt = a->vd + reg + spacing * xs;
 +
 +                if (a->l) {
 +                    gen_aa32_ld_i64(s, tmp64, addr, mmu_idx, endian | size);
 +                    neon_store_element64(tt, n, size, tmp64);
 +                } else {
 +                    neon_load_element64(tmp64, tt, n, size);
 +                    gen_aa32_st_i64(s, tmp64, addr, mmu_idx, endian | size);
 +                }
 +                tcg_gen_add_i32(addr, addr, tmp);
 +            }
 +        }
-+        if (!s->cpu_dsp[i]) {
++    }
-+            object_property_set_bool(cpuobj, false, "dsp", &err);
++    tcg_temp_free_i32(addr);
-+            if (err) {
++    tcg_temp_free_i32(tmp);
-+                error_propagate(errp, err);
++    tcg_temp_free_i64(tmp64);
-+                return;
++
-+            }
++    gen_neon_ldst_base_update(s, a->rm, a->rn, nregs * interleave * 8);
-+        }
++    return true;
++}
-         if (i > 0) {
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
+--- a/target/arm/translate.c
-     }
++++ b/target/arm/translate.c
- };
+@@ -XXX,XX +XXX,XX @@ static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
+ }
--static Property armsse_properties[] = {
--    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
--                     MemoryRegion *),
+-static struct {
--    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+-    int nregs;
--    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+-    int interleave;
--    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+-    int spacing;
--    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+-} const neon_ls_element_type[11] = {
--    DEFINE_PROP_END_OF_LIST()
+-    {1, 4, 1},
 -    {1, 4, 2},
 -    {4, 1, 1},
 -    {2, 2, 2},
 -    {1, 3, 1},
 -    {1, 3, 2},
 -    {3, 1, 1},
 -    {1, 1, 1},
 -    {1, 2, 1},
 -    {1, 2, 2},
 -    {2, 1, 1}
 -};
 -
- static void armsse_reset(DeviceState *dev)
+ /* Translate a NEON load/store element instruction.  Return nonzero if the
     instruction is invalid.  */
  static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
  {
-     ARMSSE *s = ARMSSE(dev);
+     int rd, rn, rm;
-@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
+-    int op;
-     DeviceClass *dc = DEVICE_CLASS(klass);
+     int nregs;
-     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
+-    int interleave;
-     ARMSSEClass *asc = ARMSSE_CLASS(klass);
+-    int spacing;
-+    const ARMSSEInfo *info = data;
+     int stride;
+     int size;
-     dc->realize = armsse_realize;
+     int reg;
-     dc->vmsd = &armsse_vmstate;
+     int load;
--    dc->props = armsse_properties;
+-    int n;
-+    dc->props = info->props;
+     int vec_size;
-     dc->reset = armsse_reset;
+-    int mmu_idx;
-     iic->check = armsse_idau_check;
+-    MemOp endian;
--    asc->info = data;
+     TCGv_i32 addr;
-+    asc->info = info;
+     TCGv_i32 tmp;
- }
+-    TCGv_i32 tmp2;
+-    TCGv_i64 tmp64;
- static const TypeInfo armsse_info = {
-diff --git a/hw/arm/musca.c b/hw/arm/musca.c
+     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-index XXXXXXX..XXXXXXX 100644
+         return 1;
---- a/hw/arm/musca.c
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
-+++ b/hw/arm/musca.c
+     rn = (insn >> 16) & 0xf;
-@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
+     rm = insn & 0xf;
-     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
+     load = (insn & (1 << 21)) != 0;
-     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
+-    endian = s->be_data;
-     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+-    mmu_idx = get_mem_index(s);
-+    /*
+     if ((insn & (1 << 23)) == 0) {
-+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+-        /* Load store all elements.  */
-+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+-        op = (insn >> 8) & 0xf;
-+     */
+-        size = (insn >> 6) & 3;
-+    if (mmc->type == MUSCA_B1) {
+-        if (op > 10)
-+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
+-            return 1;
-+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
+-        /* Catch UNDEF cases for bad values of align field */
-+    }
+-        switch (op & 0xc) {
-     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
+-        case 4:
-                              &error_fatal);
+-            if (((insn >> 5) & 1) == 1) {
+-                return 1;
 -            }
 -            break;
 -        case 8:
 -            if (((insn >> 4) & 3) == 3) {
 -                return 1;
 -            }
 -            break;
 -        default:
 -            break;
 -        }
 -        nregs = neon_ls_element_type[op].nregs;
 -        interleave = neon_ls_element_type[op].interleave;
 -        spacing = neon_ls_element_type[op].spacing;
 -        if (size == 3 && (interleave | spacing) != 1) {
 -            return 1;
 -        }
 -        /* For our purposes, bytes are always little-endian.  */
 -        if (size == 0) {
 -            endian = MO_LE;
 -        }
 -        /* Consecutive little-endian elements from a single register
 -         * can be promoted to a larger little-endian operation.
 -         */
 -        if (interleave == 1 && endian == MO_LE) {
 -            size = 3;
 -        }
 -        tmp64 = tcg_temp_new_i64();
 -        addr = tcg_temp_new_i32();
 -        tmp2 = tcg_const_i32(1 << size);
 -        load_reg_var(s, addr, rn);
 -        for (reg = 0; reg < nregs; reg++) {
 -            for (n = 0; n < 8 >> size; n++) {
 -                int xs;
 -                for (xs = 0; xs < interleave; xs++) {
 -                    int tt = rd + reg + spacing * xs;
 -
 -                    if (load) {
 -                        gen_aa32_ld_i64(s, tmp64, addr, mmu_idx, endian | size);
 -                        neon_store_element64(tt, n, size, tmp64);
 -                    } else {
 -                        neon_load_element64(tmp64, tt, n, size);
 -                        gen_aa32_st_i64(s, tmp64, addr, mmu_idx, endian | size);
 -                    }
 -                    tcg_gen_add_i32(addr, addr, tmp2);
 -                }
 -            }
 -        }
 -        tcg_temp_free_i32(addr);
 -        tcg_temp_free_i32(tmp2);
 -        tcg_temp_free_i64(tmp64);
 -        stride = nregs * interleave * 8;
 +        /* Load store all elements -- handled already by decodetree */
 +        return 1;
      } else {
          size = (insn >> 10) & 3;
          if (size == 3) {
 --
 .20.1

-[Qemu-devel] [PULL 23/24] target/arm: Fix typos in trans function prototypes
+[PULL 31/39] target/arm: Convert Neon 'load single structure to all lanes' to decodetree
-In several places cut and paste errors meant we were using the wrong
+Convert the Neon "load single structure to all lanes" insns to
-type for the 'arg' struct in trans_ functions called by the
+decodetree.
 decodetree decoder, because we were using the _sp version of the
 struct in the _dp function.  These were harmless, because the two
 structs were identical and so decodetree made them typedefs of the
 same underlying structure (and we'd have had a compile error if they
 were not harmless), but we should clean them up anyway.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-13-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
+ target/arm/neon-ls.decode       |  5 +++
-file changed, 14 insertions(+), 14 deletions(-)
+ target/arm/translate-neon.inc.c | 73 +++++++++++++++++++++++++++++++++
  target/arm/translate.c          | 55 +------------------------
 files changed, 80 insertions(+), 53 deletions(-)
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/neon-ls.decode
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/neon-ls.decode
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
+@@ -XXX,XX +XXX,XX @@
  VLDST_multiple 1111 0100 0 . l:1 0 rn:4 .... itype:4 size:2 align:2 rm:4 \
                 vd=%vd_dp
 +
 +# Neon load single element to all lanes
 +
 +VLD_all_lanes  1111 0100 1 . 1 0 rn:4 .... 11 n:2 size:2 t:1 a:1 rm:4 \
 +               vd=%vd_dp
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDST_multiple(DisasContext *s, arg_VLDST_multiple *a)
      gen_neon_ldst_base_update(s, a->rm, a->rn, nregs * interleave * 8);
      return true;
  }
++
--static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
++static bool trans_VLD_all_lanes(DisasContext *s, arg_VLD_all_lanes *a)
-+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
++{
- {
++    /* Neon load single structure to all lanes */
 +    int reg, stride, vec_size;
 +    int vd = a->vd;
 +    int size = a->size;
 +    int nregs = a->n + 1;
 +    TCGv_i32 addr, tmp;
 +
 +    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
 +        return false;
 +    }
 +
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +        return false;
 +    }
 +
 +    if (size == 3) {
 +        if (nregs != 4 || a->a == 0) {
 +            return false;
 +        }
 +        /* For VLD4 size == 3 a == 1 means 32 bits at 16 byte alignment */
 +        size = 2;
 +    }
 +    if (nregs == 1 && a->a == 1 && size == 0) {
 +        return false;
 +    }
 +    if (nregs == 3 && a->a == 1) {
 +        return false;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    /*
 +     * VLD1 to all lanes: T bit indicates how many Dregs to write.
 +     * VLD2/3/4 to all lanes: T bit indicates register stride.
 +     */
 +    stride = a->t ? 2 : 1;
 +    vec_size = nregs == 1 ? stride * 8 : 8;
 +
 +    tmp = tcg_temp_new_i32();
 +    addr = tcg_temp_new_i32();
 +    load_reg_var(s, addr, a->rn);
 +    for (reg = 0; reg < nregs; reg++) {
 +        gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
 +                        s->be_data | size);
 +        if ((vd & 1) && vec_size == 16) {
 +            /*
 +             * We cannot write 16 bytes at once because the
 +             * destination is unaligned.
 +             */
 +            tcg_gen_gvec_dup_i32(size, neon_reg_offset(vd, 0),
 +                                 8, 8, tmp);
 +            tcg_gen_gvec_mov(0, neon_reg_offset(vd + 1, 0),
 +                             neon_reg_offset(vd, 0), 8, 8);
 +        } else {
 +            tcg_gen_gvec_dup_i32(size, neon_reg_offset(vd, 0),
 +                                 vec_size, vec_size, tmp);
 +        }
 +        tcg_gen_addi_i32(addr, addr, 1 << size);
 +        vd += stride;
 +    }
 +    tcg_temp_free_i32(tmp);
 +    tcg_temp_free_i32(addr);
 +
 +    gen_neon_ldst_base_update(s, a->rm, a->rn, (1 << size) * nregs);
 +
 +    return true;
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
      int size;
      int reg;
      int load;
 -    int vec_size;
      TCGv_i32 addr;
      TCGv_i32 tmp;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
-     return true;
+     } else {
- }
+         size = (insn >> 10) & 3;
+         if (size == 3) {
--static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+-            /* Load single element to all lanes.  */
-+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
+-            int a = (insn >> 4) & 1;
- {
+-            if (!load) {
-     uint32_t offset;
+-                return 1;
-     TCGv_i32 addr;
+-            }
-@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+-            size = (insn >> 6) & 3;
-     tcg_temp_free_i64(tmp);
+-            nregs = ((insn >> 8) & 3) + 1;
- }
+-
+-            if (size == 3) {
--static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
+-                if (nregs != 4 || a == 0) {
-+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
+-                    return 1;
- {
+-                }
-     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
+-                /* For VLD4 size==3 a == 1 means 32 bits at 16 byte alignment */
- }
+-                size = 2;
-@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+-            }
-     tcg_temp_free_i64(tmp);
+-            if (nregs == 1 && a == 1 && size == 0) {
- }
+-                return 1;
+-            }
--static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
+-            if (nregs == 3 && a == 1) {
-+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
+-                return 1;
- {
+-            }
-     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
+-            addr = tcg_temp_new_i32();
- }
+-            load_reg_var(s, addr, rn);
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+-
-     tcg_temp_free_i64(tmp);
+-            /* VLD1 to all lanes: bit 5 indicates how many Dregs to write.
- }
+-             * VLD2/3/4 to all lanes: bit 5 indicates register stride.
+-             */
--static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
+-            stride = (insn & (1 << 5)) ? 2 : 1;
-+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
+-            vec_size = nregs == 1 ? stride * 8 : 8;
- {
+-
-     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
+-            tmp = tcg_temp_new_i32();
- }
+-            for (reg = 0; reg < nregs; reg++) {
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+-                gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
-     tcg_temp_free_i64(tmp);
+-                                s->be_data | size);
- }
+-                if ((rd & 1) && vec_size == 16) {
+-                    /* We cannot write 16 bytes at once because the
--static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
+-                     * destination is unaligned.
-+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
+-                     */
- {
+-                    tcg_gen_gvec_dup_i32(size, neon_reg_offset(rd, 0),
-     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
+-                                         8, 8, tmp);
- }
+-                    tcg_gen_gvec_mov(0, neon_reg_offset(rd + 1, 0),
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
+-                                     neon_reg_offset(rd, 0), 8, 8);
-     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
+-                } else {
- }
+-                    tcg_gen_gvec_dup_i32(size, neon_reg_offset(rd, 0),
+-                                         vec_size, vec_size, tmp);
--static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
+-                }
-+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
+-                tcg_gen_addi_i32(addr, addr, 1 << size);
- {
+-                rd += stride;
-     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
+-            }
- }
+-            tcg_temp_free_i32(tmp);
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
+-            tcg_temp_free_i32(addr);
-     gen_helper_vfp_negd(vd, vd);
+-            stride = (1 << size) * nregs;
- }
++            /* Load single element to all lanes -- handled by decodetree  */
++            return 1;
--static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
+         } else {
-+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
+             /* Single element.  */
- {
+             int idx = (insn >> 4) & 0xf;
      return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
 +static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
 +static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
      return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
  }
 -static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
 +static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
  {
      return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
  }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
      return true;
  }
 -static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
 +static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
  {
      /*
       * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
      return true;
  }
 -static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
 +static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
      return true;
  }
 -static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
 +static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
  {
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 --
 .20.1

-[Qemu-devel] [PULL 13/24] target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
+[PULL 32/39] target/arm: Convert Neon 'load/store single structure' to decodetree
-Where Neon instructions are floating point operations, we
+Convert the Neon "load/store single structure to one lane" insns to
-mostly use the old VFP utility functions like gen_vfp_abs()
+decodetree.
-which work on the TCG globals cpu_F0s and cpu_F1s. The
-Neon for-each-element loop conditionally loads the inputs
+As this is the last set of insns in the neon load/store group,
-into either a plain old TCG temporary for most operations
+we can remove the whole disas_neon_ls_insn() function.
 or into cpu_F0s for float operations, and similarly stores
 back either cpu_F0s or the temporary.
 Switch NEON_2RM_VABS_F away from using cpu_F0s, and
 update neon_2rm_is_float_op() accordingly.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-14-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-4-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 19 ++++++++-----------
+ target/arm/neon-ls.decode       |  11 +++
-file changed, 8 insertions(+), 11 deletions(-)
+ target/arm/translate-neon.inc.c |  89 +++++++++++++++++++
+ target/arm/translate.c          | 147 --------------------------------
 files changed, 100 insertions(+), 147 deletions(-)
 diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/neon-ls.decode
 +++ b/target/arm/neon-ls.decode
@@ -XXX,XX +XXX,XX @@ VLDST_multiple 1111 0100 0 . l:1 0 rn:4 .... itype:4 size:2 align:2 rm:4 \
  VLD_all_lanes  1111 0100 1 . 1 0 rn:4 .... 11 n:2 size:2 t:1 a:1 rm:4 \
                 vd=%vd_dp
 +
 +# Neon load/store single structure to one lane
 +%imm1_5_p1 5:1 !function=plus1
 +%imm1_6_p1 6:1 !function=plus1
 +
 +VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 00 n:2 reg_idx:3 align:1 rm:4 \
 +               vd=%vd_dp size=0 stride=1
 +VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 01 n:2 reg_idx:2 align:2 rm:4 \
 +               vd=%vd_dp size=1 stride=%imm1_5_p1
 +VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 10 n:2 reg_idx:1 align:3 rm:4 \
 +               vd=%vd_dp size=2 stride=%imm1_6_p1
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@
   * It might be possible to convert it to a standalone .c file eventually.
   */
 +static inline int plus1(DisasContext *s, int x)
 +{
 +    return x + 1;
 +}
 +
  /* Include the generated Neon decoder */
  #include "decode-neon-dp.inc.c"
  #include "decode-neon-ls.inc.c"
@@ -XXX,XX +XXX,XX @@ static bool trans_VLD_all_lanes(DisasContext *s, arg_VLD_all_lanes *a)
      return true;
  }
 +
 +static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
 +{
 +    /* Neon load/store single structure to one lane */
 +    int reg;
 +    int nregs = a->n + 1;
 +    int vd = a->vd;
 +    TCGv_i32 addr, tmp;
 +
 +    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
 +        return false;
 +    }
 +
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +        return false;
 +    }
 +
 +    /* Catch the UNDEF cases. This is unavoidably a bit messy. */
 +    switch (nregs) {
 +    case 1:
 +        if (((a->align & (1 << a->size)) != 0) ||
 +            (a->size == 2 && ((a->align & 3) == 1 || (a->align & 3) == 2))) {
 +            return false;
 +        }
 +        break;
 +    case 3:
 +        if ((a->align & 1) != 0) {
 +            return false;
 +        }
 +        /* fall through */
 +    case 2:
 +        if (a->size == 2 && (a->align & 2) != 0) {
 +            return false;
 +        }
 +        break;
 +    case 4:
 +        if ((a->size == 2) && ((a->align & 3) == 3)) {
 +            return false;
 +        }
 +        break;
 +    default:
 +        abort();
 +    }
 +    if ((vd + a->stride * (nregs - 1)) > 31) {
 +        /*
 +         * Attempts to write off the end of the register file are
 +         * UNPREDICTABLE; we choose to UNDEF because otherwise we would
 +         * access off the end of the array that holds the register data.
 +         */
 +        return false;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    tmp = tcg_temp_new_i32();
 +    addr = tcg_temp_new_i32();
 +    load_reg_var(s, addr, a->rn);
 +    /*
 +     * TODO: if we implemented alignment exceptions, we should check
 +     * addr against the alignment encoded in a->align here.
 +     */
 +    for (reg = 0; reg < nregs; reg++) {
 +        if (a->l) {
 +            gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
 +                            s->be_data | a->size);
 +            neon_store_element(vd, a->reg_idx, a->size, tmp);
 +        } else { /* Store */
 +            neon_load_element(tmp, vd, a->reg_idx, a->size);
 +            gen_aa32_st_i32(s, tmp, addr, get_mem_index(s),
 +                            s->be_data | a->size);
 +        }
 +        vd += a->stride;
 +        tcg_gen_addi_i32(addr, addr, 1 << a->size);
 +    }
 +    tcg_temp_free_i32(addr);
 +    tcg_temp_free_i32(tmp);
 +
 +    gen_neon_ldst_base_update(s, a->rm, a->rn, (1 << a->size) * nregs);
 +
 +    return true;
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+@@ -XXX,XX +XXX,XX @@ static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
-     return statusptr;
+     tcg_temp_free_i32(rd);
  }
--static inline void gen_vfp_abs(int dp)
+-
 -/* Translate a NEON load/store element instruction.  Return nonzero if the
 -   instruction is invalid.  */
 -static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
 -{
--    if (dp)
+-    int rd, rn, rm;
--        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
+-    int nregs;
--    else
+-    int stride;
--        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
+-    int size;
 -    int reg;
 -    int load;
 -    TCGv_i32 addr;
 -    TCGv_i32 tmp;
 -
 -    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
 -        return 1;
 -    }
 -
 -    /* FIXME: this access check should not take precedence over UNDEF
 -     * for invalid encodings; we will generate incorrect syndrome information
 -     * for attempts to execute invalid vfp/neon encodings with FP disabled.
 -     */
 -    if (s->fp_excp_el) {
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
 -        return 0;
 -    }
 -
 -    if (!s->vfp_enabled)
 -      return 1;
 -    VFP_DREG_D(rd, insn);
 -    rn = (insn >> 16) & 0xf;
 -    rm = insn & 0xf;
 -    load = (insn & (1 << 21)) != 0;
 -    if ((insn & (1 << 23)) == 0) {
 -        /* Load store all elements -- handled already by decodetree */
 -        return 1;
 -    } else {
 -        size = (insn >> 10) & 3;
 -        if (size == 3) {
 -            /* Load single element to all lanes -- handled by decodetree  */
 -            return 1;
 -        } else {
 -            /* Single element.  */
 -            int idx = (insn >> 4) & 0xf;
 -            int reg_idx;
 -            switch (size) {
 -            case 0:
 -                reg_idx = (insn >> 5) & 7;
 -                stride = 1;
 -                break;
 -            case 1:
 -                reg_idx = (insn >> 6) & 3;
 -                stride = (insn & (1 << 5)) ? 2 : 1;
 -                break;
 -            case 2:
 -                reg_idx = (insn >> 7) & 1;
 -                stride = (insn & (1 << 6)) ? 2 : 1;
 -                break;
 -            default:
 -                abort();
 -            }
 -            nregs = ((insn >> 8) & 3) + 1;
 -            /* Catch the UNDEF cases. This is unavoidably a bit messy. */
 -            switch (nregs) {
 -            case 1:
 -                if (((idx & (1 << size)) != 0) ||
 -                    (size == 2 && ((idx & 3) == 1 || (idx & 3) == 2))) {
 -                    return 1;
 -                }
 -                break;
 -            case 3:
 -                if ((idx & 1) != 0) {
 -                    return 1;
 -                }
 -                /* fall through */
 -            case 2:
 -                if (size == 2 && (idx & 2) != 0) {
 -                    return 1;
 -                }
 -                break;
 -            case 4:
 -                if ((size == 2) && ((idx & 3) == 3)) {
 -                    return 1;
 -                }
 -                break;
 -            default:
 -                abort();
 -            }
 -            if ((rd + stride * (nregs - 1)) > 31) {
 -                /* Attempts to write off the end of the register file
 -                 * are UNPREDICTABLE; we choose to UNDEF because otherwise
 -                 * the neon_load_reg() would write off the end of the array.
 -                 */
 -                return 1;
 -            }
 -            tmp = tcg_temp_new_i32();
 -            addr = tcg_temp_new_i32();
 -            load_reg_var(s, addr, rn);
 -            for (reg = 0; reg < nregs; reg++) {
 -                if (load) {
 -                    gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
 -                                    s->be_data | size);
 -                    neon_store_element(rd, reg_idx, size, tmp);
 -                } else { /* Store */
 -                    neon_load_element(tmp, rd, reg_idx, size);
 -                    gen_aa32_st_i32(s, tmp, addr, get_mem_index(s),
 -                                    s->be_data | size);
 -                }
 -                rd += stride;
 -                tcg_gen_addi_i32(addr, addr, 1 << size);
 -            }
 -            tcg_temp_free_i32(addr);
 -            tcg_temp_free_i32(tmp);
 -            stride = nregs * (1 << size);
 -        }
 -    }
 -    if (rm != 15) {
 -        TCGv_i32 base;
 -
 -        base = load_reg(s, rn);
 -        if (rm == 13) {
 -            tcg_gen_addi_i32(base, base, stride);
 -        } else {
 -            TCGv_i32 index;
 -            index = load_reg(s, rm);
 -            tcg_gen_add_i32(base, base, index);
 -            tcg_temp_free_i32(index);
 -        }
 -        store_reg(s, rn, base);
 -    }
 -    return 0;
 -}
 -
- static inline void gen_vfp_neg(int dp)
+ static inline void gen_neon_narrow(int size, TCGv_i32 dest, TCGv_i64 src)
  {
-     if (dp)
+     switch (size) {
-@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
+@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+             }
- static int neon_2rm_is_float_op(int op)
+             return;
- {
+         }
--    /* Return true if this neon 2reg-misc op is float-to-float */
+-        if ((insn & 0x0f100000) == 0x04000000) {
--    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
+-            /* NEON load/store.  */
-+    /*
+-            if (disas_neon_ls_insn(s, insn)) {
-+     * Return true if this neon 2reg-misc op is float-to-float.
+-                goto illegal_op;
-+     * This is not a property of the operation but of our code --
+-            }
-+     * what we are asking here is "does the code for this case in
+-            return;
-+     * the Neon for-each-pass loop use cpu_F0s?".
+-        }
-+     */
+         if ((insn & 0x0e000f00) == 0x0c000100) {
-+    return (op == NEON_2RM_VNEG_F ||
+             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
-             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+                 /* iWMMXt register transfer.  */
-             op == NEON_2RM_VRINTM ||
+@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+         }
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+         break;
-                             break;
+     case 12:
-                         }
+-        if ((insn & 0x01100000) == 0x01000000) {
-                         case NEON_2RM_VABS_F:
+-            if (disas_neon_ls_insn(s, insn)) {
--                            gen_vfp_abs(0);
+-                goto illegal_op;
-+                            gen_helper_vfp_abss(tmp, tmp);
+-            }
-                             break;
+-            break;
-                         case NEON_2RM_VNEG_F:
+-        }
-                             gen_vfp_neg(0);
+         goto illegal_op;
      default:
      illegal_op:
 --
 .20.1

