Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[PULL 0/8] target-arm queue
-Latest arm queue, half minor code cleanups and half minor
+Handful of bugfixes for rc2. None of these are particularly critical
-bug fixes.
+or exciting.
 -- PMM
-The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:
+The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)
+  Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803
-for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:
+for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8:
-  target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)
+  hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * support large kernel images in bootloader (by avoiding
+ * hw/timer/imx_epit: Avoid assertion when CR.SWR is written
-   putting the initrd over the top of them)
+ * netduino2, netduinoplus2, microbit: set system_clock_scale so that
- * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
+   SysTick running on the CPU clock works
- * arm_gicv3: Fix decoding of ID register range
+ * target/arm: Avoid maybe-uninitialized warning with gcc 4.9
- * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+ * target/arm: Fix AddPAC error indication
- * some code cleanups following on from the VFP decodetree conversion
+ * Make AIRCR.SYSRESETREQ actually reset the system for the
- * Only implement doubles if the FPU supports them
+   microbit, mps2-*, musca-*, netduino* boards
    (so we now correctly model Cortex-M4, -M33 as single precision only)
 ----------------------------------------------------------------
-Peter Maydell (24):
+Kaige Li (1):
-      hw/arm/boot: Don't assume RAM starts at address zero
+      target/arm: Avoid maybe-uninitialized warning with gcc 4.9
       hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
       hw/arm/boot: Avoid placing the initrd on top of the kernel
       hw/arm/boot: Honour image size field in AArch64 Image format kernels
       target/arm: Allow VFP and Neon to be disabled via a CPU property
       target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
       hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
       hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
       hw/intc/arm_gicv3: Fix decoding of ID register range
       hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
       target/arm: Move vfp_expand_imm() to translate.[ch]
       target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
       target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
       target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
       target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
       target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
       target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
       target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
       target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
       target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
       target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
       target/arm: Fix typos in trans function prototypes
       target/arm: Only implement doubles if the FPU supports them
- include/hw/arm/armsse.h        |   7 ++
+Peter Maydell (6):
- include/hw/arm/armv7m.h        |   4 +
+      hw/arm/netduino2, netduinoplus2: Set system_clock_scale
- target/arm/cpu.h               |  12 +++
+      include/hw/irq.h: New function qemu_irq_is_connected()
- target/arm/translate-a64.h     |   1 -
+      hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
- target/arm/translate.h         |   7 ++
+      msf2-soc, stellaris: Don't wire up SYSRESETREQ
- hw/arm/armsse.c                |  58 +++++++---
+      hw/arm/nrf51_soc: Set system_clock_scale
- hw/arm/armv7m.c                |  18 ++++
+      hw/timer/imx_epit: Avoid assertion when CR.SWR is written
  hw/arm/boot.c                  |  83 ++++++++++----
  hw/arm/musca.c                 |   8 ++
  hw/intc/arm_gicv3_dist.c       |  12 ++-
  hw/intc/arm_gicv3_redist.c     |   4 +-
  target/arm/cpu.c               | 179 ++++++++++++++++++++++++++++--
  target/arm/translate-a64.c     |  32 ------
  target/arm/translate-vfp.inc.c | 173 ++++++++++++++++++++++-------
  target/arm/translate.c         | 240 ++++++++++++++---------------------------
  target/arm/vfp.decode          |  10 +-
 files changed, 572 insertions(+), 276 deletions(-)
+Richard Henderson (1):
+      target/arm: Fix AddPAC error indication
+ include/hw/arm/armv7m.h           |  4 +++-
+ include/hw/irq.h                  | 18 ++++++++++++++++++
+ hw/arm/msf2-soc.c                 | 11 -----------
+ hw/arm/netduino2.c                | 10 ++++++++++
+ hw/arm/netduinoplus2.c            | 10 ++++++++++
+ hw/arm/nrf51_soc.c                |  5 +++++
+ hw/arm/stellaris.c                | 12 ------------
+ hw/intc/armv7m_nvic.c             | 17 ++++++++++++++++-
+ hw/timer/imx_epit.c               | 13 ++++++++++---
+ target/arm/pauth_helper.c         |  6 +++++-
+ target/arm/translate-a64.c        |  2 +-
+ tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++++
+ tests/tcg/aarch64/Makefile.target |  2 +-
+files changed, 112 insertions(+), 31 deletions(-)
+ create mode 100644 tests/tcg/aarch64/pauth-5.c