-[Qemu-devel] [PULL 11/24] target/arm: Move vfp_expand_imm() to translate.[ch]
+[PULL 33/39] target/arm: Convert Neon 3-reg-same VADD/VSUB to decodetree
-We want to use vfp_expand_imm() in the AArch32 VFP decode;
+Convert the Neon 3-reg-same VADD and VSUB insns to decodetree.
-move it from the a64-only header/source file to the
-AArch32 one (which is always compiled even for AArch64).
+Note that we don't need the neon_3r_sizes[op] check here because all
 size values are OK for VADD and VSUB; we'll add this when we convert
 the first insn that has size restrictions.
 For this we need one of the GVecGen*Fn typedefs currently in
 translate-a64.h; move them all to translate.h as a block so they
 are visible to the 32-bit decoder.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-15-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.h     |  1 -
+ target/arm/translate-a64.h      |  9 --------
- target/arm/translate.h         |  7 +++++++
+ target/arm/translate.h          |  9 ++++++++
- target/arm/translate-a64.c     | 32 --------------------------------
+ target/arm/neon-dp.decode       | 17 +++++++++++++++
- target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
+ target/arm/translate-neon.inc.c | 38 +++++++++++++++++++++++++++++++++
-files changed, 40 insertions(+), 33 deletions(-)
+ target/arm/translate.c          | 14 ++++--------
 files changed, 68 insertions(+), 19 deletions(-)
 diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.h
 +++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
+@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
- TCGv_ptr get_fpstatus_ptr(bool);
- bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
+ bool disas_sve(DisasContext *, uint32_t);
-                             unsigned int imms, unsigned int immr);
--uint64_t vfp_expand_imm(int size, uint8_t imm8);
+-/* Note that the gvec expanders operate on offsets + sizes.  */
- bool sve_access_check(DisasContext *s);
+-typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
+-typedef void GVecGen2iFn(unsigned, uint32_t, uint32_t, int64_t,
- /* We should have at some point before trying to access an FP register
+-                         uint32_t, uint32_t);
 -typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
 -                        uint32_t, uint32_t, uint32_t);
 -typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
 -                        uint32_t, uint32_t, uint32_t);
 -
  #endif /* TARGET_ARM_TRANSLATE_A64_H */
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
+@@ -XXX,XX +XXX,XX @@ void gen_sshl_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b);
-     }
+ #define dc_isar_feature(name, ctx) \
      ({ DisasContext *ctx_ = (ctx); isar_feature_##name(ctx_->isar); })
 +/* Note that the gvec expanders operate on offsets + sizes.  */
 +typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
 +typedef void GVecGen2iFn(unsigned, uint32_t, uint32_t, int64_t,
 +                         uint32_t, uint32_t);
 +typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
 +                        uint32_t, uint32_t, uint32_t);
 +typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
 +                        uint32_t, uint32_t, uint32_t);
 +
  #endif /* TARGET_ARM_TRANSLATE_H */
 diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/neon-dp.decode
 +++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
  #
  # This file is processed by scripts/decodetree.py
  #
 +# VFP/Neon register fields; same as vfp.decode
 +%vm_dp  5:1 0:4
 +%vn_dp  7:1 16:4
 +%vd_dp  22:1 12:4
  # Encodings for Neon data processing instructions where the T32 encoding
  # is a simple transformation of the A32 encoding.
@@ -XXX,XX +XXX,XX @@
  #   0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
  # This file works on the A32 encoding only; calling code for T32 has to
  # transform the insn into the A32 version first.
 +
 +######################################################################
 +# 3-reg-same grouping:
 +# 1111 001 U 0 D sz:2 Vn:4 Vd:4 opc:4 N Q M op Vm:4
 +######################################################################
 +
 +&3same vm vn vd q size
 +
 +@3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
 +                 &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +
 +VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
 +VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
      return true;
  }
-+/*
-+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
-+ * instruction, expand it to the actual constant value of the specified
-+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
-+ */
-+uint64_t vfp_expand_imm(int size, uint8_t imm8);
 +
- /* Vector operations shared between ARM and AArch64.  */
++static bool do_3same(DisasContext *s, arg_3same *a, GVecGen3Fn fn)
  extern const GVecGen3 mla_op[4];
  extern const GVecGen3 mls_op[4];
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
      }
  }
 -/* The imm8 encodes the sign bit, enough bits to represent an exponent in
 - * the range 01....1xx to 10....0xx, and the most significant 4 bits of
 - * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
 - */
 -uint64_t vfp_expand_imm(int size, uint8_t imm8)
 -{
 -    uint64_t imm;
 -
 -    switch (size) {
 -    case MO_64:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 -            extract32(imm8, 0, 6);
 -        imm <<= 48;
 -        break;
 -    case MO_32:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 3);
 -        imm <<= 16;
 -        break;
 -    case MO_16:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 6);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -    return imm;
 -}
 -
  /* Floating point immediate
   *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
   * +---+---+---+-----------+------+---+------------+-------+------+------+
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
  #include "decode-vfp.inc.c"
  #include "decode-vfp-uncond.inc.c"
 +/*
 + * The imm8 encodes the sign bit, enough bits to represent an exponent in
 + * the range 01....1xx to 10....0xx, and the most significant 4 bits of
 + * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
 + */
 +uint64_t vfp_expand_imm(int size, uint8_t imm8)
 +{
-+    uint64_t imm;
++    int vec_size = a->q ? 16 : 8;
 +    int rd_ofs = neon_reg_offset(a->vd, 0);
 +    int rn_ofs = neon_reg_offset(a->vn, 0);
 +    int rm_ofs = neon_reg_offset(a->vm, 0);
 +
-+    switch (size) {
++    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-+    case MO_64:
++        return false;
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 +            extract32(imm8, 0, 6);
 +        imm <<= 48;
 +        break;
 +    case MO_32:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 3);
 +        imm <<= 16;
 +        break;
 +    case MO_16:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 6);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
-+    return imm;
++
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vd | a->vn | a->vm) & 0x10)) {
 +        return false;
 +    }
 +
 +    if ((a->vn | a->vm | a->vd) & a->q) {
 +        return false;
 +    }
 +
 +    if (!vfp_access_check(s)) {
 +        return true;
 +    }
 +
 +    fn(a->size, rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
 +    return true;
 +}
 +
- /*
++#define DO_3SAME(INSN, FUNC)                                            \
-  * Return the offset of a 16-bit half of the specified VFP single-precision
++    static bool trans_##INSN##_3s(DisasContext *s, arg_3same *a)        \
-  * register. If top is true, returns the top 16 bits; otherwise the bottom
++    {                                                                   \
 +        return do_3same(s, a, FUNC);                                    \
 +    }
 +
 +DO_3SAME(VADD, tcg_gen_gvec_add)
 +DO_3SAME(VSUB, tcg_gen_gvec_sub)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
              }
              return 0;
 -        case NEON_3R_VADD_VSUB:
 -            if (u) {
 -                tcg_gen_gvec_sub(size, rd_ofs, rn_ofs, rm_ofs,
 -                                 vec_size, vec_size);
 -            } else {
 -                tcg_gen_gvec_add(size, rd_ofs, rn_ofs, rm_ofs,
 -                                 vec_size, vec_size);
 -            }
 -            return 0;
 -
          case NEON_3R_VQADD:
              tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                             rn_ofs, rm_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
              tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
                             u ? &ushl_op[size] : &sshl_op[size]);
              return 0;
 +
 +        case NEON_3R_VADD_VSUB:
 +            /* Already handled by decodetree */
 +            return 1;
          }
          if (size == 3) {
 --
 .20.1

-[Qemu-devel] [PULL 20/24] target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
+[PULL 34/39] target/arm: Convert Neon 3-reg-same logic ops to decodetree
-Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
+Convert the Neon logic ops in the 3-reg-same grouping to decodetree.
- * don't use cpu_F0s
+Note that for the logic ops the 'size' field forms part of their
- * don't use tcg_gen_ld_f32
+decode and the actual operations are always bitwise.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-16-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-11-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 27 ++++++++++++---------------
+ target/arm/neon-dp.decode       | 12 +++++++++++
-file changed, 12 insertions(+), 15 deletions(-)
+ target/arm/translate-neon.inc.c | 19 +++++++++++++++++
  target/arm/translate.c          | 38 +--------------------------------
 files changed, 32 insertions(+), 37 deletions(-)
+diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-dp.decode
++++ b/target/arm/neon-dp.decode
+@@ -XXX,XX +XXX,XX @@
+ @3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
+                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
++@3same_logic     .... ... . . . .. .... .... .... . q:1 .. .... \
++                 &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp size=0
++
++VAND_3s          1111 001 0 0 . 00 .... .... 0001 ... 1 .... @3same_logic
++VBIC_3s          1111 001 0 0 . 01 .... .... 0001 ... 1 .... @3same_logic
++VORR_3s          1111 001 0 0 . 10 .... .... 0001 ... 1 .... @3same_logic
++VORN_3s          1111 001 0 0 . 11 .... .... 0001 ... 1 .... @3same_logic
++VEOR_3s          1111 001 1 0 . 00 .... .... 0001 ... 1 .... @3same_logic
++VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
++VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
++VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
++
+ VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
+ VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static bool do_3same(DisasContext *s, arg_3same *a, GVecGen3Fn fn)
+ DO_3SAME(VADD, tcg_gen_gvec_add)
+ DO_3SAME(VSUB, tcg_gen_gvec_sub)
++DO_3SAME(VAND, tcg_gen_gvec_and)
++DO_3SAME(VBIC, tcg_gen_gvec_andc)
++DO_3SAME(VORR, tcg_gen_gvec_or)
++DO_3SAME(VORN, tcg_gen_gvec_orc)
++DO_3SAME(VEOR, tcg_gen_gvec_xor)
++
++/* These insns are all gvec_bitsel but with the inputs in various orders. */
++#define DO_3SAME_BITSEL(INSN, O1, O2, O3)                               \
++    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
++                                uint32_t rn_ofs, uint32_t rm_ofs,       \
++                                uint32_t oprsz, uint32_t maxsz)         \
++    {                                                                   \
++        tcg_gen_gvec_bitsel(vece, rd_ofs, O1, O2, O3, oprsz, maxsz);    \
++    }                                                                   \
++    DO_3SAME(INSN, gen_##INSN##_3s)
++
++DO_3SAME_BITSEL(VBSL, rd_ofs, rn_ofs, rm_ofs)
++DO_3SAME_BITSEL(VBIT, rm_ofs, rn_ofs, rd_ofs)
++DO_3SAME_BITSEL(VBIF, rm_ofs, rd_ofs, rn_ofs)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-     return ret;
- }
--#define tcg_gen_ld_f32 tcg_gen_ld_i32
- #define tcg_gen_st_f32 tcg_gen_st_i32
- #define ARM_CP_RW_BIT   (1 << 20)
 @@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         q || (rm & 1)) {
+             }
-                         return 1;
+             return 1;
-                     }
--                    tmp = tcg_temp_new_i32();
+-        case NEON_3R_LOGIC: /* Logic ops.  */
--                    tmp2 = tcg_temp_new_i32();
+-            switch ((u << 2) | size) {
-                     fpst = get_fpstatus_ptr(true);
+-            case 0: /* VAND */
-                     ahp = get_ahp_flag();
+-                tcg_gen_gvec_and(0, rd_ofs, rn_ofs, rm_ofs,
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
+-                                 vec_size, vec_size);
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
+-                break;
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
+-            case 1: /* VBIC */
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+-                tcg_gen_gvec_andc(0, rd_ofs, rn_ofs, rm_ofs,
-+                    tmp = neon_load_reg(rm, 0);
+-                                  vec_size, vec_size);
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+-                break;
-+                    tmp2 = neon_load_reg(rm, 1);
+-            case 2: /* VORR */
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
+-                tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
-                     tcg_gen_shli_i32(tmp2, tmp2, 16);
+-                                vec_size, vec_size);
-                     tcg_gen_or_i32(tmp2, tmp2, tmp);
+-                break;
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
+-            case 3: /* VORN */
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
+-                tcg_gen_gvec_orc(0, rd_ofs, rn_ofs, rm_ofs,
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
+-                                 vec_size, vec_size);
-+                    tcg_temp_free_i32(tmp);
+-                break;
-+                    tmp = neon_load_reg(rm, 2);
+-            case 4: /* VEOR */
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+-                tcg_gen_gvec_xor(0, rd_ofs, rn_ofs, rm_ofs,
-+                    tmp3 = neon_load_reg(rm, 3);
+-                                 vec_size, vec_size);
-                     neon_store_reg(rd, 0, tmp2);
+-                break;
--                    tmp2 = tcg_temp_new_i32();
+-            case 5: /* VBSL */
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rd_ofs, rn_ofs, rm_ofs,
--                    tcg_gen_shli_i32(tmp2, tmp2, 16);
+-                                    vec_size, vec_size);
--                    tcg_gen_or_i32(tmp2, tmp2, tmp);
+-                break;
--                    neon_store_reg(rd, 1, tmp2);
+-            case 6: /* VBIT */
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
+-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rm_ofs, rn_ofs, rd_ofs,
-+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
+-                                    vec_size, vec_size);
-+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
+-                break;
-+                    neon_store_reg(rd, 1, tmp3);
+-            case 7: /* VBIF */
-                     tcg_temp_free_i32(tmp);
+-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rm_ofs, rd_ofs, rn_ofs,
-                     tcg_temp_free_i32(ahp);
+-                                    vec_size, vec_size);
-                     tcg_temp_free_ptr(fpst);
+-                break;
 -            }
 -            return 0;
 -
          case NEON_3R_VQADD:
              tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                             rn_ofs, rm_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
              return 0;
          case NEON_3R_VADD_VSUB:
 +        case NEON_3R_LOGIC:
              /* Already handled by decodetree */
              return 1;
          }
 --
 .20.1

-[Qemu-devel] [PULL 02/24] hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
+[PULL 35/39] target/arm: Convert Neon 3-reg-same VMAX/VMIN to decodetree
-We calculate the locations in memory where we want to put the
+Convert the Neon 3-reg-same VMAX and VMIN insns to decodetree.
 initrd and the DTB based on the size of the kernel, since they
 come after it. Add some explicit checks that these aren't off the
 end of RAM entirely.
 (At the moment the way we calculate the initrd_start means that
 it can't ever be off the end of RAM, but that will change with
 the next commit.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20200430181003.21682-17-peter.maydell@linaro.org
 Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 23 +++++++++++++++++++++++
+ target/arm/neon-dp.decode       |  5 +++++
-file changed, 23 insertions(+)
+ target/arm/translate-neon.inc.c | 14 ++++++++++++++
  target/arm/translate.c          | 21 ++-------------------
 files changed, 21 insertions(+), 19 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/neon-dp.decode
-+++ b/hw/arm/boot.c
++++ b/target/arm/neon-dp.decode
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
-         error_report("could not load kernel '%s'", info->kernel_filename);
+ VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
-         exit(1);
+ VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
-     }
 +VMAX_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 0 .... @3same
 +VMAX_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 0 .... @3same
 +VMIN_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 1 .... @3same
 +VMIN_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 1 .... @3same
 +
-+    if (kernel_size > info->ram_size) {
+ VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
-+        error_report("kernel '%s' is too large to fit in RAM "
+ VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
-+                     "(kernel size %d, RAM size %" PRId64 ")",
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
-+                     info->kernel_filename, kernel_size, info->ram_size);
+index XXXXXXX..XXXXXXX 100644
-+        exit(1);
+--- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ DO_3SAME(VEOR, tcg_gen_gvec_xor)
  DO_3SAME_BITSEL(VBSL, rd_ofs, rn_ofs, rm_ofs)
  DO_3SAME_BITSEL(VBIT, rm_ofs, rn_ofs, rd_ofs)
  DO_3SAME_BITSEL(VBIF, rm_ofs, rd_ofs, rn_ofs)
 +
 +#define DO_3SAME_NO_SZ_3(INSN, FUNC)                                    \
 +    static bool trans_##INSN##_3s(DisasContext *s, arg_3same *a)        \
 +    {                                                                   \
 +        if (a->size == 3) {                                             \
 +            return false;                                               \
 +        }                                                               \
 +        return do_3same(s, a, FUNC);                                    \
 +    }
 +
-     info->entry = entry;
++DO_3SAME_NO_SZ_3(VMAX_S, tcg_gen_gvec_smax)
-     if (is_linux) {
++DO_3SAME_NO_SZ_3(VMAX_U, tcg_gen_gvec_umax)
-         uint32_t fixupcontext[FIXUP_MAX];
++DO_3SAME_NO_SZ_3(VMIN_S, tcg_gen_gvec_smin)
++DO_3SAME_NO_SZ_3(VMIN_U, tcg_gen_gvec_umin)
-         if (info->initrd_filename) {
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-+
+index XXXXXXX..XXXXXXX 100644
-+            if (info->initrd_start >= ram_end) {
+--- a/target/arm/translate.c
-+                error_report("not enough space after kernel to load initrd");
++++ b/target/arm/translate.c
-+                exit(1);
+@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-+            }
+                              rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
-+
+             return 0;
-             initrd_size = load_ramdisk_as(info->initrd_filename,
-                                           info->initrd_start,
+-        case NEON_3R_VMAX:
-                                           ram_end - info->initrd_start, as);
+-            if (u) {
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+-                tcg_gen_gvec_umax(size, rd_ofs, rn_ofs, rm_ofs,
-                              info->initrd_filename);
+-                                  vec_size, vec_size);
-                 exit(1);
+-            } else {
-             }
+-                tcg_gen_gvec_smax(size, rd_ofs, rn_ofs, rm_ofs,
-+            if (info->initrd_start + initrd_size > info->ram_size) {
+-                                  vec_size, vec_size);
-+                error_report("could not load initrd '%s': "
+-            }
-+                             "too big to fit into RAM after the kernel",
+-            return 0;
-+                             info->initrd_filename);
+-        case NEON_3R_VMIN:
-+            }
+-            if (u) {
-         } else {
+-                tcg_gen_gvec_umin(size, rd_ofs, rn_ofs, rm_ofs,
-             initrd_size = 0;
+-                                  vec_size, vec_size);
 -            } else {
 -                tcg_gen_gvec_smin(size, rd_ofs, rn_ofs, rm_ofs,
 -                                  vec_size, vec_size);
 -            }
 -            return 0;
 -
          case NEON_3R_VSHL:
              /* Note the operation is vshl vd,vm,vn */
              tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
          case NEON_3R_VADD_VSUB:
          case NEON_3R_LOGIC:
 +        case NEON_3R_VMAX:
 +        case NEON_3R_VMIN:
              /* Already handled by decodetree */
              return 1;
          }
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-             /* Place the DTB after the initrd in memory with alignment. */
-             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
-                                            align);
-+            if (info->dtb_start >= ram_end) {
-+                error_report("Not enough space for DTB after kernel/initrd");
-+                exit(1);
-+            }
-             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
-             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
-         } else {
 --
 .20.1

-[Qemu-devel] [PULL 17/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
+[PULL 36/39] target/arm: Convert Neon 3-reg-same comparisons to decodetree
-Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.
+Convert the Neon comparison ops in the 3-reg-same grouping
 to decodetree.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-18-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-8-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 6 +++---
+ target/arm/neon-dp.decode       |  8 ++++++++
-file changed, 3 insertions(+), 3 deletions(-)
+ target/arm/translate-neon.inc.c | 22 ++++++++++++++++++++++
  target/arm/translate.c          | 23 +++--------------------
 files changed, 33 insertions(+), 20 deletions(-)
+diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-dp.decode
++++ b/target/arm/neon-dp.decode
+@@ -XXX,XX +XXX,XX @@ VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
+ VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
+ VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
++VCGT_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 0 .... @3same
++VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
++VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
++VCGE_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 1 .... @3same
++
+ VMAX_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 0 .... @3same
+ VMAX_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 0 .... @3same
+ VMIN_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 1 .... @3same
+@@ -XXX,XX +XXX,XX @@ VMIN_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 1 .... @3same
+ VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
+ VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
++
++VTST_3s          1111 001 0 0 . .. .... .... 1000 . . . 1 .... @3same
++VCEQ_3s          1111 001 1 0 . .. .... .... 1000 . . . 1 .... @3same
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ DO_3SAME_NO_SZ_3(VMAX_S, tcg_gen_gvec_smax)
+ DO_3SAME_NO_SZ_3(VMAX_U, tcg_gen_gvec_umax)
+ DO_3SAME_NO_SZ_3(VMIN_S, tcg_gen_gvec_smin)
+ DO_3SAME_NO_SZ_3(VMIN_U, tcg_gen_gvec_umin)
++
++#define DO_3SAME_CMP(INSN, COND)                                        \
++    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
++                                uint32_t rn_ofs, uint32_t rm_ofs,       \
++                                uint32_t oprsz, uint32_t maxsz)         \
++    {                                                                   \
++        tcg_gen_gvec_cmp(COND, vece, rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz); \
++    }                                                                   \
++    DO_3SAME_NO_SZ_3(INSN, gen_##INSN##_3s)
++
++DO_3SAME_CMP(VCGT_S, TCG_COND_GT)
++DO_3SAME_CMP(VCGT_U, TCG_COND_GTU)
++DO_3SAME_CMP(VCGE_S, TCG_COND_GE)
++DO_3SAME_CMP(VCGE_U, TCG_COND_GEU)
++DO_3SAME_CMP(VCEQ, TCG_COND_EQ)
++
++static void gen_VTST_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
++                         uint32_t rm_ofs, uint32_t oprsz, uint32_t maxsz)
++{
++    tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz, &cmtst_op[vece]);
++}
++DO_3SAME_NO_SZ_3(VTST, gen_VTST_3s)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return op >= NEON_2RM_VRECPE_F;
-+    return op >= NEON_2RM_VCVT_FS;
- }
- static bool neon_2rm_is_v8_op(int op)
 @@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         case NEON_2RM_VRECPE_F:
+                            u ? &mls_op[size] : &mla_op[size]);
-                         {
+             return 0;
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
--                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
+-        case NEON_3R_VTST_VCEQ:
-+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
+-            if (u) { /* VCEQ */
-                             tcg_temp_free_ptr(fpstatus);
+-                tcg_gen_gvec_cmp(TCG_COND_EQ, size, rd_ofs, rn_ofs, rm_ofs,
-                             break;
+-                                 vec_size, vec_size);
-                         }
+-            } else { /* VTST */
-                         case NEON_2RM_VRSQRTE_F:
+-                tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs,
-                         {
+-                               vec_size, vec_size, &cmtst_op[size]);
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+-            }
--                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
+-            return 0;
-+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
+-
-                             tcg_temp_free_ptr(fpstatus);
+-        case NEON_3R_VCGT:
-                             break;
+-            tcg_gen_gvec_cmp(u ? TCG_COND_GTU : TCG_COND_GT, size,
-                         }
+-                             rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
 -            return 0;
 -
 -        case NEON_3R_VCGE:
 -            tcg_gen_gvec_cmp(u ? TCG_COND_GEU : TCG_COND_GE, size,
 -                             rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
 -            return 0;
 -
          case NEON_3R_VSHL:
              /* Note the operation is vshl vd,vm,vn */
              tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
          case NEON_3R_LOGIC:
          case NEON_3R_VMAX:
          case NEON_3R_VMIN:
 +        case NEON_3R_VTST_VCEQ:
 +        case NEON_3R_VCGT:
 +        case NEON_3R_VCGE:
              /* Already handled by decodetree */
              return 1;
          }
 --
 .20.1

-[Qemu-devel] [PULL 15/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
+[PULL 37/39] target/arm: Convert Neon 3-reg-same VQADD/VQSUB to decodetree
-Switch NEON_2RM_VRINT* away from using cpu_F0s.
+Convert the Neon VQADD/VQSUB insns in the 3-reg-same grouping
 to decodetree.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20200430181003.21682-19-peter.maydell@linaro.org
 Message-id: 20190613163917.28589-6-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 8 +++-----
+ target/arm/neon-dp.decode       |  6 ++++++
-file changed, 3 insertions(+), 5 deletions(-)
+ target/arm/translate-neon.inc.c | 15 +++++++++++++++
  target/arm/translate.c          | 14 ++------------
 files changed, 23 insertions(+), 12 deletions(-)
+diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/neon-dp.decode
++++ b/target/arm/neon-dp.decode
+@@ -XXX,XX +XXX,XX @@
+ @3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
+                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
++VQADD_S_3s       1111 001 0 0 . .. .... .... 0000 . . . 1 .... @3same
++VQADD_U_3s       1111 001 1 0 . .. .... .... 0000 . . . 1 .... @3same
++
+ @3same_logic     .... ... . . . .. .... .... .... . q:1 .. .... \
+                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp size=0
+@@ -XXX,XX +XXX,XX @@ VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
+ VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
+ VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
++VQSUB_S_3s       1111 001 0 0 . .. .... .... 0010 . . . 1 .... @3same
++VQSUB_U_3s       1111 001 1 0 . .. .... .... 0010 . . . 1 .... @3same
++
+ VCGT_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 0 .... @3same
+ VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
+ VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
+diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-neon.inc.c
++++ b/target/arm/translate-neon.inc.c
+@@ -XXX,XX +XXX,XX @@ static void gen_VTST_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+     tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz, &cmtst_op[vece]);
+ }
+ DO_3SAME_NO_SZ_3(VTST, gen_VTST_3s)
++
++#define DO_3SAME_GVEC4(INSN, OPARRAY)                                   \
++    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
++                                uint32_t rn_ofs, uint32_t rm_ofs,       \
++                                uint32_t oprsz, uint32_t maxsz)         \
++    {                                                                   \
++        tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),           \
++                       rn_ofs, rm_ofs, oprsz, maxsz, &OPARRAY[vece]);   \
++    }                                                                   \
++    DO_3SAME(INSN, gen_##INSN##_3s)
++
++DO_3SAME_GVEC4(VQADD_S, sqadd_op)
++DO_3SAME_GVEC4(VQADD_U, uqadd_op)
++DO_3SAME_GVEC4(VQSUB_S, sqsub_op)
++DO_3SAME_GVEC4(VQSUB_U, uqsub_op)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
--            op == NEON_2RM_VRINTM ||
--            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
-+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-             op >= NEON_2RM_VRECPE_F);
- }
 @@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
+             }
-                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
+             return 1;
-                                                       cpu_env);
--                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
+-        case NEON_3R_VQADD:
-+                            gen_helper_rints(tmp, tmp, fpstatus);
+-            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
+-                           rn_ofs, rm_ofs, vec_size, vec_size,
-                                                       cpu_env);
+-                           (u ? uqadd_op : sqadd_op) + size);
-                             tcg_temp_free_ptr(fpstatus);
+-            return 0;
 -
 -        case NEON_3R_VQSUB:
 -            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
 -                           rn_ofs, rm_ofs, vec_size, vec_size,
 -                           (u ? uqsub_op : sqsub_op) + size);
 -            return 0;
 -
          case NEON_3R_VMUL: /* VMUL */
              if (u) {
                  /* Polynomial case allows only P8.  */
 @@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         case NEON_2RM_VRINTX:
+         case NEON_3R_VTST_VCEQ:
-                         {
+         case NEON_3R_VCGT:
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+         case NEON_3R_VCGE:
--                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
++        case NEON_3R_VQADD:
-+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
++        case NEON_3R_VQSUB:
-                             tcg_temp_free_ptr(fpstatus);
+             /* Already handled by decodetree */
-                             break;
+             return 1;
-                         }
+         }
 --
 .20.1

-[Qemu-devel] [PULL 09/24] hw/intc/arm_gicv3: Fix decoding of ID register range
+[PULL 38/39] target/arm: Convert Neon 3-reg-same VMUL, VMLA, VMLS, VSHL to decodetree
-The GIC ID registers cover an area 0x30 bytes in size
+Convert the Neon VMUL, VMLA, VMLS and VSHL insns in the
-(12 registers, 4 bytes each). We were incorrectly decoding
+-reg-same grouping to decodetree.
 only the first 0x20 bytes.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
+Message-id: 20200430181003.21682-20-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_dist.c   | 4 ++--
+ target/arm/neon-dp.decode       |  9 +++++++
- hw/intc/arm_gicv3_redist.c | 4 ++--
+ target/arm/translate-neon.inc.c | 44 +++++++++++++++++++++++++++++++++
-files changed, 4 insertions(+), 4 deletions(-)
+ target/arm/translate.c          | 28 +++------------------
 files changed, 56 insertions(+), 25 deletions(-)
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
+--- a/target/arm/neon-dp.decode
-+++ b/hw/intc/arm_gicv3_dist.c
++++ b/target/arm/neon-dp.decode
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
  VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
  VCGE_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 1 .... @3same
 +VSHL_S_3s        1111 001 0 0 . .. .... .... 0100 . . . 0 .... @3same
 +VSHL_U_3s        1111 001 1 0 . .. .... .... 0100 . . . 0 .... @3same
 +
  VMAX_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 0 .... @3same
  VMAX_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 0 .... @3same
  VMIN_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 1 .... @3same
@@ -XXX,XX +XXX,XX @@ VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
  VTST_3s          1111 001 0 0 . .. .... .... 1000 . . . 1 .... @3same
  VCEQ_3s          1111 001 1 0 . .. .... .... 1000 . . . 1 .... @3same
 +
 +VMLA_3s          1111 001 0 0 . .. .... .... 1001 . . . 0 .... @3same
 +VMLS_3s          1111 001 1 0 . .. .... .... 1001 . . . 0 .... @3same
 +
 +VMUL_3s          1111 001 0 0 . .. .... .... 1001 . . . 1 .... @3same
 +VMUL_p_3s        1111 001 1 0 . .. .... .... 1001 . . . 1 .... @3same
 diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.inc.c
 +++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ DO_3SAME_NO_SZ_3(VMAX_S, tcg_gen_gvec_smax)
  DO_3SAME_NO_SZ_3(VMAX_U, tcg_gen_gvec_umax)
  DO_3SAME_NO_SZ_3(VMIN_S, tcg_gen_gvec_smin)
  DO_3SAME_NO_SZ_3(VMIN_U, tcg_gen_gvec_umin)
 +DO_3SAME_NO_SZ_3(VMUL, tcg_gen_gvec_mul)
  #define DO_3SAME_CMP(INSN, COND)                                        \
      static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
@@ -XXX,XX +XXX,XX @@ DO_3SAME_GVEC4(VQADD_S, sqadd_op)
  DO_3SAME_GVEC4(VQADD_U, uqadd_op)
  DO_3SAME_GVEC4(VQSUB_S, sqsub_op)
  DO_3SAME_GVEC4(VQSUB_U, uqsub_op)
 +
 +static void gen_VMUL_p_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
 +                           uint32_t rm_ofs, uint32_t oprsz, uint32_t maxsz)
 +{
 +    tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz,
 +                       0, gen_helper_gvec_pmul_b);
 +}
 +
 +static bool trans_VMUL_p_3s(DisasContext *s, arg_3same *a)
 +{
 +    if (a->size != 0) {
 +        return false;
 +    }
 +    return do_3same(s, a, gen_VMUL_p_3s);
 +}
 +
 +#define DO_3SAME_GVEC3_NO_SZ_3(INSN, OPARRAY)                           \
 +    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
 +                                uint32_t rn_ofs, uint32_t rm_ofs,       \
 +                                uint32_t oprsz, uint32_t maxsz)         \
 +    {                                                                   \
 +        tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs,                          \
 +                       oprsz, maxsz, &OPARRAY[vece]);                   \
 +    }                                                                   \
 +    DO_3SAME_NO_SZ_3(INSN, gen_##INSN##_3s)
 +
 +
 +DO_3SAME_GVEC3_NO_SZ_3(VMLA, mla_op)
 +DO_3SAME_GVEC3_NO_SZ_3(VMLS, mls_op)
 +
 +#define DO_3SAME_GVEC3_SHIFT(INSN, OPARRAY)                             \
 +    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
 +                                uint32_t rn_ofs, uint32_t rm_ofs,       \
 +                                uint32_t oprsz, uint32_t maxsz)         \
 +    {                                                                   \
 +        /* Note the operation is vshl vd,vm,vn */                       \
 +        tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs,                          \
 +                       oprsz, maxsz, &OPARRAY[vece]);                   \
 +    }                                                                   \
 +    DO_3SAME(INSN, gen_##INSN##_3s)
 +
 +DO_3SAME_GVEC3_SHIFT(VSHL_S, sshl_op)
 +DO_3SAME_GVEC3_SHIFT(VSHL_U, ushl_op)
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
              }
              return 1;
 -        case NEON_3R_VMUL: /* VMUL */
 -            if (u) {
 -                /* Polynomial case allows only P8.  */
 -                if (size != 0) {
 -                    return 1;
 -                }
 -                tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size,
 -                                   0, gen_helper_gvec_pmul_b);
 -            } else {
 -                tcg_gen_gvec_mul(size, rd_ofs, rn_ofs, rm_ofs,
 -                                 vec_size, vec_size);
 -            }
 -            return 0;
 -
 -        case NEON_3R_VML: /* VMLA, VMLS */
 -            tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size,
 -                           u ? &mls_op[size] : &mla_op[size]);
 -            return 0;
 -
 -        case NEON_3R_VSHL:
 -            /* Note the operation is vshl vd,vm,vn */
 -            tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
 -                           u ? &ushl_op[size] : &sshl_op[size]);
 -            return 0;
 -
          case NEON_3R_VADD_VSUB:
          case NEON_3R_LOGIC:
          case NEON_3R_VMAX:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
          case NEON_3R_VCGE:
          case NEON_3R_VQADD:
          case NEON_3R_VQSUB:
 +        case NEON_3R_VMUL:
 +        case NEON_3R_VML:
 +        case NEON_3R_VSHL:
              /* Already handled by decodetree */
              return 1;
          }
-         return MEMTX_OK;
-     }
--    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
-+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
-         /* ID registers */
-         *data = gicv3_idreg(offset - GICD_IDREGS);
-         return MEMTX_OK;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
-         gicd_write_irouter(s, attrs, irq, r);
-         return MEMTX_OK;
-     }
--    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
-+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
-     case GICD_TYPER:
-     case GICD_IIDR:
-         /* RO registers, ignore the write */
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
-+++ b/hw/intc/arm_gicv3_redist.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
-         }
-         *data = cs->gicr_nsacr;
-         return MEMTX_OK;
--    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
-+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
-         *data = gicv3_idreg(offset - GICR_IDREGS);
-         return MEMTX_OK;
-     default:
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
-         return MEMTX_OK;
-     case GICR_IIDR:
-     case GICR_TYPER:
--    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
-+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
-         /* RO registers, ignore the write */
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "%s: invalid guest write to RO register at offset "
 --
 .20.1

-[Qemu-devel] [PULL 01/24] hw/arm/boot: Don't assume RAM starts at address zero
+[PULL 39/39] target/arm: Move gen_ function typedefs to translate.h
-In the Arm kernel/initrd loading code, in some places we make the
+We're going to want at least some of the NeonGen* typedefs
-incorrect assumption that info->ram_size can be treated as the
+for the refactored 32-bit Neon decoder, so move them all
-address of the end of RAM, as for instance when we calculate the
+to translate.h since it makes more sense to keep them in
-available space for the initrd using "info->ram_size - info->initrd_start".
+one group.
 This is wrong, because many Arm boards (including "virt") specify
 a non-zero info->loader_start to indicate that their RAM area
 starts at a non-zero physical address.
 Correct the places which make this incorrect assumption.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
+Message-id: 20200430181003.21682-23-peter.maydell@linaro.org
 Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 9 ++++-----
+ target/arm/translate.h     | 17 +++++++++++++++++
-file changed, 4 insertions(+), 5 deletions(-)
+ target/arm/translate-a64.c | 17 -----------------
 files changed, 17 insertions(+), 17 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/translate.h
-+++ b/hw/arm/boot.c
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
-     int elf_machine;
+ typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
-     hwaddr entry;
+                         uint32_t, uint32_t, uint32_t);
-     static const ARMInsnFixup *primary_loader;
-+    uint64_t ram_end = info->loader_start + info->ram_size;
++/* Function prototype for gen_ functions for calling Neon helpers */
++typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
-     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
++typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
-         primary_loader = bootloader_aarch64;
++typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
++typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
-         /* 32-bit ARM */
++typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
-         entry = info->loader_start + KERNEL_LOAD_ADDR;
++typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
-         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
++typedef void NeonGenNarrowEnvFn(TCGv_i32, TCGv_ptr, TCGv_i64);
--                                             info->ram_size - KERNEL_LOAD_ADDR,
++typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
--                                             as);
++typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
-+                                             ram_end - KERNEL_LOAD_ADDR, as);
++typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
-         is_linux = 1;
++typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
-     }
++typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
-     if (kernel_size < 0) {
++typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
++typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
-         if (info->initrd_filename) {
++typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
-             initrd_size = load_ramdisk_as(info->initrd_filename,
++
-                                           info->initrd_start,
+ #endif /* TARGET_ARM_TRANSLATE_H */
--                                          info->ram_size - info->initrd_start,
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
--                                          as);
+index XXXXXXX..XXXXXXX 100644
-+                                          ram_end - info->initrd_start, as);
+--- a/target/arm/translate-a64.c
-             if (initrd_size < 0) {
++++ b/target/arm/translate-a64.c
-                 initrd_size = load_image_targphys_as(info->initrd_filename,
+@@ -XXX,XX +XXX,XX @@ typedef struct AArch64DecodeTable {
-                                                      info->initrd_start,
+     AArch64DecodeFn *disas_fn;
--                                                     info->ram_size -
+ } AArch64DecodeTable;
-+                                                     ram_end -
-                                                      info->initrd_start,
+-/* Function prototype for gen_ functions for calling Neon helpers */
-                                                      as);
+-typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
-             }
+-typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
 -typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
 -typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
 -typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
 -typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
 -typedef void NeonGenNarrowEnvFn(TCGv_i32, TCGv_ptr, TCGv_i64);
 -typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
 -typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 -typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
 -typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
 -typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
 -typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 -typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 -typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
 -
  /* initialize TCG globals.  */
  void a64_translate_init(void)
  {
 --
 .20.1

Latest arm queue, half minor code cleanups and half minor
bug fixes.

-- PMM

The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617

for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:

target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)

----------------------------------------------------------------
target-arm queue:
 * support large kernel images in bootloader (by avoiding
   putting the initrd over the top of them)
 * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
 * arm_gicv3: Fix decoding of ID register range
 * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
 * some code cleanups following on from the VFP decodetree conversion
 * Only implement doubles if the FPU supports them
   (so we now correctly model Cortex-M4, -M33 as single precision only)

----------------------------------------------------------------
Peter Maydell (24):
      hw/arm/boot: Don't assume RAM starts at address zero
      hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
      hw/arm/boot: Avoid placing the initrd on top of the kernel
      hw/arm/boot: Honour image size field in AArch64 Image format kernels
      target/arm: Allow VFP and Neon to be disabled via a CPU property
      target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
      hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
      hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
      hw/intc/arm_gicv3: Fix decoding of ID register range
      hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
      target/arm: Move vfp_expand_imm() to translate.[ch]
      target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
      target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
      target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
      target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
      target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
      target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
      target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
      target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
      target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
      target/arm: Fix typos in trans function prototypes
      target/arm: Only implement doubles if the FPU supports them

In the Arm kernel/initrd loading code, in some places we make the
incorrect assumption that info->ram_size can be treated as the
address of the end of RAM, as for instance when we calculate the
available space for the initrd using "info->ram_size - info->initrd_start".
This is wrong, because many Arm boards (including "virt") specify
a non-zero info->loader_start to indicate that their RAM area
starts at a non-zero physical address.

Correct the places which make this incorrect assumption.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
+    uint64_t ram_end = info->loader_start + info->ram_size;
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         primary_loader = bootloader_aarch64;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
-                                             info->ram_size - KERNEL_LOAD_ADDR,
-                                             as);
+                                             ram_end - KERNEL_LOAD_ADDR, as);
         is_linux = 1;
     }
     if (kernel_size < 0) {
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         if (info->initrd_filename) {
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
-                                          info->ram_size - info->initrd_start,
-                                          as);
+                                          ram_end - info->initrd_start, as);
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys_as(info->initrd_filename,
                                                      info->initrd_start,
-                                                     info->ram_size -
+                                                     ram_end -
                                                      info->initrd_start,
                                                      as);
             }
-- 
2.20.1

We calculate the locations in memory where we want to put the
initrd and the DTB based on the size of the kernel, since they
come after it. Add some explicit checks that these aren't off the
end of RAM entirely.

(At the moment the way we calculate the initrd_start means that
it can't ever be off the end of RAM, but that will change with
the next commit.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         error_report("could not load kernel '%s'", info->kernel_filename);
         exit(1);
     }
+
+    if (kernel_size > info->ram_size) {
+        error_report("kernel '%s' is too large to fit in RAM "
+                     "(kernel size %d, RAM size %" PRId64 ")",
+                     info->kernel_filename, kernel_size, info->ram_size);
+        exit(1);
+    }
+
     info->entry = entry;
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
         if (info->initrd_filename) {
+
+            if (info->initrd_start >= ram_end) {
+                error_report("not enough space after kernel to load initrd");
+                exit(1);
+            }
+
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
                                           ram_end - info->initrd_start, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                              info->initrd_filename);
                 exit(1);
             }
+            if (info->initrd_start + initrd_size > info->ram_size) {
+                error_report("could not load initrd '%s': "
+                             "too big to fit into RAM after the kernel",
+                             info->initrd_filename);
+            }
         } else {
             initrd_size = 0;
         }
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
             /* Place the DTB after the initrd in memory with alignment. */
             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
                                            align);
+            if (info->dtb_start >= ram_end) {
+                error_report("Not enough space for DTB after kernel/initrd");
+                exit(1);
+            }
             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
         } else {
-- 
2.20.1

We currently put the initrd at the smaller of:
 * 128MB into RAM
 * halfway into the RAM
(with the dtb following it).

However for large kernels this might mean that the kernel
overlaps the initrd. For some kinds of kernel (self-decompressing
32-bit kernels, and ELF images with a BSS section at the end)
we don't know the exact size, but even there we have a
minimum size. Put the initrd at least further into RAM than
that. For image formats that can give us an exact kernel size, this
will mean that we definitely avoid overlaying kernel and initrd.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     if (info->nb_cpus == 0)
         info->nb_cpus = 1;
 
-    /*
-     * We want to put the initrd far enough into RAM that when the
-     * kernel is uncompressed it will not clobber the initrd. However
-     * on boards without much RAM we must ensure that we still leave
-     * enough room for a decent sized initrd, and on boards with large
-     * amounts of RAM we must avoid the initrd being so far up in RAM
-     * that it is outside lowmem and inaccessible to the kernel.
-     * So for boards with less  than 256MB of RAM we put the initrd
-     * halfway into RAM, and for boards with 256MB of RAM or more we put
-     * the initrd at 128MB.
-     */
-    info->initrd_start = info->loader_start +
-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
-
     /* Assume that raw images are linux kernels, and ELF images are not.  */
     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
                                &elf_high_addr, elf_machine, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
 
     info->entry = entry;
+
+    /*
+     * We want to put the initrd far enough into RAM that when the
+     * kernel is uncompressed it will not clobber the initrd. However
+     * on boards without much RAM we must ensure that we still leave
+     * enough room for a decent sized initrd, and on boards with large
+     * amounts of RAM we must avoid the initrd being so far up in RAM
+     * that it is outside lowmem and inaccessible to the kernel.
+     * So for boards with less  than 256MB of RAM we put the initrd
+     * halfway into RAM, and for boards with 256MB of RAM or more we put
+     * the initrd at 128MB.
+     * We also refuse to put the initrd somewhere that will definitely
+     * overlay the kernel we just loaded, though for kernel formats which
+     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
+     * we might still make a bad choice here.
+     */
+    info->initrd_start = info->loader_start +
+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
+
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
-- 
2.20.1

Since Linux v3.17, the kernel's Image header includes a field image_size,
which gives the total size of the kernel including unpopulated data
sections such as the BSS). If this is present, then return it from
load_aarch64_image() as the true size of the kernel rather than
just using the size of the Image file itself. This allows the code
which calculates where to put the initrd to avoid putting it in
the kernel's BSS area.

This means that we should be able to reliably load kernel images
which are larger than 128MB without accidentally putting the
initrd or dtb in locations that clash with the kernel itself.

Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
---
 hw/arm/boot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
                                    hwaddr *entry, AddressSpace *as)
 {
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+    uint64_t kernel_size = 0;
     uint8_t *buffer;
     int size;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          * is only valid if the image_size is non-zero.
          */
         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
-        if (hdrvals[1] != 0) {
+
+        kernel_size = le64_to_cpu(hdrvals[1]);
+
+        if (kernel_size != 0) {
             kernel_load_offset = le64_to_cpu(hdrvals[0]);
 
             /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
         }
     }
 
+    /*
+     * Kernels before v3.17 don't populate the image_size field, and
+     * raw images have no header. For those our best guess at the size
+     * is the size of the Image file itself.
+     */
+    if (kernel_size == 0) {
+        kernel_size = size;
+    }
+
     *entry = mem_base + kernel_load_offset;
     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
 
     g_free(buffer);
 
-    return size;
+    return kernel_size;
 }
 
 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-- 
2.20.1

Allow VFP and neon to be disabled via a CPU property. As with
the "pmu" property, we only allow these features to be removed
from CPUs which have it by default, not added to CPUs which
don't have it.

The primary motivation here is to be able to optionally
create Cortex-M33 CPUs with no FPU, but we provide switches
for both VFP and Neon because the two interact:
 * AArch64 can't have one without the other
 * Some ID register fields only change if both are disabled

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
---
 target/arm/cpu.h |   4 ++
 target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 148 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_el3;
     /* CPU has PMU (Performance Monitor Unit) */
     bool has_pmu;
+    /* CPU has VFP */
+    bool has_vfp;
+    /* CPU has Neon */
+    bool has_neon;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
 static Property arm_cpu_has_pmu_property =
             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 
+static Property arm_cpu_has_vfp_property =
+            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
+
+static Property arm_cpu_has_neon_property =
+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
+    /* Similarly for the VFP feature bits */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP3);
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP);
+    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
+    /*
+     * Allow user to turn off VFP and Neon support, but only for TCG --
+     * KVM does not currently allow us to lie to the guest about its
+     * ID/feature registers, so the guest always sees what the host has.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        cpu->has_vfp = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
+                                     &error_abort);
+        }
+    }
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
+        cpu->has_neon = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
+                                     &error_abort);
+        }
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+        cpu->has_vfp != cpu->has_neon) {
+        /*
+         * This is an architectural requirement for AArch64; AArch32 is
+         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
+         */
+        error_setg(errp,
+                   "AArch64 CPUs must have both VFP and Neon or neither");
+        return;
+    }
+
+    if (!cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_VFP);
+        unset_feature(env, ARM_FEATURE_VFP3);
+        unset_feature(env, ARM_FEATURE_VFP4);
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, FPSP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDP, 0);
+        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
+        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
+        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
+        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
+        cpu->isar.mvfr0 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
+        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
+        u = FIELD_DP32(u, MVFR1, FPHP, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_NEON);
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar5;
+        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
+        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
+        cpu->isar.id_isar5 = u;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
+        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon && !cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
+        cpu->isar.mvfr0 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     if (arm_feature(env, ARM_FEATURE_V5)) {
         set_feature(env, ARM_FEATURE_V4T);
     }
-    if (arm_feature(env, ARM_FEATURE_VFP4)) {
-        set_feature(env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(env, ARM_FEATURE_VFP3)) {
-        set_feature(env, ARM_FEATURE_VFP);
-    }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
         set_feature(env, ARM_FEATURE_PXN);
-- 
2.20.1

Allow the DSP extension to be disabled via a CPU property for
M-profile CPUs. (A and R-profile CPUs don't have this extension
as a defined separate optional architecture extension, so
they don't need the property.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
---
 target/arm/cpu.h |  2 ++
 target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_vfp;
     /* CPU has Neon */
     bool has_neon;
+    /* CPU has M-profile DSP extension */
+    bool has_dsp;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
 static Property arm_cpu_has_neon_property =
             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 
+static Property arm_cpu_has_dsp_property =
+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
         }
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
+        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
+                                 &error_abort);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.mvfr0 = u;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
+
+        u = cpu->isar.id_isar1;
+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
+        cpu->isar.id_isar1 = u;
+
+        u = cpu->isar.id_isar2;
+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
+        cpu->isar.id_isar2 = u;
+
+        u = cpu->isar.id_isar3;
+        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
+        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
+        cpu->isar.id_isar3 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
-- 
2.20.1

Create "vfp" and "dsp" properties on the armv7m container object
which will be forwarded to its CPU object, so that SoCs can
configure whether the CPU has these features.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 ++++
 hw/arm/armv7m.c         | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  *   devices will be automatically layered on top of this view.)
  * + Property "idau": IDAU interface (forwarded to CPU object)
  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
+ * + Property "vfp": enable VFP (forwarded to CPU object)
+ * + Property "dsp": enable DSP (forwarded to CPU object)
  * + Property "enable-bitband": expose bitbanded IO
  */
 typedef struct ARMv7MState {
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     uint32_t init_svtor;
     bool enable_bitband;
     bool start_powered_off;
+    bool vfp;
+    bool dsp;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
+                                 "vfp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
+                                 "dsp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
 
     /*
      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
                      false),
+    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
+    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

The SSE-200 hardware has configurable integration settings which
determine whether its two CPUs have the FPU and DSP:
 * CPU0_FPU (default 0)
 * CPU0_DSP (default 0)
 * CPU1_FPU (default 1)
 * CPU1_DSP (default 1)

Similarly, the IoTKit has settings for its single CPU:
 * CPU0_FPU (default 1)
 * CPU0_DSP (default 1)

Of our four boards that use either the IoTKit or the SSE-200:
 * mps2-an505, mps2-an521 and musca-a use the default settings
 * musca-b1 enables FPU and DSP on both CPUs

Currently QEMU models all these boards using CPUs with
both FPU and DSP enabled. This means that we are incorrect
for mps2-an521 and musca-a, which should not have FPU or DSP
on CPU0.

Create QOM properties on the ARMSSE devices corresponding to the
default h/w integration settings, and make the Musca-B1 board
enable FPU and DSP on both CPUs. This fixes the mps2-an521
and musca-a behaviour, and leaves the musca-b1 and mps2-an505
behaviour unchanged.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h |  7 +++++
 hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
 hw/arm/musca.c          |  8 ++++++
 3 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *    address of each SRAM bank (and thus the total amount of internal SRAM)
  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
  *    (where it expects to load the PC and SP from the vector table on reset)
+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
+ *    set whether the CPUs have the FPU and DSP features present. The default
+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
  *    which are wired to its NVIC lines 32 .. n+32
  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
     uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
+    bool cpu_fpu[SSE_MAX_CPUS];
+    bool cpu_dsp[SSE_MAX_CPUS];
 } ARMSSE;
 
 typedef struct ARMSSEInfo ARMSSEInfo;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
     bool has_cachectrl;
     bool has_cpusecctrl;
     bool has_cpuid;
+    Property *props;
+};
+
+static Property iotkit_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static Property armsse_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
+    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
+    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
+    DEFINE_PROP_END_OF_LIST()
 };
 
 static const ARMSSEInfo armsse_variants[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = false,
         .has_cpusecctrl = false,
         .has_cpuid = false,
+        .props = iotkit_properties,
     },
     {
         .name = TYPE_SSE200,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = true,
         .has_cpusecctrl = true,
         .has_cpuid = true,
+        .props = armsse_properties,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 return;
             }
         }
+        if (!s->cpu_fpu[i]) {
+            object_property_set_bool(cpuobj, false, "vfp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
+        if (!s->cpu_dsp[i]) {
+            object_property_set_bool(cpuobj, false, "dsp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
 
         if (i > 0) {
             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
     }
 };
 
-static Property armsse_properties[] = {
-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-    DEFINE_PROP_END_OF_LIST()
-};
-
 static void armsse_reset(DeviceState *dev)
 {
     ARMSSE *s = ARMSSE(dev);
@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
     ARMSSEClass *asc = ARMSSE_CLASS(klass);
+    const ARMSSEInfo *info = data;
 
     dc->realize = armsse_realize;
     dc->vmsd = &armsse_vmstate;
-    dc->props = armsse_properties;
+    dc->props = info->props;
     dc->reset = armsse_reset;
     iic->check = armsse_idau_check;
-    asc->info = data;
+    asc->info = info;
 }
 
 static const TypeInfo armsse_info = {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    /*
+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+     */
+    if (mmc->type == MUSCA_B1) {
+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
+    }
     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
                              &error_fatal);
 
-- 
2.20.1

The GIC ID registers cover an area 0x30 bytes in size
(12 registers, 4 bytes each). We were incorrectly decoding
only the first 0x20 bytes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c   | 4 ++--
 hw/intc/arm_gicv3_redist.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
         }
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
         /* ID registers */
         *data = gicv3_idreg(offset - GICD_IDREGS);
         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
         gicd_write_irouter(s, attrs, irq, r);
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
     case GICD_TYPER:
     case GICD_IIDR:
         /* RO registers, ignore the write */
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
         }
         *data = cs->gicr_nsacr;
         return MEMTX_OK;
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         *data = gicv3_idreg(offset - GICR_IDREGS);
         return MEMTX_OK;
     default:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         return MEMTX_OK;
     case GICR_IIDR:
     case GICR_TYPER:
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         /* RO registers, ignore the write */
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest write to RO register at offset "
-- 
2.20.1

The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
if the security extension is unsupported. "Security extension
unsupported" always implies GICD_CTLR.DS == 1, but the guest can
also set DS on a GIC which does support the security extension.
Fix the condition to correctly check the GICD_CTLR.DS bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
          * ITLinesNumber == (num external irqs / 32) - 1
          */
         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+        /*
+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
+         * "security extensions not supported" always implies DS == 1,
+         * so we only need to check the DS bit.
+         */
+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
             (0xf << 19) | itlinesnumber;
         return MEMTX_OK;
     }
-- 
2.20.1

We want to use vfp_expand_imm() in the AArch32 VFP decode;
move it from the a64-only header/source file to the
AArch32 one (which is always compiled even for AArch64).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
---
 target/arm/translate-a64.h     |  1 -
 target/arm/translate.h         |  7 +++++++
 target/arm/translate-a64.c     | 32 --------------------------------
 target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 33 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
 TCGv_ptr get_fpstatus_ptr(bool);
 bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
                             unsigned int imms, unsigned int immr);
-uint64_t vfp_expand_imm(int size, uint8_t imm8);
 bool sve_access_check(DisasContext *s);
 
 /* We should have at some point before trying to access an FP register
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
+/*
+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
+ * instruction, expand it to the actual constant value of the specified
+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8);
+
 /* Vector operations shared between ARM and AArch64.  */
 extern const GVecGen3 mla_op[4];
 extern const GVecGen3 mls_op[4];
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
- */
-uint64_t vfp_expand_imm(int size, uint8_t imm8)
-{
-    uint64_t imm;
-
-    switch (size) {
-    case MO_64:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-        break;
-    case MO_32:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-        break;
-    case MO_16:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
-            (extract32(imm8, 0, 6) << 6);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    return imm;
-}
-
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.inc.c"
 #include "decode-vfp-uncond.inc.c"
 
+/*
+ * The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    case MO_16:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+            (extract32(imm8, 0, 6) << 6);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /*
  * Return the offset of a 16-bit half of the specified VFP single-precision
  * register. If top is true, returns the top 16 bits; otherwise the bottom
-- 
2.20.1

The AArch32 VMOV (immediate) instruction uses the same VFP encoded
immediate format we already handle in vfp_expand_imm().  Use that
function rather than hand-decoding it.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++------------------------
 target/arm/vfp.decode          | 10 ++++++----
 2 files changed, 10 insertions(+), 28 deletions(-)

Where Neon instructions are floating point operations, we
mostly use the old VFP utility functions like gen_vfp_abs()
which work on the TCG globals cpu_F0s and cpu_F1s. The
Neon for-each-element loop conditionally loads the inputs
into either a plain old TCG temporary for most operations
or into cpu_F0s for float operations, and similarly stores
back either cpu_F0s or the temporary.

Switch NEON_2RM_VABS_F away from using cpu_F0s, and
update neon_2rm_is_float_op() accordingly.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_abs(int dp)
-{
-    if (dp)
-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
-}
-
 static inline void gen_vfp_neg(int dp)
 {
     if (dp)
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 
 static int neon_2rm_is_float_op(int op)
 {
-    /* Return true if this neon 2reg-misc op is float-to-float */
-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
+    /*
+     * Return true if this neon 2reg-misc op is float-to-float.
+     * This is not a property of the operation but of our code --
+     * what we are asking here is "does the code for this case in
+     * the Neon for-each-pass loop use cpu_F0s?".
+     */
+    return (op == NEON_2RM_VNEG_F ||
             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VABS_F:
-                            gen_vfp_abs(0);
+                            gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
                             gen_vfp_neg(0);
-- 
2.20.1

Switch NEON_2RM_VABS_F away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_neg(int dp)
-{
-    if (dp)
-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
-}
-
 #define VFP_GEN_ITOF(name) \
 static inline void gen_vfp_##name(int dp, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return (op == NEON_2RM_VNEG_F ||
-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
-                            gen_vfp_neg(0);
+                            gen_helper_vfp_negs(tmp, tmp);
                             break;
                         case NEON_2RM_VSWP:
                             tmp2 = neon_load_reg(rd, pass);
-- 
2.20.1

Switch NEON_2RM_VRINT* away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-            op == NEON_2RM_VRINTM ||
-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
 }
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
-                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints(tmp, tmp, fpstatus);
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
                             tcg_temp_free_ptr(fpstatus);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRINTX:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-            op >= NEON_2RM_VRECPE_F);
+    return op >= NEON_2RM_VRECPE_F;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                                       cpu_env);
 
                             if (is_signed) {
-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_tosls(tmp, tmp,
                                                      tcg_shift, fpst);
                             } else {
-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_touls(tmp, tmp,
                                                      tcg_shift, fpst);
                             }
 
-- 
2.20.1

Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return op >= NEON_2RM_VRECPE_F;
+    return op >= NEON_2RM_VCVT_FS;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRECPE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
                         case NEON_2RM_VRSQRTE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
Since this is the last user of cpu_F0s in the Neon 2rm-op
loop, we can remove the handling code for it too.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_ITOF(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_ITOF(uito)
-VFP_GEN_ITOF(sito)
-#undef VFP_GEN_ITOF
-
-#define VFP_GEN_FTOI(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_FTOI(touiz)
-VFP_GEN_FTOI(tosiz)
-#undef VFP_GEN_FTOI
-
 #define VFP_GEN_FIX(name, round) \
 static inline void gen_vfp_##name(int dp, int shift, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 #define NEON_2RM_VCVT_SF 62
 #define NEON_2RM_VCVT_UF 63
 
-static int neon_2rm_is_float_op(int op)
-{
-    /*
-     * Return true if this neon 2reg-misc op is float-to-float.
-     * This is not a property of the operation but of our code --
-     * what we are asking here is "does the code for this case in
-     * the Neon for-each-pass loop use cpu_F0s?".
-     */
-    return op >= NEON_2RM_VCVT_FS;
-}
-
 static bool neon_2rm_is_v8_op(int op)
 {
     /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 default:
                 elementwise:
                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rm, pass));
-                            tmp = NULL;
-                        } else {
-                            tmp = neon_load_reg(rm, pass);
-                        }
+                        tmp = neon_load_reg(rm, pass);
                         switch (op) {
                         case NEON_2RM_VREV32:
                             switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
-                            gen_vfp_sito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
-                            gen_vfp_uito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
-                            gen_vfp_tosiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
-                            gen_vfp_touiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         default:
                             /* Reserved op values were caught by the
                              * neon_2rm_sizes[] check earlier.
                              */
                             abort();
                         }
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rd, pass));
-                        } else {
-                            neon_store_reg(rd, pass, tmp);
-                        }
+                        neon_store_reg(rd, pass, tmp);
                     }
                     break;
                 }
-- 
2.20.1

Stop using cpu_F0s in the Neon VCVT fixed-point operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
---
 target/arm/translate.c | 62 +++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
 /* Function prototypes for gen_ functions calling Neon helpers.  */
 typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
                                  TCGv_i32, TCGv_i32);
+/* Function prototypes for gen_ functions for fix point conversions */
+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_FIX(name, round) \
-static inline void gen_vfp_##name(int dp, int shift, int neon) \
-{ \
-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
-                                        statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
-                                        statusptr); \
-    } \
-    tcg_temp_free_i32(tmp_shift); \
-    tcg_temp_free_ptr(statusptr); \
-}
-VFP_GEN_FIX(tosl, _round_to_zero)
-VFP_GEN_FIX(toul, _round_to_zero)
-VFP_GEN_FIX(slto, )
-VFP_GEN_FIX(ulto, )
-#undef VFP_GEN_FIX
-
 static inline long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 }
             } else if (op >= 14) {
                 /* VCVT fixed-point.  */
+                TCGv_ptr fpst;
+                TCGv_i32 shiftv;
+                VFPGenFixPointFn *fn;
+
                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
                     return 1;
                 }
+
+                if (!(op & 1)) {
+                    if (u) {
+                        fn = gen_helper_vfp_ultos;
+                    } else {
+                        fn = gen_helper_vfp_sltos;
+                    }
+                } else {
+                    if (u) {
+                        fn = gen_helper_vfp_touls_round_to_zero;
+                    } else {
+                        fn = gen_helper_vfp_tosls_round_to_zero;
+                    }
+                }
+
                 /* We have already masked out the must-be-1 top bit of imm6,
                  * hence this 32-shift where the ARM ARM has 64-imm6.
                  */
                 shift = 32 - shift;
+                fpst = get_fpstatus_ptr(1);
+                shiftv = tcg_const_i32(shift);
                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
-                    if (!(op & 1)) {
-                        if (u)
-                            gen_vfp_ulto(0, shift, 1);
-                        else
-                            gen_vfp_slto(0, shift, 1);
-                    } else {
-                        if (u)
-                            gen_vfp_toul(0, shift, 1);
-                        else
-                            gen_vfp_tosl(0, shift, 1);
-                    }
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
+                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
+                    fn(tmpf, tmpf, shiftv, fpst);
+                    neon_store_reg(rd, pass, tmpf);
                 }
+                tcg_temp_free_ptr(fpst);
+                tcg_temp_free_i32(shiftv);
             } else {
                 return 1;
             }
-- 
2.20.1

Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
 * don't use cpu_F0s
 * don't use tcg_gen_ld_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_st_f32 tcg_gen_st_i32
 
 #define ARM_CP_RW_BIT   (1 << 20)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         q || (rm & 1)) {
                         return 1;
                     }
-                    tmp = tcg_temp_new_i32();
-                    tmp2 = tcg_temp_new_i32();
                     fpst = get_fpstatus_ptr(true);
                     ahp = get_ahp_flag();
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+                    tmp = neon_load_reg(rm, 0);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp2 = neon_load_reg(rm, 1);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
                     tcg_gen_shli_i32(tmp2, tmp2, 16);
                     tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
+                    tcg_temp_free_i32(tmp);
+                    tmp = neon_load_reg(rm, 2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp3 = neon_load_reg(rm, 3);
                     neon_store_reg(rd, 0, tmp2);
-                    tmp2 = tcg_temp_new_i32();
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
-                    tcg_gen_shli_i32(tmp2, tmp2, 16);
-                    tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    neon_store_reg(rd, 1, tmp2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
+                    neon_store_reg(rd, 1, tmp3);
                     tcg_temp_free_i32(tmp);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
-- 
2.20.1

Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
 * don't use CPU_F0s
 * don't use tcg_gen_st_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_st_f32 tcg_gen_st_i32
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP decoder */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp = neon_load_reg(rm, 0);
                     tmp2 = neon_load_reg(rm, 1);
                     tcg_gen_ext16u_i32(tmp3, tmp);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
-                    tcg_gen_shri_i32(tmp3, tmp, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
-                    tcg_temp_free_i32(tmp);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 0, tmp3);
+                    tcg_gen_shri_i32(tmp, tmp, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
+                    neon_store_reg(rd, 1, tmp);
+                    tmp3 = tcg_temp_new_i32();
                     tcg_gen_ext16u_i32(tmp3, tmp2);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
-                    tcg_gen_shri_i32(tmp3, tmp2, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
-                    tcg_temp_free_i32(tmp2);
-                    tcg_temp_free_i32(tmp3);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 2, tmp3);
+                    tcg_gen_shri_i32(tmp2, tmp2, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
+                    neon_store_reg(rd, 3, tmp2);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
                     break;
-- 
2.20.1

Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.

cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
cpu_V1 are used by both iwmmxt and Neon.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
 TCGv_i64 cpu_exclusive_addr;
 TCGv_i64 cpu_exclusive_val;
 
-/* FIXME:  These should be removed.  */
-static TCGv_i32 cpu_F0s, cpu_F1s;
-static TCGv_i64 cpu_F0d, cpu_F1d;
-
 #include "exec/gen-icount.h"
 
 static const char * const regnames[] =
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->base.max_insns = MIN(dc->base.max_insns, bound);
     }
 
-    cpu_F0s = tcg_temp_new_i32();
-    cpu_F1s = tcg_temp_new_i32();
-    cpu_F0d = tcg_temp_new_i64();
-    cpu_F1d = tcg_temp_new_i64();
-    cpu_V0 = cpu_F0d;
-    cpu_V1 = cpu_F1d;
+    cpu_V0 = tcg_temp_new_i64();
+    cpu_V1 = tcg_temp_new_i64();
     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
     cpu_M0 = tcg_temp_new_i64();
 }
-- 
2.20.1

In several places cut and paste errors meant we were using the wrong
type for the 'arg' struct in trans_ functions called by the
decodetree decoder, because we were using the _sp version of the
struct in the _dp function.  These were harmless, because the two
structs were identical and so decodetree made them typedefs of the
same underlying structure (and we'd have had a compile error if they
were not harmless), but we should clean them up anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
     return true;
 }
 
-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
 {
     TCGv_i32 tmp;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
     return true;
 }
 
-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
 {
     uint32_t offset;
     TCGv_i32 addr;
@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     gen_helper_vfp_negd(vd, vd);
 }
 
-static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
+static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
+static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
+static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
     return true;
 }
 
-static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
+static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 {
     /*
      * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
     return true;
 }
 
-static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
+static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
     return true;
 }
 
-static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
+static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
-- 
2.20.1

The architecture permits FPUs which have only single-precision
support, not double-precision; Cortex-M4 and Cortex-M33 are
both like that. Add the necessary checks on the MVFR0 FPDP
field so that we UNDEF any double-precision instructions on
CPUs like this.

Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
VLDM/VSTM, VLDR/VSTR which take double precision registers
still exist.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
---
 target/arm/cpu.h               |  6 +++
 target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
 }
 
+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
+{
+    /* Return true if CPU supports double precision floating point */
+    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
+}
+
 /*
  * We always set the FP and SIMD FP16 fields to indicate identical
  * levels of support (assuming SIMD is implemented at all), so
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         ((a->vm | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
-- 
2.20.1

Most of this is the Neon decodetree patches, followed by Edgar's versal cleanups.

thanks
-- PMM

The following changes since commit 2ef486e76d64436be90f7359a3071fb2a56ce835:

Merge remote-tracking branch 'remotes/marcel/tags/rdma-pull-request' into staging (2020-05-03 14:12:56 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200504

for you to fetch changes up to 9aefc6cf9b73f66062d2f914a0136756e7a28211:

target/arm: Move gen_ function typedefs to translate.h (2020-05-04 12:59:26 +0100)

----------------------------------------------------------------
target-arm queue:
 * Start of conversion of Neon insns to decodetree
 * versal board: support SD and RTC
 * Implement ARMv8.2-TTS2UXN
 * Make VQDMULL undefined when U=1
 * Some minor code cleanups

----------------------------------------------------------------
Edgar E. Iglesias (11):
      hw/arm: versal: Remove inclusion of arm_gicv3_common.h
      hw/arm: versal: Move misplaced comment
      hw/arm: versal-virt: Fix typo xlnx-ve -> xlnx-versal
      hw/arm: versal: Embed the UARTs into the SoC type
      hw/arm: versal: Embed the GEMs into the SoC type
      hw/arm: versal: Embed the ADMAs into the SoC type
      hw/arm: versal: Embed the APUs into the SoC type
      hw/arm: versal: Add support for SD
      hw/arm: versal: Add support for the RTC
      hw/arm: versal-virt: Add support for SD
      hw/arm: versal-virt: Add support for the RTC

Fredrik Strupe (1):
      target/arm: Make VQDMULL undefined when U=1

Peter Maydell (25):
      target/arm: Don't use a TLB for ARMMMUIdx_Stage2
      target/arm: Use enum constant in get_phys_addr_lpae() call
      target/arm: Add new 's1_is_el0' argument to get_phys_addr_lpae()
      target/arm: Implement ARMv8.2-TTS2UXN
      target/arm: Use correct variable for setting 'max' cpu's ID_AA64DFR0
      target/arm/translate-vfp.inc.c: Remove duplicate simd_r32 check
      target/arm: Don't allow Thumb Neon insns without FEATURE_NEON
      target/arm: Add stubs for AArch32 Neon decodetree
      target/arm: Convert VCMLA (vector) to decodetree
      target/arm: Convert VCADD (vector) to decodetree
      target/arm: Convert V[US]DOT (vector) to decodetree
      target/arm: Convert VFM[AS]L (vector) to decodetree
      target/arm: Convert VCMLA (scalar) to decodetree
      target/arm: Convert V[US]DOT (scalar) to decodetree
      target/arm: Convert VFM[AS]L (scalar) to decodetree
      target/arm: Convert Neon load/store multiple structures to decodetree
      target/arm: Convert Neon 'load single structure to all lanes' to decodetree
      target/arm: Convert Neon 'load/store single structure' to decodetree
      target/arm: Convert Neon 3-reg-same VADD/VSUB to decodetree
      target/arm: Convert Neon 3-reg-same logic ops to decodetree
      target/arm: Convert Neon 3-reg-same VMAX/VMIN to decodetree
      target/arm: Convert Neon 3-reg-same comparisons to decodetree
      target/arm: Convert Neon 3-reg-same VQADD/VQSUB to decodetree
      target/arm: Convert Neon 3-reg-same VMUL, VMLA, VMLS, VSHL to decodetree
      target/arm: Move gen_ function typedefs to translate.h

Philippe Mathieu-Daudé (2):
      hw/arm/mps2-tz: Use TYPE_IOTKIT instead of hardcoded string
      target/arm: Use uint64_t for midr field in CPU state struct

include/hw/arm/xlnx-versal.h    |  31 +-
 target/arm/cpu-param.h          |   2 +-
 target/arm/cpu.h                |  38 ++-
 target/arm/translate-a64.h      |   9 -
 target/arm/translate.h          |  26 ++
 target/arm/neon-dp.decode       |  86 +++++
 target/arm/neon-ls.decode       |  52 +++
 target/arm/neon-shared.decode   |  66 ++++
 hw/arm/mps2-tz.c                |   2 +-
 hw/arm/xlnx-versal-virt.c       |  74 ++++-
 hw/arm/xlnx-versal.c            | 115 +++++--
 target/arm/cpu.c                |   3 +-
 target/arm/cpu64.c              |   8 +-
 target/arm/helper.c             | 183 ++++------
 target/arm/translate-a64.c      |  17 -
 target/arm/translate-neon.inc.c | 714 +++++++++++++++++++++++++++++++++++++++
 target/arm/translate-vfp.inc.c  |   6 -
 target/arm/translate.c          | 716 +++-------------------------------------
 target/arm/Makefile.objs        |  18 +
 19 files changed, 1302 insertions(+), 864 deletions(-)
 create mode 100644 target/arm/neon-dp.decode
 create mode 100644 target/arm/neon-ls.decode
 create mode 100644 target/arm/neon-shared.decode
 create mode 100644 target/arm/translate-neon.inc.c

From: Fredrik Strupe <fredrik@strupe.net>

According to Arm ARM, VQDMULL is only valid when U=0, while having
U=1 is unallocated.

Signed-off-by: Fredrik Strupe <fredrik@strupe.net>
Fixes: 695272dcb976 ("target-arm: Handle UNDEF cases for Neon 3-regs-different-widths")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     {0, 0, 0, 0}, /* VMLSL */
                     {0, 0, 0, 9}, /* VQDMLSL */
                     {0, 0, 0, 0}, /* Integer VMULL */
-                    {0, 0, 0, 1}, /* VQDMULL */
+                    {0, 0, 0, 9}, /* VQDMULL */
                     {0, 0, 0, 0xa}, /* Polynomial VMULL */
                     {0, 0, 0, 7}, /* Reserved: always UNDEF */
                 };
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

By using the TYPE_* definitions for devices, we can:
 - quickly find where devices are used with 'git-grep'
 - easily rename a device (one-line change).

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200428154650.21991-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/mps2-tz.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
-    sysbus_init_child_obj(OBJECT(machine), "iotkit", &mms->iotkit,
+    sysbus_init_child_obj(OBJECT(machine), TYPE_IOTKIT, &mms->iotkit,
                           sizeof(mms->iotkit), mmc->armsse_type);
     iotkitdev = DEVICE(&mms->iotkit);
     object_property_set_link(OBJECT(&mms->iotkit), OBJECT(system_memory),
-- 
2.20.1

We define ARMMMUIdx_Stage2 as being an MMU index which uses a QEMU
TLB.  However we never actually use the TLB -- all stage 2 lookups
are done by direct calls to get_phys_addr_lpae() followed by a
physical address load via address_space_ld*().

Remove Stage2 from the list of ARM MMU indexes which correspond to
real core MMU indexes, and instead put it in the set of "NOTLB" ARM
MMU indexes.

This allows us to drop NB_MMU_MODES to 11.  It also means we can
safely add support for the ARMv8.3-TTS2UXN extension, which adds
permission bits to the stage 2 descriptors which define execute
permission separatel for EL0 and EL1; supporting that while keeping
Stage2 in a QEMU TLB would require us to use separate TLBs for
"Stage2 for an EL0 access" and "Stage2 for an EL1 access", which is a
lot of extra complication given we aren't even using the QEMU TLB.

In the process of updating the comment on our MMU index use,
fix a couple of other minor errors:
 * NS EL2 EL2&0 was missing from the list in the comment
 * some text hadn't been updated from when we bumped NB_MMU_MODES
   above 8

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330210400.11724-2-peter.maydell@linaro.org
---
 target/arm/cpu-param.h |   2 +-
 target/arm/cpu.h       |  21 +++++---
 target/arm/helper.c    | 112 ++++-------------------------------------
 3 files changed, 27 insertions(+), 108 deletions(-)

diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -XXX,XX +XXX,XX @@
 # define TARGET_PAGE_BITS_MIN  10
 #endif
 
-#define NB_MMU_MODES 12
+#define NB_MMU_MODES 11
 
 #endif
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  *     handling via the TLB. The only way to do a stage 1 translation without
  *     the immediate stage 2 translation is via the ATS or AT system insns,
  *     which can be slow-pathed and always do a page table walk.
+ *     The only use of stage 2 translations is either as part of an s1+2
+ *     lookup or when loading the descriptors during a stage 1 page table walk,
+ *     and in both those cases we don't use the TLB.
  *  4. we can also safely fold together the "32 bit EL3" and "64 bit EL3"
  *     translation regimes, because they map reasonably well to each other
  *     and they can't both be active at the same time.
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  * NS EL1 EL1&0 stage 1+2 (aka NS PL1)
  * NS EL1 EL1&0 stage 1+2 +PAN
  * NS EL0 EL2&0
+ * NS EL2 EL2&0
  * NS EL2 EL2&0 +PAN
  * NS EL2 (aka NS PL2)
  * S EL0 EL1&0 (aka S PL0)
  * S EL1 EL1&0 (not used if EL3 is 32 bit)
  * S EL1 EL1&0 +PAN
  * S EL3 (aka S PL1)
- * NS EL1&0 stage 2
  *
- * for a total of 12 different mmu_idx.
+ * for a total of 11 different mmu_idx.
  *
  * R profile CPUs have an MPU, but can use the same set of MMU indexes
  * as A profile. They only need to distinguish NS EL0 and NS EL1 (and
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
  * are not quite the same -- different CPU types (most notably M profile
  * vs A/R profile) would like to use MMU indexes with different semantics,
  * but since we don't ever need to use all of those in a single CPU we
- * can avoid setting NB_MMU_MODES to more than 8. The lower bits of
+ * can avoid having to set NB_MMU_MODES to "total number of A profile MMU
+ * modes + total number of M profile MMU modes". The lower bits of
  * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
  * the same for any particular CPU.
  * Variables of type ARMMUIdx are always full values, and the core
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_SE10_1_PAN = 9 | ARM_MMU_IDX_A,
     ARMMMUIdx_SE3        = 10 | ARM_MMU_IDX_A,
 
-    ARMMMUIdx_Stage2     = 11 | ARM_MMU_IDX_A,
-
     /*
      * These are not allocated TLBs and are used only for AT system
      * instructions or for the first stage of an S12 page table walk.
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
+    /*
+     * Not allocated a TLB: used only for second stage of an S12 page
+     * table walk, or for descriptor loads during first stage of an S1
+     * page table walk. Note that if we ever want to have a TLB for this
+     * then various TLB flush insns which currently are no-ops or flush
+     * only stage 1 MMU indexes will need to change to flush stage 2.
+     */
+    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
 
     /*
      * M-profile.
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
     TO_CORE_BIT(SE10_1),
     TO_CORE_BIT(SE10_1_PAN),
     TO_CORE_BIT(SE3),
-    TO_CORE_BIT(Stage2),
 
     TO_CORE_BIT(MUser),
     TO_CORE_BIT(MPriv),
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_write(CPUARMState *env, const ARMCPRegInfo *ri,
     tlb_flush_by_mmuidx(cs,
                         ARMMMUIdxBit_E10_1 |
                         ARMMMUIdxBit_E10_1_PAN |
-                        ARMMMUIdxBit_E10_0 |
-                        ARMMMUIdxBit_Stage2);
+                        ARMMMUIdxBit_E10_0);
 }
 
 static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbiall_nsnh_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     tlb_flush_by_mmuidx_all_cpus_synced(cs,
                                         ARMMMUIdxBit_E10_1 |
                                         ARMMMUIdxBit_E10_1_PAN |
-                                        ARMMMUIdxBit_E10_0 |
-                                        ARMMMUIdxBit_Stage2);
+                                        ARMMMUIdxBit_E10_0);
 }
 
-static void tlbiipas2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                            uint64_t value)
-{
-    /* Invalidate by IPA. This has to invalidate any structures that
-     * contain only stage 2 translation information, but does not need
-     * to apply to structures that contain combined stage 1 and stage 2
-     * translation information.
-     * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
-     */
-    CPUState *cs = env_cpu(env);
-    uint64_t pageaddr;
-
-    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
-        return;
-    }
-
-    pageaddr = sextract64(value << 12, 0, 40);
-
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);
-}
-
-static void tlbiipas2_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                               uint64_t value)
-{
-    CPUState *cs = env_cpu(env);
-    uint64_t pageaddr;
-
-    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
-        return;
-    }
-
-    pageaddr = sextract64(value << 12, 0, 40);
-
-    tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             ARMMMUIdxBit_Stage2);
-}
 
 static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
                               uint64_t value)
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         tlb_flush_by_mmuidx(cs,
                             ARMMMUIdxBit_E10_1 |
                             ARMMMUIdxBit_E10_1_PAN |
-                            ARMMMUIdxBit_E10_0 |
-                            ARMMMUIdxBit_Stage2);
+                            ARMMMUIdxBit_E10_0);
         raw_write(env, ri, value);
     }
 }
@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
         return ARMMMUIdxBit_SE10_1 |
                ARMMMUIdxBit_SE10_1_PAN |
                ARMMMUIdxBit_SE10_0;
-    } else if (arm_feature(env, ARM_FEATURE_EL2)) {
-        return ARMMMUIdxBit_E10_1 |
-               ARMMMUIdxBit_E10_1_PAN |
-               ARMMMUIdxBit_E10_0 |
-               ARMMMUIdxBit_Stage2;
     } else {
         return ARMMMUIdxBit_E10_1 |
                ARMMMUIdxBit_E10_1_PAN |
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
                                              ARMMMUIdxBit_SE3);
 }
 
-static void tlbi_aa64_ipas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                                    uint64_t value)
-{
-    /* Invalidate by IPA. This has to invalidate any structures that
-     * contain only stage 2 translation information, but does not need
-     * to apply to structures that contain combined stage 1 and stage 2
-     * translation information.
-     * This must NOP if EL2 isn't implemented or SCR_EL3.NS is zero.
-     */
-    ARMCPU *cpu = env_archcpu(env);
-    CPUState *cs = CPU(cpu);
-    uint64_t pageaddr;
-
-    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
-        return;
-    }
-
-    pageaddr = sextract64(value << 12, 0, 48);
-
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_Stage2);
-}
-
-static void tlbi_aa64_ipas2e1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                                      uint64_t value)
-{
-    CPUState *cs = env_cpu(env);
-    uint64_t pageaddr;
-
-    if (!arm_feature(env, ARM_FEATURE_EL2) || !(env->cp15.scr_el3 & SCR_NS)) {
-        return;
-    }
-
-    pageaddr = sextract64(value << 12, 0, 48);
-
-    tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             ARMMMUIdxBit_Stage2);
-}
-
 static CPAccessResult aa64_zva_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                       bool isread)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = tlbi_aa64_vae1_write },
     { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1is_write },
+      .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1is_write },
+      .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = tlbi_aa64_alle1is_write },
     { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1_write },
+      .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1_write },
+      .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = tlbimva_hyp_is_write },
     { .name = "TLBIIPAS2",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_write },
+      .type = ARM_CP_NOP, .access = PL2_W },
     { .name = "TLBIIPAS2IS",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_is_write },
+      .type = ARM_CP_NOP, .access = PL2_W },
     { .name = "TLBIIPAS2L",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_write },
+      .type = ARM_CP_NOP, .access = PL2_W },
     { .name = "TLBIIPAS2LIS",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_is_write },
+      .type = ARM_CP_NOP, .access = PL2_W },
     /* 32 bit cache operations */
     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = aa64_cacheop_pou_access },
-- 
2.20.1

The access_type argument to get_phys_addr_lpae() is an MMUAccessType;
use the enum constant MMU_DATA_LOAD rather than a literal 0 when we
call it in S1_ptw_translate().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330210400.11724-3-peter.maydell@linaro.org
---
 target/arm/helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             pcacheattrs = &cacheattrs;
         }
 
-        ret = get_phys_addr_lpae(env, addr, 0, ARMMMUIdx_Stage2, &s2pa,
-                                 &txattrs, &s2prot, &s2size, fi, pcacheattrs);
+        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
+                                 &s2pa, &txattrs, &s2prot, &s2size, fi,
+                                 pcacheattrs);
         if (ret) {
             assert(fi->type != ARMFault_None);
             fi->s2addr = addr;
-- 
2.20.1

For ARMv8.2-TTS2UXN, the stage 2 page table walk wants to know
whether the stage 1 access is for EL0 or not, because whether
exec permission is given can depend on whether this is an EL0
or EL1 access. Add a new argument to get_phys_addr_lpae() so
the call sites can pass this information in.

Since get_phys_addr_lpae() doesn't already have a doc comment,
add one so we have a place to put the documentation of the
semantics of the new s1_is_el0 argument.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330210400.11724-4-peter.maydell@linaro.org
---
 target/arm/helper.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                               bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr,
                                ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs);
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         }
 
         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
+                                 false,
                                  &s2pa, &txattrs, &s2prot, &s2size, fi,
                                  pcacheattrs);
         if (ret) {
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
     };
 }
 
+/**
+ * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
+ *
+ * Returns false if the translation was successful. Otherwise, phys_ptr, attrs,
+ * prot and page_size may not be filled in, and the populated fsr value provides
+ * information on why the translation aborted, in the format of a long-format
+ * DFSR/IFSR fault register, with the following caveats:
+ *  * the WnR bit is never set (the caller must do this).
+ *
+ * @env: CPUARMState
+ * @address: virtual address to get physical address for
+ * @access_type: MMU_DATA_LOAD, MMU_DATA_STORE or MMU_INST_FETCH
+ * @mmu_idx: MMU index indicating required translation regime
+ * @s1_is_el0: if @mmu_idx is ARMMMUIdx_Stage2 (so this is a stage 2 page table
+ *             walk), must be true if this is stage 2 of a stage 1+2 walk for an
+ *             EL0 access). If @mmu_idx is anything else, @s1_is_el0 is ignored.
+ * @phys_ptr: set to the physical address corresponding to the virtual address
+ * @attrs: set to the memory transaction attributes to use
+ * @prot: set to the permissions for the page containing phys_ptr
+ * @page_size_ptr: set to the size of the page containing phys_ptr
+ * @fi: set to fault info if the translation fails
+ * @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes
+ */
 static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                               bool s1_is_el0,
                                hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,
                                target_ulong *page_size_ptr,
                                ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
             /* S1 is done. Now do S2 translation.  */
             ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2,
+                                     mmu_idx == ARMMMUIdx_E10_0,
                                      phys_ptr, attrs, &s2_prot,
                                      page_size, fi,
                                      cacheattrs != NULL ? &cacheattrs2 : NULL);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
     }
 
     if (regime_using_lpae_format(env, mmu_idx)) {
-        return get_phys_addr_lpae(env, address, access_type, mmu_idx,
+        return get_phys_addr_lpae(env, address, access_type, mmu_idx, false,
                                   phys_ptr, attrs, prot, page_size,
                                   fi, cacheattrs);
     } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
-- 
2.20.1

The ARMv8.2-TTS2UXN feature extends the XN field in stage 2
translation table descriptors from just bit [54] to bits [54:53],
allowing stage 2 to control execution permissions separately for EL0
and EL1. Implement the new semantics of the XN field and enable
the feature for our 'max' CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330210400.11724-5-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 15 +++++++++++++++
 target/arm/cpu.c    |  1 +
 target/arm/cpu64.c  |  2 ++
 target/arm/helper.c | 37 +++++++++++++++++++++++++++++++------
 4 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
     return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
 }
 
+static inline bool isar_feature_aa32_tts2uxn(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, XNX) != 0;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
 }
 
+static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
     return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
 }
 
+static inline bool isar_feature_any_tts2uxn(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_tts2uxn(id) || isar_feature_aa32_tts2uxn(id);
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
             t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
             t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
             t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
+            t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
             cpu->isar.id_mmfr4 = t;
         }
 #endif
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);
         t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2); /* ATS1E1 */
         t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* VMID16 */
+        t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* TTS2UXN */
         cpu->isar.id_aa64mmfr1 = t;
 
         t = cpu->isar.id_aa64mmfr2;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
         u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
         u = FIELD_DP32(u, ID_MMFR4, CNP, 1); /* TTCNP */
+        u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
         cpu->isar.id_mmfr4 = u;
 
         u = cpu->isar.id_aa64dfr0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
  *
  * @env:     CPUARMState
  * @s2ap:    The 2-bit stage2 access permissions (S2AP)
- * @xn:      XN (execute-never) bit
+ * @xn:      XN (execute-never) bits
+ * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
  */
-static int get_S2prot(CPUARMState *env, int s2ap, int xn)
+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
 {
     int prot = 0;
 
@@ -XXX,XX +XXX,XX @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn)
     if (s2ap & 2) {
         prot |= PAGE_WRITE;
     }
-    if (!xn) {
-        if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
+
+    if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
+        switch (xn) {
+        case 0:
             prot |= PAGE_EXEC;
+            break;
+        case 1:
+            if (s1_is_el0) {
+                prot |= PAGE_EXEC;
+            }
+            break;
+        case 2:
+            break;
+        case 3:
+            if (!s1_is_el0) {
+                prot |= PAGE_EXEC;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    } else {
+        if (!extract32(xn, 1, 1)) {
+            if (arm_el_is_aa64(env, 2) || prot & PAGE_READ) {
+                prot |= PAGE_EXEC;
+            }
         }
     }
     return prot;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
     }
 
     ap = extract32(attrs, 4, 2);
-    xn = extract32(attrs, 12, 1);
 
     if (mmu_idx == ARMMMUIdx_Stage2) {
         ns = true;
-        *prot = get_S2prot(env, ap, xn);
+        xn = extract32(attrs, 11, 2);
+        *prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
         ns = extract32(attrs, 3, 1);
+        xn = extract32(attrs, 12, 1);
         pxn = extract32(attrs, 11, 1);
         *prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
-- 
2.20.1

In aarch64_max_initfn() we update both 32-bit and 64-bit ID
registers.  The intended pattern is that for 64-bit ID registers we
use FIELD_DP64 and the uint64_t 't' register, while 32-bit ID
registers use FIELD_DP32 and the uint32_t 'u' register.  For
ID_AA64DFR0 we accidentally used 'u', meaning that the top 32 bits of
this 64-bit ID register would end up always zero.  Luckily at the
moment that's what they should be anyway, so this bug has no visible
effects.

Use the right-sized variable.

Fixes: 3bec78447a958d481991
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200423110915.10527-1-peter.maydell@linaro.org
---
 target/arm/cpu64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
         cpu->isar.id_mmfr4 = u;
 
-        u = cpu->isar.id_aa64dfr0;
-        u = FIELD_DP64(u, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
-        cpu->isar.id_aa64dfr0 = u;
+        t = cpu->isar.id_aa64dfr0;
+        t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
+        cpu->isar.id_aa64dfr0 = t;
 
         u = cpu->isar.id_dfr0;
         u = FIELD_DP32(u, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

MIDR_EL1 is a 64-bit system register with the top 32-bit being RES0.
Represent it in QEMU's ARMCPU struct with a uint64_t, not a
uint32_t.

This fixes an error when compiling with -Werror=conversion
because we were manipulating the register value using a
local uint64_t variable:

target/arm/cpu64.c: In function ‘aarch64_max_initfn’:
  target/arm/cpu64.c:628:21: error: conversion from ‘uint64_t’ {aka ‘long unsigned int’} to ‘uint32_t’ {aka ‘unsigned int’} may change value [-Werror=conversion]
    628 |         cpu->midr = t;
        |                     ^

and future-proofs us against a possible future architecture
change using some of the top 32 bits.

Suggested-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Laurent Desnogues <laurent.desnogues@gmail.com>
Message-id: 20200428172634.29707-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 2 +-
 target/arm/cpu.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint64_t id_aa64dfr0;
         uint64_t id_aa64dfr1;
     } isar;
-    uint32_t midr;
+    uint64_t midr;
     uint32_t revidr;
     uint32_t reset_fpsid;
     uint32_t ctr;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo arm_cpus[] = {
 static Property arm_cpu_properties[] = {
     DEFINE_PROP_BOOL("start-powered-off", ARMCPU, start_powered_off, false),
     DEFINE_PROP_UINT32("psci-conduit", ARMCPU, psci_conduit, 0),
-    DEFINE_PROP_UINT32("midr", ARMCPU, midr, 0),
+    DEFINE_PROP_UINT64("midr", ARMCPU, midr, 0),
     DEFINE_PROP_UINT64("mp-affinity", ARMCPU,
                         mp_affinity, ARM64_AFFINITY_INVALID),
     DEFINE_PROP_INT32("node-id", ARMCPU, node_id, CPU_UNSET_NUMA_NODE_ID),
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Move misplaced comment.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
 
         obj = object_new(XLNX_VERSAL_ACPU_TYPE);
         if (!obj) {
-            /* Secondary CPUs start in PSCI powered-down state */
             error_report("Unable to create apu.cpu[%d] of type %s",
                          i, XLNX_VERSAL_ACPU_TYPE);
             exit(EXIT_FAILURE);
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
         object_property_set_int(obj, s->cfg.psci_conduit,
                                 "psci-conduit", &error_abort);
         if (i) {
+            /* Secondary CPUs start in PSCI powered-down state */
             object_property_set_bool(obj, true,
                                      "start-powered-off", &error_abort);
         }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Fix typo xlnx-ve -> xlnx-versal.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-4-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
         psci_conduit = QEMU_PSCI_CONDUIT_SMC;
     }
 
-    sysbus_init_child_obj(OBJECT(machine), "xlnx-ve", &s->soc,
+    sysbus_init_child_obj(OBJECT(machine), "xlnx-versal", &s->soc,
                           sizeof(s->soc), TYPE_XLNX_VERSAL);
     object_property_set_link(OBJECT(&s->soc), OBJECT(machine->ram),
                              "ddr", &error_abort);
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the UARTs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-5-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  3 ++-
 hw/arm/xlnx-versal.c         | 12 ++++++------
 2 files changed, 8 insertions(+), 7 deletions(-)

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the GEMs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  3 ++-
 hw/arm/xlnx-versal.c         | 15 ++++++++-------
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/boot.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
+#include "hw/net/cadence_gem.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 
         struct {
             PL011State uart[XLNX_VERSAL_NR_UARTS];
-            SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];
+            CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
             SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];
         } iou;
     } lpd;
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)
         DeviceState *dev;
         MemoryRegion *mr;
 
-        dev = qdev_create(NULL, "cadence_gem");
-        s->lpd.iou.gem[i] = SYS_BUS_DEVICE(dev);
-        object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
+        sysbus_init_child_obj(OBJECT(s), name,
+                              &s->lpd.iou.gem[i], sizeof(s->lpd.iou.gem[i]),
+                              TYPE_CADENCE_GEM);
+        dev = DEVICE(&s->lpd.iou.gem[i]);
         if (nd->used) {
             qemu_check_nic_model(nd, "cadence_gem");
             qdev_set_nic_properties(dev, nd);
         }
-        object_property_set_int(OBJECT(s->lpd.iou.gem[i]),
+        object_property_set_int(OBJECT(dev),
                                 2, "num-priority-queues",
                                 &error_abort);
-        object_property_set_link(OBJECT(s->lpd.iou.gem[i]),
+        object_property_set_link(OBJECT(dev),
                                  OBJECT(&s->mr_ps), "dma",
                                  &error_abort);
         qdev_init_nofail(dev);
 
-        mr = sysbus_mmio_get_region(s->lpd.iou.gem[i], 0);
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
         memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
 
-        sysbus_connect_irq(s->lpd.iou.gem[i], 0, pic[irqs[i]]);
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
         g_free(name);
     }
 }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the ADMAs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-7-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  3 ++-
 hw/arm/xlnx-versal.c         | 14 +++++++-------
 2 files changed, 9 insertions(+), 8 deletions(-)

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Embed the APUs into the SoC type.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-8-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  2 +-
 hw/arm/xlnx-versal-virt.c    |  4 ++--
 hw/arm/xlnx-versal.c         | 19 +++++--------------
 3 files changed, 8 insertions(+), 17 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
     struct {
         struct {
             MemoryRegion mr;
-            ARMCPU *cpu[XLNX_VERSAL_NR_ACPUS];
+            ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
             GICv3State gic;
         } apu;
     } fpd;
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
     s->binfo.get_dtb = versal_virt_get_dtb;
     s->binfo.modify_dtb = versal_virt_modify_dtb;
     if (machine->kernel_filename) {
-        arm_load_kernel(s->soc.fpd.apu.cpu[0], machine, &s->binfo);
+        arm_load_kernel(&s->soc.fpd.apu.cpu[0], machine, &s->binfo);
     } else {
-        AddressSpace *as = arm_boot_address_space(s->soc.fpd.apu.cpu[0],
+        AddressSpace *as = arm_boot_address_space(&s->soc.fpd.apu.cpu[0],
                                                   &s->binfo);
         /* Some boot-loaders (e.g u-boot) don't like blobs at address 0 (NULL).
          * Offset things by 4K.  */
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
 
     for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
         Object *obj;
-        char *name;
-
-        obj = object_new(XLNX_VERSAL_ACPU_TYPE);
-        if (!obj) {
-            error_report("Unable to create apu.cpu[%d] of type %s",
-                         i, XLNX_VERSAL_ACPU_TYPE);
-            exit(EXIT_FAILURE);
-        }
-
-        name = g_strdup_printf("apu-cpu[%d]", i);
-        object_property_add_child(OBJECT(s), name, obj, &error_fatal);
-        g_free(name);
 
+        object_initialize_child(OBJECT(s), "apu-cpu[*]",
+                                &s->fpd.apu.cpu[i], sizeof(s->fpd.apu.cpu[i]),
+                                XLNX_VERSAL_ACPU_TYPE, &error_abort, NULL);
+        obj = OBJECT(&s->fpd.apu.cpu[i]);
         object_property_set_int(obj, s->cfg.psci_conduit,
                                 "psci-conduit", &error_abort);
         if (i) {
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_cpus(Versal *s)
         object_property_set_link(obj, OBJECT(&s->fpd.apu.mr), "memory",
                                  &error_abort);
         object_property_set_bool(obj, true, "realized", &error_fatal);
-        s->fpd.apu.cpu[i] = ARM_CPU(obj);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
     }
 
     for (i = 0; i < nr_apu_cpus; i++) {
-        DeviceState *cpudev = DEVICE(s->fpd.apu.cpu[i]);
+        DeviceState *cpudev = DEVICE(&s->fpd.apu.cpu[i]);
         int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
         qemu_irq maint_irq;
         int ti;
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for SD.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-9-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 12 ++++++++++++
 hw/arm/xlnx-versal.c         | 31 +++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/char/pl011.h"
 #include "hw/dma/xlnx-zdma.h"
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_NR_UARTS   2
 #define XLNX_VERSAL_NR_GEMS    2
 #define XLNX_VERSAL_NR_ADMAS   8
+#define XLNX_VERSAL_NR_SDS     2
 #define XLNX_VERSAL_NR_IRQS    192
 
 typedef struct Versal {
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
         } iou;
     } lpd;
 
+    /* The Platform Management Controller subsystem.  */
+    struct {
+        struct {
+            SDHCIState sd[XLNX_VERSAL_NR_SDS];
+        } iou;
+    } pmc;
+
     struct {
         MemoryRegion *mr_ddr;
         uint32_t psci_conduit;
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define VERSAL_GEM1_IRQ_0          58
 #define VERSAL_GEM1_WAKE_IRQ_0     59
 #define VERSAL_ADMA_IRQ_0          60
+#define VERSAL_SD0_IRQ_0           126
 
 /* Architecturally reserved IRQs suitable for virtualization.  */
 #define VERSAL_RSVD_IRQ_FIRST 111
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
 
+#define MM_PMC_SD0                  0xf1040000U
+#define MM_PMC_SD0_SIZE             0x10000
 #define MM_PMC_CRP                  0xf1260000U
 #define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
     }
 }
 
+#define SDHCI_CAPABILITIES  0x280737ec6481 /* Same as on ZynqMP.  */
+static void versal_create_sds(Versal *s, qemu_irq *pic)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->pmc.iou.sd); i++) {
+        DeviceState *dev;
+        MemoryRegion *mr;
+
+        sysbus_init_child_obj(OBJECT(s), "sd[*]",
+                              &s->pmc.iou.sd[i], sizeof(s->pmc.iou.sd[i]),
+                              TYPE_SYSBUS_SDHCI);
+        dev = DEVICE(&s->pmc.iou.sd[i]);
+
+        object_property_set_uint(OBJECT(dev),
+                                 3, "sd-spec-version", &error_fatal);
+        object_property_set_uint(OBJECT(dev), SDHCI_CAPABILITIES, "capareg",
+                                 &error_fatal);
+        object_property_set_uint(OBJECT(dev), UHS_I, "uhs", &error_fatal);
+        qdev_init_nofail(dev);
+
+        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+        memory_region_add_subregion(&s->mr_ps,
+                                    MM_PMC_SD0 + i * MM_PMC_SD0_SIZE, mr);
+
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                           pic[VERSAL_SD0_IRQ_0 + i * 2]);
+    }
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_uarts(s, pic);
     versal_create_gems(s, pic);
     versal_create_admas(s, pic);
+    versal_create_sds(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

hw/arm: versal: Add support for the RTC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-10-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  8 ++++++++
 hw/arm/xlnx-versal.c         | 21 +++++++++++++++++++++
 2 files changed, 29 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/pl011.h"
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/net/cadence_gem.h"
+#include "hw/rtc/xlnx-zynqmp-rtc.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 #define XLNX_VERSAL(obj) OBJECT_CHECK(Versal, (obj), TYPE_XLNX_VERSAL)
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
         struct {
             SDHCIState sd[XLNX_VERSAL_NR_SDS];
         } iou;
+
+        XlnxZynqMPRTC rtc;
     } pmc;
 
     struct {
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define VERSAL_GEM1_IRQ_0          58
 #define VERSAL_GEM1_WAKE_IRQ_0     59
 #define VERSAL_ADMA_IRQ_0          60
+#define VERSAL_RTC_APB_ERR_IRQ     121
 #define VERSAL_SD0_IRQ_0           126
+#define VERSAL_RTC_ALARM_IRQ       142
+#define VERSAL_RTC_SECONDS_IRQ     143
 
 /* Architecturally reserved IRQs suitable for virtualization.  */
 #define VERSAL_RSVD_IRQ_FIRST 111
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_PMC_SD0_SIZE             0x10000
 #define MM_PMC_CRP                  0xf1260000U
 #define MM_PMC_CRP_SIZE             0x10000
+#define MM_PMC_RTC                  0xf12a0000
+#define MM_PMC_RTC_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_create_sds(Versal *s, qemu_irq *pic)
     }
 }
 
+static void versal_create_rtc(Versal *s, qemu_irq *pic)
+{
+    SysBusDevice *sbd;
+    MemoryRegion *mr;
+
+    sysbus_init_child_obj(OBJECT(s), "rtc", &s->pmc.rtc, sizeof(s->pmc.rtc),
+                          TYPE_XLNX_ZYNQMP_RTC);
+    sbd = SYS_BUS_DEVICE(&s->pmc.rtc);
+    qdev_init_nofail(DEVICE(sbd));
+
+    mr = sysbus_mmio_get_region(sbd, 0);
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_RTC, mr);
+
+    /*
+     * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
+     * supports them.
+     */
+    sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_gems(s, pic);
     versal_create_admas(s, pic);
     versal_create_sds(s, pic);
+    versal_create_rtc(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for SD.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-11-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 46 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/sysbus-fdt.h"
 #include "hw/arm/fdt.h"
 #include "cpu.h"
+#include "hw/qdev-properties.h"
 #include "hw/arm/xlnx-versal.h"
 
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
@@ -XXX,XX +XXX,XX @@ static void fdt_add_zdma_nodes(VersalVirt *s)
     }
 }
 
+static void fdt_add_sd_nodes(VersalVirt *s)
+{
+    const char clocknames[] = "clk_xin\0clk_ahb";
+    const char compat[] = "arasan,sdhci-8.9a";
+    int i;
+
+    for (i = ARRAY_SIZE(s->soc.pmc.iou.sd) - 1; i >= 0; i--) {
+        uint64_t addr = MM_PMC_SD0 + MM_PMC_SD0_SIZE * i;
+        char *name = g_strdup_printf("/sdhci@%" PRIx64, addr);
+
+        qemu_fdt_add_subnode(s->fdt, name);
+
+        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
+                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
+        qemu_fdt_setprop(s->fdt, name, "clock-names",
+                         clocknames, sizeof(clocknames));
+        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, VERSAL_SD0_IRQ_0 + i * 2,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                     2, addr, 2, MM_PMC_SD0_SIZE);
+        qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
+        g_free(name);
+    }
+}
+
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void create_virtio_regions(VersalVirt *s)
     }
 }
 
+static void sd_plugin_card(SDHCIState *sd, DriveInfo *di)
+{
+    BlockBackend *blk = di ? blk_by_legacy_dinfo(di) : NULL;
+    DeviceState *card;
+
+    card = qdev_create(qdev_get_child_bus(DEVICE(sd), "sd-bus"), TYPE_SD_CARD);
+    object_property_add_child(OBJECT(sd), "card[*]", OBJECT(card),
+                              &error_fatal);
+    qdev_prop_set_drive(card, "drive", blk, &error_fatal);
+    object_property_set_bool(OBJECT(card), true, "realized", &error_fatal);
+}
+
 static void versal_virt_init(MachineState *machine)
 {
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
     int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
+    int i;
 
     /*
      * If the user provides an Operating System to be loaded, we expect them
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
     fdt_add_zdma_nodes(s);
+    fdt_add_sd_nodes(s);
     fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
     memory_region_add_subregion_overlap(get_system_memory(),
                                         0, &s->soc.fpd.apu.mr, 0);
 
+    /* Plugin SD cards.  */
+    for (i = 0; i < ARRAY_SIZE(s->soc.pmc.iou.sd); i++) {
+        sd_plugin_card(&s->soc.pmc.iou.sd[i], drive_get_next(IF_SD));
+    }
+
     s->binfo.ram_size = machine->ram_size;
     s->binfo.loader_start = 0x0;
     s->binfo.get_dtb = versal_virt_get_dtb;
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for the RTC.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20200427181649.26851-12-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_sd_nodes(VersalVirt *s)
     }
 }
 
+static void fdt_add_rtc_node(VersalVirt *s)
+{
+    const char compat[] = "xlnx,zynqmp-rtc";
+    const char interrupt_names[] = "alarm\0sec";
+    char *name = g_strdup_printf("/rtc@%x", MM_PMC_RTC);
+
+    qemu_fdt_add_subnode(s->fdt, name);
+
+    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
+                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_ALARM_IRQ,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_SECONDS_IRQ,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
+                     interrupt_names, sizeof(interrupt_names));
+    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+                                 2, MM_PMC_RTC, 2, MM_PMC_RTC_SIZE);
+    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
+    g_free(name);
+}
+
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
     fdt_add_timer_nodes(s);
     fdt_add_zdma_nodes(s);
     fdt_add_sd_nodes(s);
+    fdt_add_rtc_node(s);
     fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
-- 
2.20.1

Somewhere along theline we accidentally added a duplicate
"using D16-D31 when they don't exist" check to do_vfm_dp()
(probably an artifact of a patchseries rebase). Remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200430181003.21682-2-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vd | a->vn | a->vm) & 0x10)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
-- 
2.20.1

We were accidentally permitting decode of Thumb Neon insns even if
the CPU didn't have the FEATURE_NEON bit set, because the feature
check was being done before the call to disas_neon_data_insn() and
disas_neon_ls_insn() in the Arm decoder but was omitted from the
Thumb decoder.  Push the feature bit check down into the called
functions so it is done for both Arm and Thumb encodings.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200430181003.21682-3-peter.maydell@linaro.org
---
 target/arm/translate.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
     TCGv_i32 tmp2;
     TCGv_i64 tmp64;
 
+    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
+        return 1;
+    }
+
     /* FIXME: this access check should not take precedence over UNDEF
      * for invalid encodings; we will generate incorrect syndrome information
      * for attempts to execute invalid vfp/neon encodings with FP disabled.
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     TCGv_ptr ptr1, ptr2, ptr3;
     TCGv_i64 tmp64;
 
+    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
+        return 1;
+    }
+
     /* FIXME: this access check should not take precedence over UNDEF
      * for invalid encodings; we will generate incorrect syndrome information
      * for attempts to execute invalid vfp/neon encodings with FP disabled.
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
 
         if (((insn >> 25) & 7) == 1) {
             /* NEON Data processing.  */
-            if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-                goto illegal_op;
-            }
-
             if (disas_neon_data_insn(s, insn)) {
                 goto illegal_op;
             }
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         }
         if ((insn & 0x0f100000) == 0x04000000) {
             /* NEON load/store.  */
-            if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-                goto illegal_op;
-            }
-
             if (disas_neon_ls_insn(s, insn)) {
                 goto illegal_op;
             }
-- 
2.20.1

Add the infrastructure for building and invoking a decodetree decoder
for the AArch32 Neon encodings.  At the moment the new decoder covers
nothing, so we always fall back to the existing hand-written decode.

We follow the same pattern we did for the VFP decodetree conversion
(commit 78e138bc1f672c145ef6ace74617d and following): code that deals
with Neon will be moving gradually out to translate-neon.vfp.inc,
which we #include into translate.c.

In order to share the decode files between A32 and T32, we
split Neon into 3 parts:
 * data-processing
 * load-store
 * 'shared' encodings

The first two groups of instructions have similar but not identical
A32 and T32 encodings, so we need to manually transform the T32
encoding into the A32 one before calling the decoder; the third group
covers the Neon instructions which are identical in A32 and T32.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-4-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       | 29 ++++++++++++++++++++++++++
 target/arm/neon-ls.decode       | 29 ++++++++++++++++++++++++++
 target/arm/neon-shared.decode   | 27 +++++++++++++++++++++++++
 target/arm/translate-neon.inc.c | 32 +++++++++++++++++++++++++++++
 target/arm/translate.c          | 36 +++++++++++++++++++++++++++++++--
 target/arm/Makefile.objs        | 18 +++++++++++++++++
 6 files changed, 169 insertions(+), 2 deletions(-)
 create mode 100644 target/arm/neon-dp.decode
 create mode 100644 target/arm/neon-ls.decode
 create mode 100644 target/arm/neon-shared.decode
 create mode 100644 target/arm/translate-neon.inc.c

diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
+# AArch32 Neon data-processing instruction descriptions
+#
+#  Copyright (c) 2020 Linaro, Ltd
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, see <http://www.gnu.org/licenses/>.
+
+#
+# This file is processed by scripts/decodetree.py
+#
+
+# Encodings for Neon data processing instructions where the T32 encoding
+# is a simple transformation of the A32 encoding.
+# More specifically, this file covers instructions where the A32 encoding is
+#   0b1111_001p_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
+# and the T32 encoding is
+#   0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
+# This file works on the A32 encoding only; calling code for T32 has to
+# transform the insn into the A32 version first.
diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/neon-ls.decode
@@ -XXX,XX +XXX,XX @@
+# AArch32 Neon load/store instruction descriptions
+#
+#  Copyright (c) 2020 Linaro, Ltd
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, see <http://www.gnu.org/licenses/>.
+
+#
+# This file is processed by scripts/decodetree.py
+#
+
+# Encodings for Neon load/store instructions where the T32 encoding
+# is a simple transformation of the A32 encoding.
+# More specifically, this file covers instructions where the A32 encoding is
+#   0b1111_0100_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
+# and the T32 encoding is
+#   0b1111_1001_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
+# This file works on the A32 encoding only; calling code for T32 has to
+# transform the insn into the A32 version first.
diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@
+# AArch32 Neon instruction descriptions
+#
+#  Copyright (c) 2020 Linaro, Ltd
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with this library; if not, see <http://www.gnu.org/licenses/>.
+
+#
+# This file is processed by scripts/decodetree.py
+#
+
+# Encodings for Neon instructions whose encoding is the same for
+# both A32 and T32.
+
+# More specifically, this covers:
+# 2reg scalar ext: 0b1111_1110_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
+# 3same ext:       0b1111_110x_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ARM translation: AArch32 Neon instructions
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *  Copyright (c) 2005-2007 CodeSourcery
+ *  Copyright (c) 2007 OpenedHand, Ltd.
+ *  Copyright (c) 2020 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+/*
+ * This file is intended to be included from translate.c; it uses
+ * some macros and definitions provided by that file.
+ * It might be possible to convert it to a standalone .c file eventually.
+ */
+
+/* Include the generated Neon decoder */
+#include "decode-neon-dp.inc.c"
+#include "decode-neon-ls.inc.c"
+#include "decode-neon-shared.inc.c"
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
 
 #define ARM_CP_RW_BIT   (1 << 20)
 
-/* Include the VFP decoder */
+/* Include the VFP and Neon decoders */
 #include "translate-vfp.inc.c"
+#include "translate-neon.inc.c"
 
 static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
 {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         /* Unconditional instructions.  */
         /* TODO: Perhaps merge these into one decodetree output file.  */
         if (disas_a32_uncond(s, insn) ||
-            disas_vfp_uncond(s, insn)) {
+            disas_vfp_uncond(s, insn) ||
+            disas_neon_dp(s, insn) ||
+            disas_neon_ls(s, insn) ||
+            disas_neon_shared(s, insn)) {
             return;
         }
         /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         ARCH(6T2);
     }
 
+    if ((insn & 0xef000000) == 0xef000000) {
+        /*
+         * T32 encodings 0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
+         * transform into
+         * A32 encodings 0b1111_001p_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
+         */
+        uint32_t a32_insn = (insn & 0xe2ffffff) |
+            ((insn & (1 << 28)) >> 4) | (1 << 28);
+
+        if (disas_neon_dp(s, a32_insn)) {
+            return;
+        }
+    }
+
+    if ((insn & 0xff100000) == 0xf9000000) {
+        /*
+         * T32 encodings 0b1111_1001_ppp0_qqqq_qqqq_qqqq_qqqq_qqqq
+         * transform into
+         * A32 encodings 0b1111_0100_ppp0_qqqq_qqqq_qqqq_qqqq_qqqq
+         */
+        uint32_t a32_insn = (insn & 0x00ffffff) | 0xf4000000;
+
+        if (disas_neon_ls(s, a32_insn)) {
+            return;
+        }
+    }
+
     /*
      * TODO: Perhaps merge these into one decodetree output file.
      * Note disas_vfp is written for a32 with cond field in the
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
      */
     if (disas_t32(s, insn) ||
         disas_vfp_uncond(s, insn) ||
+        disas_neon_shared(s, insn) ||
         ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
         return;
     }
diff --git a/target/arm/Makefile.objs b/target/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/Makefile.objs
+++ b/target/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ target/arm/decode-sve.inc.c: $(SRC_PATH)/target/arm/sve.decode $(DECODETREE)
 	  $(PYTHON) $(DECODETREE) --decode disas_sve -o $@ $<,\
 	  "GEN", $(TARGET_DIR)$@)
 
+target/arm/decode-neon-shared.inc.c: $(SRC_PATH)/target/arm/neon-shared.decode $(DECODETREE)
+	$(call quiet-command,\
+	  $(PYTHON) $(DECODETREE) --static-decode disas_neon_shared -o $@ $<,\
+	  "GEN", $(TARGET_DIR)$@)
+
+target/arm/decode-neon-dp.inc.c: $(SRC_PATH)/target/arm/neon-dp.decode $(DECODETREE)
+	$(call quiet-command,\
+	  $(PYTHON) $(DECODETREE) --static-decode disas_neon_dp -o $@ $<,\
+	  "GEN", $(TARGET_DIR)$@)
+
+target/arm/decode-neon-ls.inc.c: $(SRC_PATH)/target/arm/neon-ls.decode $(DECODETREE)
+	$(call quiet-command,\
+	  $(PYTHON) $(DECODETREE) --static-decode disas_neon_ls -o $@ $<,\
+	  "GEN", $(TARGET_DIR)$@)
+
 target/arm/decode-vfp.inc.c: $(SRC_PATH)/target/arm/vfp.decode $(DECODETREE)
 	$(call quiet-command,\
 	  $(PYTHON) $(DECODETREE) --static-decode disas_vfp -o $@ $<,\
@@ -XXX,XX +XXX,XX @@ target/arm/decode-t16.inc.c: $(SRC_PATH)/target/arm/t16.decode $(DECODETREE)
 	  "GEN", $(TARGET_DIR)$@)
 
 target/arm/translate-sve.o: target/arm/decode-sve.inc.c
+target/arm/translate.o: target/arm/decode-neon-shared.inc.c
+target/arm/translate.o: target/arm/decode-neon-dp.inc.c
+target/arm/translate.o: target/arm/decode-neon-ls.inc.c
 target/arm/translate.o: target/arm/decode-vfp.inc.c
 target/arm/translate.o: target/arm/decode-vfp-uncond.inc.c
 target/arm/translate.o: target/arm/decode-a32.inc.c
-- 
2.20.1

Convert the VCMLA (vector) insns in the 3same extension group to
decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-5-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   | 11 ++++++++++
 target/arm/translate-neon.inc.c | 37 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 11 +---------
 3 files changed, 49 insertions(+), 10 deletions(-)

diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-shared.decode
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@
 # More specifically, this covers:
 # 2reg scalar ext: 0b1111_1110_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
 # 3same ext:       0b1111_110x_xxxx_xxxx_xxxx_1x0x_xxxx_xxxx
+
+# VFP/Neon register fields; same as vfp.decode
+%vm_dp  5:1 0:4
+%vm_sp  0:4 5:1
+%vn_dp  7:1 16:4
+%vn_sp  16:4 7:1
+%vd_dp  22:1 12:4
+%vd_sp  12:4 22:1
+
+VCMLA          1111 110 rot:2 . 1 size:1 .... .... 1000 . q:1 . 0 .... \
+               vm=%vm_dp vn=%vn_dp vd=%vd_dp
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@
 #include "decode-neon-dp.inc.c"
 #include "decode-neon-ls.inc.c"
 #include "decode-neon-shared.inc.c"
+
+static bool trans_VCMLA(DisasContext *s, arg_VCMLA *a)
+{
+    int opr_sz;
+    TCGv_ptr fpst;
+    gen_helper_gvec_3_ptr *fn_gvec_ptr;
+
+    if (!dc_isar_feature(aa32_vcma, s)
+        || (!a->size && !dc_isar_feature(aa32_fp16_arith, s))) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
+        return false;
+    }
+
+    if ((a->vn | a->vm | a->vd) & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    opr_sz = (1 + a->q) * 8;
+    fpst = get_fpstatus_ptr(1);
+    fn_gvec_ptr = a->size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
+                       vfp_reg_offset(1, a->vn),
+                       vfp_reg_offset(1, a->vm),
+                       fpst, opr_sz, opr_sz, a->rot,
+                       fn_gvec_ptr);
+    tcg_temp_free_ptr(fpst);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
     bool is_long = false, q = extract32(insn, 6, 1);
     bool ptr_is_env = false;
 
-    if ((insn & 0xfe200f10) == 0xfc200800) {
-        /* VCMLA -- 1111 110R R.1S .... .... 1000 ...0 .... */
-        int size = extract32(insn, 20, 1);
-        data = extract32(insn, 23, 2); /* rot */
-        if (!dc_isar_feature(aa32_vcma, s)
-            || (!size && !dc_isar_feature(aa32_fp16_arith, s))) {
-            return 1;
-        }
-        fn_gvec_ptr = size ? gen_helper_gvec_fcmlas : gen_helper_gvec_fcmlah;
-    } else if ((insn & 0xfea00f10) == 0xfc800800) {
+    if ((insn & 0xfea00f10) == 0xfc800800) {
         /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
         int size = extract32(insn, 20, 1);
         data = extract32(insn, 24, 1); /* rot */
-- 
2.20.1

Convert the VCADD (vector) insns to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-6-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |  3 +++
 target/arm/translate-neon.inc.c | 37 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 11 +---------
 3 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-shared.decode
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@
 
 VCMLA          1111 110 rot:2 . 1 size:1 .... .... 1000 . q:1 . 0 .... \
                vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+VCADD          1111 110 rot:1 1 . 0 size:1 .... .... 1000 . q:1 . 0 .... \
+               vm=%vm_dp vn=%vn_dp vd=%vd_dp
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMLA(DisasContext *s, arg_VCMLA *a)
     tcg_temp_free_ptr(fpst);
     return true;
 }
+
+static bool trans_VCADD(DisasContext *s, arg_VCADD *a)
+{
+    int opr_sz;
+    TCGv_ptr fpst;
+    gen_helper_gvec_3_ptr *fn_gvec_ptr;
+
+    if (!dc_isar_feature(aa32_vcma, s)
+        || (!a->size && !dc_isar_feature(aa32_fp16_arith, s))) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
+        return false;
+    }
+
+    if ((a->vn | a->vm | a->vd) & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    opr_sz = (1 + a->q) * 8;
+    fpst = get_fpstatus_ptr(1);
+    fn_gvec_ptr = a->size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
+                       vfp_reg_offset(1, a->vn),
+                       vfp_reg_offset(1, a->vm),
+                       fpst, opr_sz, opr_sz, a->rot,
+                       fn_gvec_ptr);
+    tcg_temp_free_ptr(fpst);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
     bool is_long = false, q = extract32(insn, 6, 1);
     bool ptr_is_env = false;
 
-    if ((insn & 0xfea00f10) == 0xfc800800) {
-        /* VCADD -- 1111 110R 1.0S .... .... 1000 ...0 .... */
-        int size = extract32(insn, 20, 1);
-        data = extract32(insn, 24, 1); /* rot */
-        if (!dc_isar_feature(aa32_vcma, s)
-            || (!size && !dc_isar_feature(aa32_fp16_arith, s))) {
-            return 1;
-        }
-        fn_gvec_ptr = size ? gen_helper_gvec_fcadds : gen_helper_gvec_fcaddh;
-    } else if ((insn & 0xfeb00f00) == 0xfc200d00) {
+    if ((insn & 0xfeb00f00) == 0xfc200d00) {
         /* V[US]DOT -- 1111 1100 0.10 .... .... 1101 .Q.U .... */
         bool u = extract32(insn, 4, 1);
         if (!dc_isar_feature(aa32_dp, s)) {
-- 
2.20.1

Convert the V[US]DOT (vector) insns to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-7-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |  4 ++++
 target/arm/translate-neon.inc.c | 32 ++++++++++++++++++++++++++++++++
 target/arm/translate.c          |  9 +--------
 3 files changed, 37 insertions(+), 8 deletions(-)

Convert the VFM[AS]L (vector) insns to decodetree.  This is the last
insn in the legacy decoder for the 3same_ext group, so we can
delete the legacy decoder function for the group entirely.

Note that in disas_thumb2_insn() the parts of this encoding space
where the decodetree decoder returns false will correctly be directed
to illegal_op by the "(insn & (1 << 28))" check so they won't fall
into disas_coproc_insn() by mistake.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-8-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |  6 +++
 target/arm/translate-neon.inc.c | 31 +++++++++++
 target/arm/translate.c          | 92 +--------------------------------
 3 files changed, 38 insertions(+), 91 deletions(-)

diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-shared.decode
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@ VCADD          1111 110 rot:1 1 . 0 size:1 .... .... 1000 . q:1 . 0 .... \
 # VUDOT and VSDOT
 VDOT           1111 110 00 . 10 .... .... 1101 . q:1 . u:1 .... \
                vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+# VFM[AS]L
+VFML           1111 110 0 s:1 . 10 .... .... 1000 . 0 . 1 .... \
+               vm=%vm_sp vn=%vn_sp vd=%vd_dp q=0
+VFML           1111 110 0 s:1 . 10 .... .... 1000 . 1 . 1 .... \
+               vm=%vm_dp vn=%vn_dp vd=%vd_dp q=1
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VDOT(DisasContext *s, arg_VDOT *a)
                        opr_sz, opr_sz, 0, fn_gvec);
     return true;
 }
+
+static bool trans_VFML(DisasContext *s, arg_VFML *a)
+{
+    int opr_sz;
+
+    if (!dc_isar_feature(aa32_fhm, s)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        (a->vd & 0x10)) {
+        return false;
+    }
+
+    if (a->vd & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    opr_sz = (1 + a->q) * 8;
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
+                       vfp_reg_offset(a->q, a->vn),
+                       vfp_reg_offset(a->q, a->vm),
+                       cpu_env, opr_sz, opr_sz, a->s, /* is_2 == 0 */
+                       gen_helper_gvec_fmlal_a32);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     return 0;
 }
 
-/* Advanced SIMD three registers of the same length extension.
- *  31           25    23  22    20   16   12  11   10   9    8        3     0
- * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
- * | 1 1 1 1 1 1 0 | op1 | D | op2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
- * +---------------+-----+---+-----+----+----+---+----+---+----+---------+----+
- */
-static int disas_neon_insn_3same_ext(DisasContext *s, uint32_t insn)
-{
-    gen_helper_gvec_3 *fn_gvec = NULL;
-    gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
-    int rd, rn, rm, opr_sz;
-    int data = 0;
-    int off_rn, off_rm;
-    bool is_long = false, q = extract32(insn, 6, 1);
-    bool ptr_is_env = false;
-
-    if ((insn & 0xff300f10) == 0xfc200810) {
-        /* VFM[AS]L -- 1111 1100 S.10 .... .... 1000 .Q.1 .... */
-        int is_s = extract32(insn, 23, 1);
-        if (!dc_isar_feature(aa32_fhm, s)) {
-            return 1;
-        }
-        is_long = true;
-        data = is_s; /* is_2 == 0 */
-        fn_gvec_ptr = gen_helper_gvec_fmlal_a32;
-        ptr_is_env = true;
-    } else {
-        return 1;
-    }
-
-    VFP_DREG_D(rd, insn);
-    if (rd & q) {
-        return 1;
-    }
-    if (q || !is_long) {
-        VFP_DREG_N(rn, insn);
-        VFP_DREG_M(rm, insn);
-        if ((rn | rm) & q & !is_long) {
-            return 1;
-        }
-        off_rn = vfp_reg_offset(1, rn);
-        off_rm = vfp_reg_offset(1, rm);
-    } else {
-        rn = VFP_SREG_N(insn);
-        rm = VFP_SREG_M(insn);
-        off_rn = vfp_reg_offset(0, rn);
-        off_rm = vfp_reg_offset(0, rm);
-    }
-
-    if (s->fp_excp_el) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
-        return 0;
-    }
-    if (!s->vfp_enabled) {
-        return 1;
-    }
-
-    opr_sz = (1 + q) * 8;
-    if (fn_gvec_ptr) {
-        TCGv_ptr ptr;
-        if (ptr_is_env) {
-            ptr = cpu_env;
-        } else {
-            ptr = get_fpstatus_ptr(1);
-        }
-        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
-                           opr_sz, opr_sz, data, fn_gvec_ptr);
-        if (!ptr_is_env) {
-            tcg_temp_free_ptr(ptr);
-        }
-    } else {
-        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
-                           opr_sz, opr_sz, data, fn_gvec);
-    }
-    return 0;
-}
-
 /* Advanced SIMD two registers and a scalar extension.
  *  31             24   23  22   20   16   12  11   10   9    8        3     0
  * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                     }
                 }
             }
-        } else if ((insn & 0x0e000a00) == 0x0c000800
-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
-            if (disas_neon_insn_3same_ext(s, insn)) {
-                goto illegal_op;
-            }
-            return;
         } else if ((insn & 0x0f000a00) == 0x0e000800
                    && arm_dc_feature(s, ARM_FEATURE_V8)) {
             if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             }
             break;
         }
-        if ((insn & 0xfe000a00) == 0xfc000800
+        if ((insn & 0xff000a00) == 0xfe000800
             && arm_dc_feature(s, ARM_FEATURE_V8)) {
             /* The Thumb2 and ARM encodings are identical.  */
-            if (disas_neon_insn_3same_ext(s, insn)) {
-                goto illegal_op;
-            }
-        } else if ((insn & 0xff000a00) == 0xfe000800
-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
-            /* The Thumb2 and ARM encodings are identical.  */
             if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
                 goto illegal_op;
             }
-- 
2.20.1

Convert VCMLA (scalar) in the 2reg-scalar-ext group to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-9-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |  5 +++++
 target/arm/translate-neon.inc.c | 40 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 26 +--------------------
 3 files changed, 46 insertions(+), 25 deletions(-)

diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-shared.decode
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@ VFML           1111 110 0 s:1 . 10 .... .... 1000 . 0 . 1 .... \
                vm=%vm_sp vn=%vn_sp vd=%vd_dp q=0
 VFML           1111 110 0 s:1 . 10 .... .... 1000 . 1 . 1 .... \
                vm=%vm_dp vn=%vn_dp vd=%vd_dp q=1
+
+VCMLA_scalar   1111 1110 0 . rot:2 .... .... 1000 . q:1 index:1 0 vm:4 \
+               vn=%vn_dp vd=%vd_dp size=0
+VCMLA_scalar   1111 1110 1 . rot:2 .... .... 1000 . q:1 . 0 .... \
+               vm=%vm_dp vn=%vn_dp vd=%vd_dp size=1 index=0
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VFML(DisasContext *s, arg_VFML *a)
                        gen_helper_gvec_fmlal_a32);
     return true;
 }
+
+static bool trans_VCMLA_scalar(DisasContext *s, arg_VCMLA_scalar *a)
+{
+    gen_helper_gvec_3_ptr *fn_gvec_ptr;
+    int opr_sz;
+    TCGv_ptr fpst;
+
+    if (!dc_isar_feature(aa32_vcma, s)) {
+        return false;
+    }
+    if (a->size == 0 && !dc_isar_feature(aa32_fp16_arith, s)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
+        return false;
+    }
+
+    if ((a->vd | a->vn) & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    fn_gvec_ptr = (a->size ? gen_helper_gvec_fcmlas_idx
+                   : gen_helper_gvec_fcmlah_idx);
+    opr_sz = (1 + a->q) * 8;
+    fpst = get_fpstatus_ptr(1);
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
+                       vfp_reg_offset(1, a->vn),
+                       vfp_reg_offset(1, a->vm),
+                       fpst, opr_sz, opr_sz,
+                       (a->index << 2) | a->rot, fn_gvec_ptr);
+    tcg_temp_free_ptr(fpst);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
     bool is_long = false, q = extract32(insn, 6, 1);
     bool ptr_is_env = false;
 
-    if ((insn & 0xff000f10) == 0xfe000800) {
-        /* VCMLA (indexed) -- 1111 1110 S.RR .... .... 1000 ...0 .... */
-        int rot = extract32(insn, 20, 2);
-        int size = extract32(insn, 23, 1);
-        int index;
-
-        if (!dc_isar_feature(aa32_vcma, s)) {
-            return 1;
-        }
-        if (size == 0) {
-            if (!dc_isar_feature(aa32_fp16_arith, s)) {
-                return 1;
-            }
-            /* For fp16, rm is just Vm, and index is M.  */
-            rm = extract32(insn, 0, 4);
-            index = extract32(insn, 5, 1);
-        } else {
-            /* For fp32, rm is the usual M:Vm, and index is 0.  */
-            VFP_DREG_M(rm, insn);
-            index = 0;
-        }
-        data = (index << 2) | rot;
-        fn_gvec_ptr = (size ? gen_helper_gvec_fcmlas_idx
-                       : gen_helper_gvec_fcmlah_idx);
-    } else if ((insn & 0xffb00f00) == 0xfe200d00) {
+    if ((insn & 0xffb00f00) == 0xfe200d00) {
         /* V[US]DOT -- 1111 1110 0.10 .... .... 1101 .Q.U .... */
         int u = extract32(insn, 4, 1);
 
-- 
2.20.1

Convert the V[US]DOT (scalar) insns in the 2reg-scalar-ext group
to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-10-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |  3 +++
 target/arm/translate-neon.inc.c | 35 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 13 +-----------
 3 files changed, 39 insertions(+), 12 deletions(-)

Convert the VFM[AS]L (scalar) insns in the 2reg-scalar-ext group
to decodetree. These are the last ones in the group so we can remove
all the legacy decode for the group.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-11-peter.maydell@linaro.org
---
 target/arm/neon-shared.decode   |   7 +++
 target/arm/translate-neon.inc.c |  32 ++++++++++
 target/arm/translate.c          | 107 +-------------------------------
 3 files changed, 40 insertions(+), 106 deletions(-)

diff --git a/target/arm/neon-shared.decode b/target/arm/neon-shared.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-shared.decode
+++ b/target/arm/neon-shared.decode
@@ -XXX,XX +XXX,XX @@ VCMLA_scalar   1111 1110 1 . rot:2 .... .... 1000 . q:1 . 0 .... \
 
 VDOT_scalar    1111 1110 0 . 10 .... .... 1101 . q:1 index:1 u:1 rm:4 \
                vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+%vfml_scalar_q0_rm 0:3 5:1
+%vfml_scalar_q1_index 5:1 3:1
+VFML_scalar    1111 1110 0 . 0 s:1 .... .... 1000 . 0 . 1 index:1 ... \
+               rm=%vfml_scalar_q0_rm vn=%vn_sp vd=%vd_dp q=0
+VFML_scalar    1111 1110 0 . 0 s:1 .... .... 1000 . 1 . 1 . rm:3 \
+               index=%vfml_scalar_q1_index vn=%vn_dp vd=%vd_dp q=1
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VDOT_scalar(DisasContext *s, arg_VDOT_scalar *a)
     tcg_temp_free_ptr(fpst);
     return true;
 }
+
+static bool trans_VFML_scalar(DisasContext *s, arg_VFML_scalar *a)
+{
+    int opr_sz;
+
+    if (!dc_isar_feature(aa32_fhm, s)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd & 0x10) || (a->q && (a->vn & 0x10)))) {
+        return false;
+    }
+
+    if (a->vd & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    opr_sz = (1 + a->q) * 8;
+    tcg_gen_gvec_3_ptr(vfp_reg_offset(1, a->vd),
+                       vfp_reg_offset(a->q, a->vn),
+                       vfp_reg_offset(a->q, a->rm),
+                       cpu_env, opr_sz, opr_sz,
+                       (a->index << 2) | a->s, /* is_2 == 0 */
+                       gen_helper_gvec_fmlal_idx_a32);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
 }
 
 #define VFP_REG_SHR(x, n) (((n) > 0) ? (x) >> (n) : (x) << -(n))
-#define VFP_SREG(insn, bigbit, smallbit) \
-  ((VFP_REG_SHR(insn, bigbit - 1) & 0x1e) | (((insn) >> (smallbit)) & 1))
 #define VFP_DREG(reg, insn, bigbit, smallbit) do { \
     if (dc_isar_feature(aa32_simd_r32, s)) { \
         reg = (((insn) >> (bigbit)) & 0x0f) \
@@ -XXX,XX +XXX,XX @@ static int disas_dsp_insn(DisasContext *s, uint32_t insn)
         reg = ((insn) >> (bigbit)) & 0x0f; \
     }} while (0)
 
-#define VFP_SREG_D(insn) VFP_SREG(insn, 12, 22)
 #define VFP_DREG_D(reg, insn) VFP_DREG(reg, insn, 12, 22)
-#define VFP_SREG_N(insn) VFP_SREG(insn, 16,  7)
 #define VFP_DREG_N(reg, insn) VFP_DREG(reg, insn, 16,  7)
-#define VFP_SREG_M(insn) VFP_SREG(insn,  0,  5)
 #define VFP_DREG_M(reg, insn) VFP_DREG(reg, insn,  0,  5)
 
 static void gen_neon_dup_low16(TCGv_i32 var)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
     return 0;
 }
 
-/* Advanced SIMD two registers and a scalar extension.
- *  31             24   23  22   20   16   12  11   10   9    8        3     0
- * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
- * | 1 1 1 1 1 1 1 0 | o1 | D | o2 | Vn | Vd | 1 | o3 | 0 | o4 | N Q M U | Vm |
- * +-----------------+----+---+----+----+----+---+----+---+----+---------+----+
- *
- */
-
-static int disas_neon_insn_2reg_scalar_ext(DisasContext *s, uint32_t insn)
-{
-    gen_helper_gvec_3 *fn_gvec = NULL;
-    gen_helper_gvec_3_ptr *fn_gvec_ptr = NULL;
-    int rd, rn, rm, opr_sz, data;
-    int off_rn, off_rm;
-    bool is_long = false, q = extract32(insn, 6, 1);
-    bool ptr_is_env = false;
-
-    if ((insn & 0xffa00f10) == 0xfe000810) {
-        /* VFM[AS]L -- 1111 1110 0.0S .... .... 1000 .Q.1 .... */
-        int is_s = extract32(insn, 20, 1);
-        int vm20 = extract32(insn, 0, 3);
-        int vm3 = extract32(insn, 3, 1);
-        int m = extract32(insn, 5, 1);
-        int index;
-
-        if (!dc_isar_feature(aa32_fhm, s)) {
-            return 1;
-        }
-        if (q) {
-            rm = vm20;
-            index = m * 2 + vm3;
-        } else {
-            rm = vm20 * 2 + m;
-            index = vm3;
-        }
-        is_long = true;
-        data = (index << 2) | is_s; /* is_2 == 0 */
-        fn_gvec_ptr = gen_helper_gvec_fmlal_idx_a32;
-        ptr_is_env = true;
-    } else {
-        return 1;
-    }
-
-    VFP_DREG_D(rd, insn);
-    if (rd & q) {
-        return 1;
-    }
-    if (q || !is_long) {
-        VFP_DREG_N(rn, insn);
-        if (rn & q & !is_long) {
-            return 1;
-        }
-        off_rn = vfp_reg_offset(1, rn);
-        off_rm = vfp_reg_offset(1, rm);
-    } else {
-        rn = VFP_SREG_N(insn);
-        off_rn = vfp_reg_offset(0, rn);
-        off_rm = vfp_reg_offset(0, rm);
-    }
-    if (s->fp_excp_el) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
-        return 0;
-    }
-    if (!s->vfp_enabled) {
-        return 1;
-    }
-
-    opr_sz = (1 + q) * 8;
-    if (fn_gvec_ptr) {
-        TCGv_ptr ptr;
-        if (ptr_is_env) {
-            ptr = cpu_env;
-        } else {
-            ptr = get_fpstatus_ptr(1);
-        }
-        tcg_gen_gvec_3_ptr(vfp_reg_offset(1, rd), off_rn, off_rm, ptr,
-                           opr_sz, opr_sz, data, fn_gvec_ptr);
-        if (!ptr_is_env) {
-            tcg_temp_free_ptr(ptr);
-        }
-    } else {
-        tcg_gen_gvec_3_ool(vfp_reg_offset(1, rd), off_rn, off_rm,
-                           opr_sz, opr_sz, data, fn_gvec);
-    }
-    return 0;
-}
-
 static int disas_coproc_insn(DisasContext *s, uint32_t insn)
 {
     int cpnum, is64, crn, crm, opc1, opc2, isread, rt, rt2;
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
                     }
                 }
             }
-        } else if ((insn & 0x0f000a00) == 0x0e000800
-                   && arm_dc_feature(s, ARM_FEATURE_V8)) {
-            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
-                goto illegal_op;
-            }
-            return;
         }
         goto illegal_op;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
             }
             break;
         }
-        if ((insn & 0xff000a00) == 0xfe000800
-            && arm_dc_feature(s, ARM_FEATURE_V8)) {
-            /* The Thumb2 and ARM encodings are identical.  */
-            if (disas_neon_insn_2reg_scalar_ext(s, insn)) {
-                goto illegal_op;
-            }
-        } else if (((insn >> 24) & 3) == 3) {
+        if (((insn >> 24) & 3) == 3) {
             /* Translate into the equivalent ARM encoding.  */
             insn = (insn & 0xe2ffffff) | ((insn & (1 << 28)) >> 4) | (1 << 28);
             if (disas_neon_data_insn(s, insn)) {
-- 
2.20.1

Convert the Neon "load/store multiple structures" insns to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-12-peter.maydell@linaro.org
---
 target/arm/neon-ls.decode       |   7 ++
 target/arm/translate-neon.inc.c | 124 ++++++++++++++++++++++++++++++++
 target/arm/translate.c          |  91 +----------------------
 3 files changed, 133 insertions(+), 89 deletions(-)

diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-ls.decode
+++ b/target/arm/neon-ls.decode
@@ -XXX,XX +XXX,XX @@
 #   0b1111_1001_xxx0_xxxx_xxxx_xxxx_xxxx_xxxx
 # This file works on the A32 encoding only; calling code for T32 has to
 # transform the insn into the A32 version first.
+
+%vd_dp  22:1 12:4
+
+# Neon load/store multiple structures
+
+VLDST_multiple 1111 0100 0 . l:1 0 rn:4 .... itype:4 size:2 align:2 rm:4 \
+               vd=%vd_dp
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VFML_scalar(DisasContext *s, arg_VFML_scalar *a)
                        gen_helper_gvec_fmlal_idx_a32);
     return true;
 }
+
+static struct {
+    int nregs;
+    int interleave;
+    int spacing;
+} const neon_ls_element_type[11] = {
+    {1, 4, 1},
+    {1, 4, 2},
+    {4, 1, 1},
+    {2, 2, 2},
+    {1, 3, 1},
+    {1, 3, 2},
+    {3, 1, 1},
+    {1, 1, 1},
+    {1, 2, 1},
+    {1, 2, 2},
+    {2, 1, 1}
+};
+
+static void gen_neon_ldst_base_update(DisasContext *s, int rm, int rn,
+                                      int stride)
+{
+    if (rm != 15) {
+        TCGv_i32 base;
+
+        base = load_reg(s, rn);
+        if (rm == 13) {
+            tcg_gen_addi_i32(base, base, stride);
+        } else {
+            TCGv_i32 index;
+            index = load_reg(s, rm);
+            tcg_gen_add_i32(base, base, index);
+            tcg_temp_free_i32(index);
+        }
+        store_reg(s, rn, base);
+    }
+}
+
+static bool trans_VLDST_multiple(DisasContext *s, arg_VLDST_multiple *a)
+{
+    /* Neon load/store multiple structures */
+    int nregs, interleave, spacing, reg, n;
+    MemOp endian = s->be_data;
+    int mmu_idx = get_mem_index(s);
+    int size = a->size;
+    TCGv_i64 tmp64;
+    TCGv_i32 addr, tmp;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+        return false;
+    }
+    if (a->itype > 10) {
+        return false;
+    }
+    /* Catch UNDEF cases for bad values of align field */
+    switch (a->itype & 0xc) {
+    case 4:
+        if (a->align >= 2) {
+            return false;
+        }
+        break;
+    case 8:
+        if (a->align == 3) {
+            return false;
+        }
+        break;
+    default:
+        break;
+    }
+    nregs = neon_ls_element_type[a->itype].nregs;
+    interleave = neon_ls_element_type[a->itype].interleave;
+    spacing = neon_ls_element_type[a->itype].spacing;
+    if (size == 3 && (interleave | spacing) != 1) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    /* For our purposes, bytes are always little-endian.  */
+    if (size == 0) {
+        endian = MO_LE;
+    }
+    /*
+     * Consecutive little-endian elements from a single register
+     * can be promoted to a larger little-endian operation.
+     */
+    if (interleave == 1 && endian == MO_LE) {
+        size = 3;
+    }
+    tmp64 = tcg_temp_new_i64();
+    addr = tcg_temp_new_i32();
+    tmp = tcg_const_i32(1 << size);
+    load_reg_var(s, addr, a->rn);
+    for (reg = 0; reg < nregs; reg++) {
+        for (n = 0; n < 8 >> size; n++) {
+            int xs;
+            for (xs = 0; xs < interleave; xs++) {
+                int tt = a->vd + reg + spacing * xs;
+
+                if (a->l) {
+                    gen_aa32_ld_i64(s, tmp64, addr, mmu_idx, endian | size);
+                    neon_store_element64(tt, n, size, tmp64);
+                } else {
+                    neon_load_element64(tmp64, tt, n, size);
+                    gen_aa32_st_i64(s, tmp64, addr, mmu_idx, endian | size);
+                }
+                tcg_gen_add_i32(addr, addr, tmp);
+            }
+        }
+    }
+    tcg_temp_free_i32(addr);
+    tcg_temp_free_i32(tmp);
+    tcg_temp_free_i64(tmp64);
+
+    gen_neon_ldst_base_update(s, a->rm, a->rn, nregs * interleave * 8);
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
 }
 
 
-static struct {
-    int nregs;
-    int interleave;
-    int spacing;
-} const neon_ls_element_type[11] = {
-    {1, 4, 1},
-    {1, 4, 2},
-    {4, 1, 1},
-    {2, 2, 2},
-    {1, 3, 1},
-    {1, 3, 2},
-    {3, 1, 1},
-    {1, 1, 1},
-    {1, 2, 1},
-    {1, 2, 2},
-    {2, 1, 1}
-};
-
 /* Translate a NEON load/store element instruction.  Return nonzero if the
    instruction is invalid.  */
 static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
 {
     int rd, rn, rm;
-    int op;
     int nregs;
-    int interleave;
-    int spacing;
     int stride;
     int size;
     int reg;
     int load;
-    int n;
     int vec_size;
-    int mmu_idx;
-    MemOp endian;
     TCGv_i32 addr;
     TCGv_i32 tmp;
-    TCGv_i32 tmp2;
-    TCGv_i64 tmp64;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return 1;
@@ -XXX,XX +XXX,XX @@ static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
     rn = (insn >> 16) & 0xf;
     rm = insn & 0xf;
     load = (insn & (1 << 21)) != 0;
-    endian = s->be_data;
-    mmu_idx = get_mem_index(s);
     if ((insn & (1 << 23)) == 0) {
-        /* Load store all elements.  */
-        op = (insn >> 8) & 0xf;
-        size = (insn >> 6) & 3;
-        if (op > 10)
-            return 1;
-        /* Catch UNDEF cases for bad values of align field */
-        switch (op & 0xc) {
-        case 4:
-            if (((insn >> 5) & 1) == 1) {
-                return 1;
-            }
-            break;
-        case 8:
-            if (((insn >> 4) & 3) == 3) {
-                return 1;
-            }
-            break;
-        default:
-            break;
-        }
-        nregs = neon_ls_element_type[op].nregs;
-        interleave = neon_ls_element_type[op].interleave;
-        spacing = neon_ls_element_type[op].spacing;
-        if (size == 3 && (interleave | spacing) != 1) {
-            return 1;
-        }
-        /* For our purposes, bytes are always little-endian.  */
-        if (size == 0) {
-            endian = MO_LE;
-        }
-        /* Consecutive little-endian elements from a single register
-         * can be promoted to a larger little-endian operation.
-         */
-        if (interleave == 1 && endian == MO_LE) {
-            size = 3;
-        }
-        tmp64 = tcg_temp_new_i64();
-        addr = tcg_temp_new_i32();
-        tmp2 = tcg_const_i32(1 << size);
-        load_reg_var(s, addr, rn);
-        for (reg = 0; reg < nregs; reg++) {
-            for (n = 0; n < 8 >> size; n++) {
-                int xs;
-                for (xs = 0; xs < interleave; xs++) {
-                    int tt = rd + reg + spacing * xs;
-
-                    if (load) {
-                        gen_aa32_ld_i64(s, tmp64, addr, mmu_idx, endian | size);
-                        neon_store_element64(tt, n, size, tmp64);
-                    } else {
-                        neon_load_element64(tmp64, tt, n, size);
-                        gen_aa32_st_i64(s, tmp64, addr, mmu_idx, endian | size);
-                    }
-                    tcg_gen_add_i32(addr, addr, tmp2);
-                }
-            }
-        }
-        tcg_temp_free_i32(addr);
-        tcg_temp_free_i32(tmp2);
-        tcg_temp_free_i64(tmp64);
-        stride = nregs * interleave * 8;
+        /* Load store all elements -- handled already by decodetree */
+        return 1;
     } else {
         size = (insn >> 10) & 3;
         if (size == 3) {
-- 
2.20.1

Convert the Neon "load single structure to all lanes" insns to
decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-13-peter.maydell@linaro.org
---
 target/arm/neon-ls.decode       |  5 +++
 target/arm/translate-neon.inc.c | 73 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 55 +------------------------
 3 files changed, 80 insertions(+), 53 deletions(-)

Convert the Neon "load/store single structure to one lane" insns to
decodetree.

As this is the last set of insns in the neon load/store group,
we can remove the whole disas_neon_ls_insn() function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-14-peter.maydell@linaro.org
---
 target/arm/neon-ls.decode       |  11 +++
 target/arm/translate-neon.inc.c |  89 +++++++++++++++++++
 target/arm/translate.c          | 147 --------------------------------
 3 files changed, 100 insertions(+), 147 deletions(-)

diff --git a/target/arm/neon-ls.decode b/target/arm/neon-ls.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-ls.decode
+++ b/target/arm/neon-ls.decode
@@ -XXX,XX +XXX,XX @@ VLDST_multiple 1111 0100 0 . l:1 0 rn:4 .... itype:4 size:2 align:2 rm:4 \
 
 VLD_all_lanes  1111 0100 1 . 1 0 rn:4 .... 11 n:2 size:2 t:1 a:1 rm:4 \
                vd=%vd_dp
+
+# Neon load/store single structure to one lane
+%imm1_5_p1 5:1 !function=plus1
+%imm1_6_p1 6:1 !function=plus1
+
+VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 00 n:2 reg_idx:3 align:1 rm:4 \
+               vd=%vd_dp size=0 stride=1
+VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 01 n:2 reg_idx:2 align:2 rm:4 \
+               vd=%vd_dp size=1 stride=%imm1_5_p1
+VLDST_single   1111 0100 1 . l:1 0 rn:4 .... 10 n:2 reg_idx:1 align:3 rm:4 \
+               vd=%vd_dp size=2 stride=%imm1_6_p1
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@
  * It might be possible to convert it to a standalone .c file eventually.
  */
 
+static inline int plus1(DisasContext *s, int x)
+{
+    return x + 1;
+}
+
 /* Include the generated Neon decoder */
 #include "decode-neon-dp.inc.c"
 #include "decode-neon-ls.inc.c"
@@ -XXX,XX +XXX,XX @@ static bool trans_VLD_all_lanes(DisasContext *s, arg_VLD_all_lanes *a)
 
     return true;
 }
+
+static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
+{
+    /* Neon load/store single structure to one lane */
+    int reg;
+    int nregs = a->n + 1;
+    int vd = a->vd;
+    TCGv_i32 addr, tmp;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+        return false;
+    }
+
+    /* Catch the UNDEF cases. This is unavoidably a bit messy. */
+    switch (nregs) {
+    case 1:
+        if (((a->align & (1 << a->size)) != 0) ||
+            (a->size == 2 && ((a->align & 3) == 1 || (a->align & 3) == 2))) {
+            return false;
+        }
+        break;
+    case 3:
+        if ((a->align & 1) != 0) {
+            return false;
+        }
+        /* fall through */
+    case 2:
+        if (a->size == 2 && (a->align & 2) != 0) {
+            return false;
+        }
+        break;
+    case 4:
+        if ((a->size == 2) && ((a->align & 3) == 3)) {
+            return false;
+        }
+        break;
+    default:
+        abort();
+    }
+    if ((vd + a->stride * (nregs - 1)) > 31) {
+        /*
+         * Attempts to write off the end of the register file are
+         * UNPREDICTABLE; we choose to UNDEF because otherwise we would
+         * access off the end of the array that holds the register data.
+         */
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    tmp = tcg_temp_new_i32();
+    addr = tcg_temp_new_i32();
+    load_reg_var(s, addr, a->rn);
+    /*
+     * TODO: if we implemented alignment exceptions, we should check
+     * addr against the alignment encoded in a->align here.
+     */
+    for (reg = 0; reg < nregs; reg++) {
+        if (a->l) {
+            gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
+                            s->be_data | a->size);
+            neon_store_element(vd, a->reg_idx, a->size, tmp);
+        } else { /* Store */
+            neon_load_element(tmp, vd, a->reg_idx, a->size);
+            gen_aa32_st_i32(s, tmp, addr, get_mem_index(s),
+                            s->be_data | a->size);
+        }
+        vd += a->stride;
+        tcg_gen_addi_i32(addr, addr, 1 << a->size);
+    }
+    tcg_temp_free_i32(addr);
+    tcg_temp_free_i32(tmp);
+
+    gen_neon_ldst_base_update(s, a->rm, a->rn, (1 << a->size) * nregs);
+
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_neon_trn_u16(TCGv_i32 t0, TCGv_i32 t1)
     tcg_temp_free_i32(rd);
 }
 
-
-/* Translate a NEON load/store element instruction.  Return nonzero if the
-   instruction is invalid.  */
-static int disas_neon_ls_insn(DisasContext *s, uint32_t insn)
-{
-    int rd, rn, rm;
-    int nregs;
-    int stride;
-    int size;
-    int reg;
-    int load;
-    TCGv_i32 addr;
-    TCGv_i32 tmp;
-
-    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
-        return 1;
-    }
-
-    /* FIXME: this access check should not take precedence over UNDEF
-     * for invalid encodings; we will generate incorrect syndrome information
-     * for attempts to execute invalid vfp/neon encodings with FP disabled.
-     */
-    if (s->fp_excp_el) {
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_simd_access_trap(1, 0xe, false), s->fp_excp_el);
-        return 0;
-    }
-
-    if (!s->vfp_enabled)
-      return 1;
-    VFP_DREG_D(rd, insn);
-    rn = (insn >> 16) & 0xf;
-    rm = insn & 0xf;
-    load = (insn & (1 << 21)) != 0;
-    if ((insn & (1 << 23)) == 0) {
-        /* Load store all elements -- handled already by decodetree */
-        return 1;
-    } else {
-        size = (insn >> 10) & 3;
-        if (size == 3) {
-            /* Load single element to all lanes -- handled by decodetree  */
-            return 1;
-        } else {
-            /* Single element.  */
-            int idx = (insn >> 4) & 0xf;
-            int reg_idx;
-            switch (size) {
-            case 0:
-                reg_idx = (insn >> 5) & 7;
-                stride = 1;
-                break;
-            case 1:
-                reg_idx = (insn >> 6) & 3;
-                stride = (insn & (1 << 5)) ? 2 : 1;
-                break;
-            case 2:
-                reg_idx = (insn >> 7) & 1;
-                stride = (insn & (1 << 6)) ? 2 : 1;
-                break;
-            default:
-                abort();
-            }
-            nregs = ((insn >> 8) & 3) + 1;
-            /* Catch the UNDEF cases. This is unavoidably a bit messy. */
-            switch (nregs) {
-            case 1:
-                if (((idx & (1 << size)) != 0) ||
-                    (size == 2 && ((idx & 3) == 1 || (idx & 3) == 2))) {
-                    return 1;
-                }
-                break;
-            case 3:
-                if ((idx & 1) != 0) {
-                    return 1;
-                }
-                /* fall through */
-            case 2:
-                if (size == 2 && (idx & 2) != 0) {
-                    return 1;
-                }
-                break;
-            case 4:
-                if ((size == 2) && ((idx & 3) == 3)) {
-                    return 1;
-                }
-                break;
-            default:
-                abort();
-            }
-            if ((rd + stride * (nregs - 1)) > 31) {
-                /* Attempts to write off the end of the register file
-                 * are UNPREDICTABLE; we choose to UNDEF because otherwise
-                 * the neon_load_reg() would write off the end of the array.
-                 */
-                return 1;
-            }
-            tmp = tcg_temp_new_i32();
-            addr = tcg_temp_new_i32();
-            load_reg_var(s, addr, rn);
-            for (reg = 0; reg < nregs; reg++) {
-                if (load) {
-                    gen_aa32_ld_i32(s, tmp, addr, get_mem_index(s),
-                                    s->be_data | size);
-                    neon_store_element(rd, reg_idx, size, tmp);
-                } else { /* Store */
-                    neon_load_element(tmp, rd, reg_idx, size);
-                    gen_aa32_st_i32(s, tmp, addr, get_mem_index(s),
-                                    s->be_data | size);
-                }
-                rd += stride;
-                tcg_gen_addi_i32(addr, addr, 1 << size);
-            }
-            tcg_temp_free_i32(addr);
-            tcg_temp_free_i32(tmp);
-            stride = nregs * (1 << size);
-        }
-    }
-    if (rm != 15) {
-        TCGv_i32 base;
-
-        base = load_reg(s, rn);
-        if (rm == 13) {
-            tcg_gen_addi_i32(base, base, stride);
-        } else {
-            TCGv_i32 index;
-            index = load_reg(s, rm);
-            tcg_gen_add_i32(base, base, index);
-            tcg_temp_free_i32(index);
-        }
-        store_reg(s, rn, base);
-    }
-    return 0;
-}
-
 static inline void gen_neon_narrow(int size, TCGv_i32 dest, TCGv_i64 src)
 {
     switch (size) {
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             }
             return;
         }
-        if ((insn & 0x0f100000) == 0x04000000) {
-            /* NEON load/store.  */
-            if (disas_neon_ls_insn(s, insn)) {
-                goto illegal_op;
-            }
-            return;
-        }
         if ((insn & 0x0e000f00) == 0x0c000100) {
             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
                 /* iWMMXt register transfer.  */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         }
         break;
     case 12:
-        if ((insn & 0x01100000) == 0x01000000) {
-            if (disas_neon_ls_insn(s, insn)) {
-                goto illegal_op;
-            }
-            break;
-        }
         goto illegal_op;
     default:
     illegal_op:
-- 
2.20.1

Convert the Neon 3-reg-same VADD and VSUB insns to decodetree.

Note that we don't need the neon_3r_sizes[op] check here because all
size values are OK for VADD and VSUB; we'll add this when we convert
the first insn that has size restrictions.

For this we need one of the GVecGen*Fn typedefs currently in
translate-a64.h; move them all to translate.h as a block so they
are visible to the 32-bit decoder.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-15-peter.maydell@linaro.org
---
 target/arm/translate-a64.h      |  9 --------
 target/arm/translate.h          |  9 ++++++++
 target/arm/neon-dp.decode       | 17 +++++++++++++++
 target/arm/translate-neon.inc.c | 38 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 14 ++++--------
 5 files changed, 68 insertions(+), 19 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
 
 bool disas_sve(DisasContext *, uint32_t);
 
-/* Note that the gvec expanders operate on offsets + sizes.  */
-typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
-typedef void GVecGen2iFn(unsigned, uint32_t, uint32_t, int64_t,
-                         uint32_t, uint32_t);
-typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
-                        uint32_t, uint32_t, uint32_t);
-typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
-                        uint32_t, uint32_t, uint32_t);
-
 #endif /* TARGET_ARM_TRANSLATE_A64_H */
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ void gen_sshl_i64(TCGv_i64 d, TCGv_i64 a, TCGv_i64 b);
 #define dc_isar_feature(name, ctx) \
     ({ DisasContext *ctx_ = (ctx); isar_feature_##name(ctx_->isar); })
 
+/* Note that the gvec expanders operate on offsets + sizes.  */
+typedef void GVecGen2Fn(unsigned, uint32_t, uint32_t, uint32_t, uint32_t);
+typedef void GVecGen2iFn(unsigned, uint32_t, uint32_t, int64_t,
+                         uint32_t, uint32_t);
+typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
+                        uint32_t, uint32_t, uint32_t);
+typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
+                        uint32_t, uint32_t, uint32_t);
+
 #endif /* TARGET_ARM_TRANSLATE_H */
diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-dp.decode
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
 #
 # This file is processed by scripts/decodetree.py
 #
+# VFP/Neon register fields; same as vfp.decode
+%vm_dp  5:1 0:4
+%vn_dp  7:1 16:4
+%vd_dp  22:1 12:4
 
 # Encodings for Neon data processing instructions where the T32 encoding
 # is a simple transformation of the A32 encoding.
@@ -XXX,XX +XXX,XX @@
 #   0b111p_1111_qqqq_qqqq_qqqq_qqqq_qqqq_qqqq
 # This file works on the A32 encoding only; calling code for T32 has to
 # transform the insn into the A32 version first.
+
+######################################################################
+# 3-reg-same grouping:
+# 1111 001 U 0 D sz:2 Vn:4 Vd:4 opc:4 N Q M op Vm:4
+######################################################################
+
+&3same vm vn vd q size
+
+@3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
+                 &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
+VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDST_single(DisasContext *s, arg_VLDST_single *a)
 
     return true;
 }
+
+static bool do_3same(DisasContext *s, arg_3same *a, GVecGen3Fn fn)
+{
+    int vec_size = a->q ? 16 : 8;
+    int rd_ofs = neon_reg_offset(a->vd, 0);
+    int rn_ofs = neon_reg_offset(a->vn, 0);
+    int rm_ofs = neon_reg_offset(a->vm, 0);
+
+    if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
+        return false;
+    }
+
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
+        return false;
+    }
+
+    if ((a->vn | a->vm | a->vd) & a->q) {
+        return false;
+    }
+
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
+    fn(a->size, rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
+    return true;
+}
+
+#define DO_3SAME(INSN, FUNC)                                            \
+    static bool trans_##INSN##_3s(DisasContext *s, arg_3same *a)        \
+    {                                                                   \
+        return do_3same(s, a, FUNC);                                    \
+    }
+
+DO_3SAME(VADD, tcg_gen_gvec_add)
+DO_3SAME(VSUB, tcg_gen_gvec_sub)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             return 0;
 
-        case NEON_3R_VADD_VSUB:
-            if (u) {
-                tcg_gen_gvec_sub(size, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-            } else {
-                tcg_gen_gvec_add(size, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-            }
-            return 0;
-
         case NEON_3R_VQADD:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
                            u ? &ushl_op[size] : &sshl_op[size]);
             return 0;
+
+        case NEON_3R_VADD_VSUB:
+            /* Already handled by decodetree */
+            return 1;
         }
 
         if (size == 3) {
-- 
2.20.1

Convert the Neon logic ops in the 3-reg-same grouping to decodetree.
Note that for the logic ops the 'size' field forms part of their
decode and the actual operations are always bitwise.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-16-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       | 12 +++++++++++
 target/arm/translate-neon.inc.c | 19 +++++++++++++++++
 target/arm/translate.c          | 38 +--------------------------------
 3 files changed, 32 insertions(+), 37 deletions(-)

diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-dp.decode
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
 @3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
 
+@3same_logic     .... ... . . . .. .... .... .... . q:1 .. .... \
+                 &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp size=0
+
+VAND_3s          1111 001 0 0 . 00 .... .... 0001 ... 1 .... @3same_logic
+VBIC_3s          1111 001 0 0 . 01 .... .... 0001 ... 1 .... @3same_logic
+VORR_3s          1111 001 0 0 . 10 .... .... 0001 ... 1 .... @3same_logic
+VORN_3s          1111 001 0 0 . 11 .... .... 0001 ... 1 .... @3same_logic
+VEOR_3s          1111 001 1 0 . 00 .... .... 0001 ... 1 .... @3same_logic
+VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
+VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
+VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
+
 VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
 VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static bool do_3same(DisasContext *s, arg_3same *a, GVecGen3Fn fn)
 
 DO_3SAME(VADD, tcg_gen_gvec_add)
 DO_3SAME(VSUB, tcg_gen_gvec_sub)
+DO_3SAME(VAND, tcg_gen_gvec_and)
+DO_3SAME(VBIC, tcg_gen_gvec_andc)
+DO_3SAME(VORR, tcg_gen_gvec_or)
+DO_3SAME(VORN, tcg_gen_gvec_orc)
+DO_3SAME(VEOR, tcg_gen_gvec_xor)
+
+/* These insns are all gvec_bitsel but with the inputs in various orders. */
+#define DO_3SAME_BITSEL(INSN, O1, O2, O3)                               \
+    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
+                                uint32_t rn_ofs, uint32_t rm_ofs,       \
+                                uint32_t oprsz, uint32_t maxsz)         \
+    {                                                                   \
+        tcg_gen_gvec_bitsel(vece, rd_ofs, O1, O2, O3, oprsz, maxsz);    \
+    }                                                                   \
+    DO_3SAME(INSN, gen_##INSN##_3s)
+
+DO_3SAME_BITSEL(VBSL, rd_ofs, rn_ofs, rm_ofs)
+DO_3SAME_BITSEL(VBIT, rm_ofs, rn_ofs, rd_ofs)
+DO_3SAME_BITSEL(VBIF, rm_ofs, rd_ofs, rn_ofs)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             return 1;
 
-        case NEON_3R_LOGIC: /* Logic ops.  */
-            switch ((u << 2) | size) {
-            case 0: /* VAND */
-                tcg_gen_gvec_and(0, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-                break;
-            case 1: /* VBIC */
-                tcg_gen_gvec_andc(0, rd_ofs, rn_ofs, rm_ofs,
-                                  vec_size, vec_size);
-                break;
-            case 2: /* VORR */
-                tcg_gen_gvec_or(0, rd_ofs, rn_ofs, rm_ofs,
-                                vec_size, vec_size);
-                break;
-            case 3: /* VORN */
-                tcg_gen_gvec_orc(0, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-                break;
-            case 4: /* VEOR */
-                tcg_gen_gvec_xor(0, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-                break;
-            case 5: /* VBSL */
-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rd_ofs, rn_ofs, rm_ofs,
-                                    vec_size, vec_size);
-                break;
-            case 6: /* VBIT */
-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rm_ofs, rn_ofs, rd_ofs,
-                                    vec_size, vec_size);
-                break;
-            case 7: /* VBIF */
-                tcg_gen_gvec_bitsel(MO_8, rd_ofs, rm_ofs, rd_ofs, rn_ofs,
-                                    vec_size, vec_size);
-                break;
-            }
-            return 0;
-
         case NEON_3R_VQADD:
             tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
                            rn_ofs, rm_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             return 0;
 
         case NEON_3R_VADD_VSUB:
+        case NEON_3R_LOGIC:
             /* Already handled by decodetree */
             return 1;
         }
-- 
2.20.1

Convert the Neon 3-reg-same VMAX and VMIN insns to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-17-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       |  5 +++++
 target/arm/translate-neon.inc.c | 14 ++++++++++++++
 target/arm/translate.c          | 21 ++-------------------
 3 files changed, 21 insertions(+), 19 deletions(-)

Convert the Neon comparison ops in the 3-reg-same grouping
to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-18-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       |  8 ++++++++
 target/arm/translate-neon.inc.c | 22 ++++++++++++++++++++++
 target/arm/translate.c          | 23 +++--------------------
 3 files changed, 33 insertions(+), 20 deletions(-)

diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-dp.decode
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@ VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
 VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
 VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
 
+VCGT_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 0 .... @3same
+VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
+VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
+VCGE_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 1 .... @3same
+
 VMAX_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 0 .... @3same
 VMAX_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 0 .... @3same
 VMIN_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 1 .... @3same
@@ -XXX,XX +XXX,XX @@ VMIN_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 1 .... @3same
 
 VADD_3s          1111 001 0 0 . .. .... .... 1000 . . . 0 .... @3same
 VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
+
+VTST_3s          1111 001 0 0 . .. .... .... 1000 . . . 1 .... @3same
+VCEQ_3s          1111 001 1 0 . .. .... .... 1000 . . . 1 .... @3same
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ DO_3SAME_NO_SZ_3(VMAX_S, tcg_gen_gvec_smax)
 DO_3SAME_NO_SZ_3(VMAX_U, tcg_gen_gvec_umax)
 DO_3SAME_NO_SZ_3(VMIN_S, tcg_gen_gvec_smin)
 DO_3SAME_NO_SZ_3(VMIN_U, tcg_gen_gvec_umin)
+
+#define DO_3SAME_CMP(INSN, COND)                                        \
+    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
+                                uint32_t rn_ofs, uint32_t rm_ofs,       \
+                                uint32_t oprsz, uint32_t maxsz)         \
+    {                                                                   \
+        tcg_gen_gvec_cmp(COND, vece, rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz); \
+    }                                                                   \
+    DO_3SAME_NO_SZ_3(INSN, gen_##INSN##_3s)
+
+DO_3SAME_CMP(VCGT_S, TCG_COND_GT)
+DO_3SAME_CMP(VCGT_U, TCG_COND_GTU)
+DO_3SAME_CMP(VCGE_S, TCG_COND_GE)
+DO_3SAME_CMP(VCGE_U, TCG_COND_GEU)
+DO_3SAME_CMP(VCEQ, TCG_COND_EQ)
+
+static void gen_VTST_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+                         uint32_t rm_ofs, uint32_t oprsz, uint32_t maxsz)
+{
+    tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz, &cmtst_op[vece]);
+}
+DO_3SAME_NO_SZ_3(VTST, gen_VTST_3s)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                            u ? &mls_op[size] : &mla_op[size]);
             return 0;
 
-        case NEON_3R_VTST_VCEQ:
-            if (u) { /* VCEQ */
-                tcg_gen_gvec_cmp(TCG_COND_EQ, size, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-            } else { /* VTST */
-                tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs,
-                               vec_size, vec_size, &cmtst_op[size]);
-            }
-            return 0;
-
-        case NEON_3R_VCGT:
-            tcg_gen_gvec_cmp(u ? TCG_COND_GTU : TCG_COND_GT, size,
-                             rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
-            return 0;
-
-        case NEON_3R_VCGE:
-            tcg_gen_gvec_cmp(u ? TCG_COND_GEU : TCG_COND_GE, size,
-                             rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size);
-            return 0;
-
         case NEON_3R_VSHL:
             /* Note the operation is vshl vd,vm,vn */
             tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         case NEON_3R_LOGIC:
         case NEON_3R_VMAX:
         case NEON_3R_VMIN:
+        case NEON_3R_VTST_VCEQ:
+        case NEON_3R_VCGT:
+        case NEON_3R_VCGE:
             /* Already handled by decodetree */
             return 1;
         }
-- 
2.20.1

Convert the Neon VQADD/VQSUB insns in the 3-reg-same grouping
to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-19-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       |  6 ++++++
 target/arm/translate-neon.inc.c | 15 +++++++++++++++
 target/arm/translate.c          | 14 ++------------
 3 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-dp.decode
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@
 @3same           .... ... . . . size:2 .... .... .... . q:1 . . .... \
                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp
 
+VQADD_S_3s       1111 001 0 0 . .. .... .... 0000 . . . 1 .... @3same
+VQADD_U_3s       1111 001 1 0 . .. .... .... 0000 . . . 1 .... @3same
+
 @3same_logic     .... ... . . . .. .... .... .... . q:1 .. .... \
                  &3same vm=%vm_dp vn=%vn_dp vd=%vd_dp size=0
 
@@ -XXX,XX +XXX,XX @@ VBSL_3s          1111 001 1 0 . 01 .... .... 0001 ... 1 .... @3same_logic
 VBIT_3s          1111 001 1 0 . 10 .... .... 0001 ... 1 .... @3same_logic
 VBIF_3s          1111 001 1 0 . 11 .... .... 0001 ... 1 .... @3same_logic
 
+VQSUB_S_3s       1111 001 0 0 . .. .... .... 0010 . . . 1 .... @3same
+VQSUB_U_3s       1111 001 1 0 . .. .... .... 0010 . . . 1 .... @3same
+
 VCGT_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 0 .... @3same
 VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
 VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ static void gen_VTST_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
     tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz, &cmtst_op[vece]);
 }
 DO_3SAME_NO_SZ_3(VTST, gen_VTST_3s)
+
+#define DO_3SAME_GVEC4(INSN, OPARRAY)                                   \
+    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
+                                uint32_t rn_ofs, uint32_t rm_ofs,       \
+                                uint32_t oprsz, uint32_t maxsz)         \
+    {                                                                   \
+        tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),           \
+                       rn_ofs, rm_ofs, oprsz, maxsz, &OPARRAY[vece]);   \
+    }                                                                   \
+    DO_3SAME(INSN, gen_##INSN##_3s)
+
+DO_3SAME_GVEC4(VQADD_S, sqadd_op)
+DO_3SAME_GVEC4(VQADD_U, uqadd_op)
+DO_3SAME_GVEC4(VQSUB_S, sqsub_op)
+DO_3SAME_GVEC4(VQSUB_U, uqsub_op)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             return 1;
 
-        case NEON_3R_VQADD:
-            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                           rn_ofs, rm_ofs, vec_size, vec_size,
-                           (u ? uqadd_op : sqadd_op) + size);
-            return 0;
-
-        case NEON_3R_VQSUB:
-            tcg_gen_gvec_4(rd_ofs, offsetof(CPUARMState, vfp.qc),
-                           rn_ofs, rm_ofs, vec_size, vec_size,
-                           (u ? uqsub_op : sqsub_op) + size);
-            return 0;
-
         case NEON_3R_VMUL: /* VMUL */
             if (u) {
                 /* Polynomial case allows only P8.  */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         case NEON_3R_VTST_VCEQ:
         case NEON_3R_VCGT:
         case NEON_3R_VCGE:
+        case NEON_3R_VQADD:
+        case NEON_3R_VQSUB:
             /* Already handled by decodetree */
             return 1;
         }
-- 
2.20.1

Convert the Neon VMUL, VMLA, VMLS and VSHL insns in the
3-reg-same grouping to decodetree.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-20-peter.maydell@linaro.org
---
 target/arm/neon-dp.decode       |  9 +++++++
 target/arm/translate-neon.inc.c | 44 +++++++++++++++++++++++++++++++++
 target/arm/translate.c          | 28 +++------------------
 3 files changed, 56 insertions(+), 25 deletions(-)

diff --git a/target/arm/neon-dp.decode b/target/arm/neon-dp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/neon-dp.decode
+++ b/target/arm/neon-dp.decode
@@ -XXX,XX +XXX,XX @@ VCGT_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 0 .... @3same
 VCGE_S_3s        1111 001 0 0 . .. .... .... 0011 . . . 1 .... @3same
 VCGE_U_3s        1111 001 1 0 . .. .... .... 0011 . . . 1 .... @3same
 
+VSHL_S_3s        1111 001 0 0 . .. .... .... 0100 . . . 0 .... @3same
+VSHL_U_3s        1111 001 1 0 . .. .... .... 0100 . . . 0 .... @3same
+
 VMAX_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 0 .... @3same
 VMAX_U_3s        1111 001 1 0 . .. .... .... 0110 . . . 0 .... @3same
 VMIN_S_3s        1111 001 0 0 . .. .... .... 0110 . . . 1 .... @3same
@@ -XXX,XX +XXX,XX @@ VSUB_3s          1111 001 1 0 . .. .... .... 1000 . . . 0 .... @3same
 
 VTST_3s          1111 001 0 0 . .. .... .... 1000 . . . 1 .... @3same
 VCEQ_3s          1111 001 1 0 . .. .... .... 1000 . . . 1 .... @3same
+
+VMLA_3s          1111 001 0 0 . .. .... .... 1001 . . . 0 .... @3same
+VMLS_3s          1111 001 1 0 . .. .... .... 1001 . . . 0 .... @3same
+
+VMUL_3s          1111 001 0 0 . .. .... .... 1001 . . . 1 .... @3same
+VMUL_p_3s        1111 001 1 0 . .. .... .... 1001 . . . 1 .... @3same
diff --git a/target/arm/translate-neon.inc.c b/target/arm/translate-neon.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.inc.c
+++ b/target/arm/translate-neon.inc.c
@@ -XXX,XX +XXX,XX @@ DO_3SAME_NO_SZ_3(VMAX_S, tcg_gen_gvec_smax)
 DO_3SAME_NO_SZ_3(VMAX_U, tcg_gen_gvec_umax)
 DO_3SAME_NO_SZ_3(VMIN_S, tcg_gen_gvec_smin)
 DO_3SAME_NO_SZ_3(VMIN_U, tcg_gen_gvec_umin)
+DO_3SAME_NO_SZ_3(VMUL, tcg_gen_gvec_mul)
 
 #define DO_3SAME_CMP(INSN, COND)                                        \
     static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
@@ -XXX,XX +XXX,XX @@ DO_3SAME_GVEC4(VQADD_S, sqadd_op)
 DO_3SAME_GVEC4(VQADD_U, uqadd_op)
 DO_3SAME_GVEC4(VQSUB_S, sqsub_op)
 DO_3SAME_GVEC4(VQSUB_U, uqsub_op)
+
+static void gen_VMUL_p_3s(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+                           uint32_t rm_ofs, uint32_t oprsz, uint32_t maxsz)
+{
+    tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, oprsz, maxsz,
+                       0, gen_helper_gvec_pmul_b);
+}
+
+static bool trans_VMUL_p_3s(DisasContext *s, arg_3same *a)
+{
+    if (a->size != 0) {
+        return false;
+    }
+    return do_3same(s, a, gen_VMUL_p_3s);
+}
+
+#define DO_3SAME_GVEC3_NO_SZ_3(INSN, OPARRAY)                           \
+    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
+                                uint32_t rn_ofs, uint32_t rm_ofs,       \
+                                uint32_t oprsz, uint32_t maxsz)         \
+    {                                                                   \
+        tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs,                          \
+                       oprsz, maxsz, &OPARRAY[vece]);                   \
+    }                                                                   \
+    DO_3SAME_NO_SZ_3(INSN, gen_##INSN##_3s)
+
+
+DO_3SAME_GVEC3_NO_SZ_3(VMLA, mla_op)
+DO_3SAME_GVEC3_NO_SZ_3(VMLS, mls_op)
+
+#define DO_3SAME_GVEC3_SHIFT(INSN, OPARRAY)                             \
+    static void gen_##INSN##_3s(unsigned vece, uint32_t rd_ofs,         \
+                                uint32_t rn_ofs, uint32_t rm_ofs,       \
+                                uint32_t oprsz, uint32_t maxsz)         \
+    {                                                                   \
+        /* Note the operation is vshl vd,vm,vn */                       \
+        tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs,                          \
+                       oprsz, maxsz, &OPARRAY[vece]);                   \
+    }                                                                   \
+    DO_3SAME(INSN, gen_##INSN##_3s)
+
+DO_3SAME_GVEC3_SHIFT(VSHL_S, sshl_op)
+DO_3SAME_GVEC3_SHIFT(VSHL_U, ushl_op)
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             return 1;
 
-        case NEON_3R_VMUL: /* VMUL */
-            if (u) {
-                /* Polynomial case allows only P8.  */
-                if (size != 0) {
-                    return 1;
-                }
-                tcg_gen_gvec_3_ool(rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size,
-                                   0, gen_helper_gvec_pmul_b);
-            } else {
-                tcg_gen_gvec_mul(size, rd_ofs, rn_ofs, rm_ofs,
-                                 vec_size, vec_size);
-            }
-            return 0;
-
-        case NEON_3R_VML: /* VMLA, VMLS */
-            tcg_gen_gvec_3(rd_ofs, rn_ofs, rm_ofs, vec_size, vec_size,
-                           u ? &mls_op[size] : &mla_op[size]);
-            return 0;
-
-        case NEON_3R_VSHL:
-            /* Note the operation is vshl vd,vm,vn */
-            tcg_gen_gvec_3(rd_ofs, rm_ofs, rn_ofs, vec_size, vec_size,
-                           u ? &ushl_op[size] : &sshl_op[size]);
-            return 0;
-
         case NEON_3R_VADD_VSUB:
         case NEON_3R_LOGIC:
         case NEON_3R_VMAX:
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
         case NEON_3R_VCGE:
         case NEON_3R_VQADD:
         case NEON_3R_VQSUB:
+        case NEON_3R_VMUL:
+        case NEON_3R_VML:
+        case NEON_3R_VSHL:
             /* Already handled by decodetree */
             return 1;
         }
-- 
2.20.1

We're going to want at least some of the NeonGen* typedefs
for the refactored 32-bit Neon decoder, so move them all
to translate.h since it makes more sense to keep them in
one group.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200430181003.21682-23-peter.maydell@linaro.org
---
 target/arm/translate.h     | 17 +++++++++++++++++
 target/arm/translate-a64.c | 17 -----------------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void GVecGen3Fn(unsigned, uint32_t, uint32_t,
 typedef void GVecGen4Fn(unsigned, uint32_t, uint32_t, uint32_t,
                         uint32_t, uint32_t, uint32_t);
 
+/* Function prototype for gen_ functions for calling Neon helpers */
+typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
+typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
+typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
+typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
+typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
+typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
+typedef void NeonGenNarrowEnvFn(TCGv_i32, TCGv_ptr, TCGv_i64);
+typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
+typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
+typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
+typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
+typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
+typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
+typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
+typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
+
 #endif /* TARGET_ARM_TRANSLATE_H */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef struct AArch64DecodeTable {
     AArch64DecodeFn *disas_fn;
 } AArch64DecodeTable;
 
-/* Function prototype for gen_ functions for calling Neon helpers */
-typedef void NeonGenOneOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32);
-typedef void NeonGenTwoOpFn(TCGv_i32, TCGv_i32, TCGv_i32);
-typedef void NeonGenTwoOpEnvFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
-typedef void NeonGenTwo64OpFn(TCGv_i64, TCGv_i64, TCGv_i64);
-typedef void NeonGenTwo64OpEnvFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i64);
-typedef void NeonGenNarrowFn(TCGv_i32, TCGv_i64);
-typedef void NeonGenNarrowEnvFn(TCGv_i32, TCGv_ptr, TCGv_i64);
-typedef void NeonGenWidenFn(TCGv_i64, TCGv_i32);
-typedef void NeonGenTwoSingleOPFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
-typedef void NeonGenTwoDoubleOPFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
-typedef void NeonGenOneOpFn(TCGv_i64, TCGv_i64);
-typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
-typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
-typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
-typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
-
 /* initialize TCG globals.  */
 void a64_translate_init(void)
 {
-- 
2.20.1