-[Qemu-devel] [PULL 01/24] hw/arm/boot: Don't assume RAM starts at address zero
+Deleted patch
-In the Arm kernel/initrd loading code, in some places we make the
-incorrect assumption that info->ram_size can be treated as the
-address of the end of RAM, as for instance when we calculate the
-available space for the initrd using "info->ram_size - info->initrd_start".
-This is wrong, because many Arm boards (including "virt") specify
-a non-zero info->loader_start to indicate that their RAM area
-starts at a non-zero physical address.
-Correct the places which make this incorrect assumption.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
----
- hw/arm/boot.c | 9 ++++-----
-file changed, 4 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
-+++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-     int elf_machine;
-     hwaddr entry;
-     static const ARMInsnFixup *primary_loader;
-+    uint64_t ram_end = info->loader_start + info->ram_size;
-     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-         primary_loader = bootloader_aarch64;
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-         /* 32-bit ARM */
-         entry = info->loader_start + KERNEL_LOAD_ADDR;
-         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
--                                             info->ram_size - KERNEL_LOAD_ADDR,
--                                             as);
-+                                             ram_end - KERNEL_LOAD_ADDR, as);
-         is_linux = 1;
-     }
-     if (kernel_size < 0) {
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-         if (info->initrd_filename) {
-             initrd_size = load_ramdisk_as(info->initrd_filename,
-                                           info->initrd_start,
--                                          info->ram_size - info->initrd_start,
--                                          as);
-+                                          ram_end - info->initrd_start, as);
-             if (initrd_size < 0) {
-                 initrd_size = load_image_targphys_as(info->initrd_filename,
-                                                      info->initrd_start,
--                                                     info->ram_size -
-+                                                     ram_end -
-                                                      info->initrd_start,
-                                                      as);
-             }
---
-.20.1

-[Qemu-devel] [PULL 02/24] hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
+Deleted patch
-We calculate the locations in memory where we want to put the
-initrd and the DTB based on the size of the kernel, since they
-come after it. Add some explicit checks that these aren't off the
-end of RAM entirely.
-(At the moment the way we calculate the initrd_start means that
-it can't ever be off the end of RAM, but that will change with
-the next commit.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
----
- hw/arm/boot.c | 23 +++++++++++++++++++++++
-file changed, 23 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
-+++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-         error_report("could not load kernel '%s'", info->kernel_filename);
-         exit(1);
-     }
-+
-+    if (kernel_size > info->ram_size) {
-+        error_report("kernel '%s' is too large to fit in RAM "
-+                     "(kernel size %d, RAM size %" PRId64 ")",
-+                     info->kernel_filename, kernel_size, info->ram_size);
-+        exit(1);
-+    }
-+
-     info->entry = entry;
-     if (is_linux) {
-         uint32_t fixupcontext[FIXUP_MAX];
-         if (info->initrd_filename) {
-+
-+            if (info->initrd_start >= ram_end) {
-+                error_report("not enough space after kernel to load initrd");
-+                exit(1);
-+            }
-+
-             initrd_size = load_ramdisk_as(info->initrd_filename,
-                                           info->initrd_start,
-                                           ram_end - info->initrd_start, as);
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-                              info->initrd_filename);
-                 exit(1);
-             }
-+            if (info->initrd_start + initrd_size > info->ram_size) {
-+                error_report("could not load initrd '%s': "
-+                             "too big to fit into RAM after the kernel",
-+                             info->initrd_filename);
-+            }
-         } else {
-             initrd_size = 0;
-         }
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-             /* Place the DTB after the initrd in memory with alignment. */
-             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
-                                            align);
-+            if (info->dtb_start >= ram_end) {
-+                error_report("Not enough space for DTB after kernel/initrd");
-+                exit(1);
-+            }
-             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
-             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
-         } else {
---
-.20.1

-[Qemu-devel] [PULL 04/24] hw/arm/boot: Honour image size field in AArch64 Image format kernels
+[PULL 1/8] hw/arm/netduino2, netduinoplus2: Set system_clock_scale
-Since Linux v3.17, the kernel's Image header includes a field image_size,
+The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale
-which gives the total size of the kernel including unpopulated data
+global, which meant that if guest code used the systick timer in "use
-sections such as the BSS). If this is present, then return it from
+the processor clock" mode it would hang because time never advances.
 load_aarch64_image() as the true size of the kernel rather than
 just using the size of the Image file itself. This allows the code
 which calculates where to put the initrd to avoid putting it in
 the kernel's BSS area.
-This means that we should be able to reliably load kernel images
+Set the global to match the documented CPU clock speed of these boards.
-which are larger than 128MB without accidentally putting the
+Judging by the data sheet this is slightly simplistic because the
-initrd or dtb in locations that clash with the kernel itself.
+SoC allows configuration of the SYSCLK source and frequency via the
 RCC (reset and clock control) module, but we don't model that.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
+Fixes: https://bugs.launchpad.net/qemu/+bug/1876187
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200727162617.26227-1-peter.maydell@linaro.org
 Tested-by: Mark Rutland <mark.rutland@arm.com>
 Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 17 +++++++++++++++--
+ hw/arm/netduino2.c     | 10 ++++++++++
-file changed, 15 insertions(+), 2 deletions(-)
+ hw/arm/netduinoplus2.c | 10 ++++++++++
 files changed, 20 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/netduino2.c
-+++ b/hw/arm/boot.c
++++ b/hw/arm/netduino2.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+@@ -XXX,XX +XXX,XX @@
-                                    hwaddr *entry, AddressSpace *as)
+ #include "hw/arm/stm32f205_soc.h"
  #include "hw/arm/boot.h"
 +/* Main SYSCLK frequency in Hz (120MHz) */
 +#define SYSCLK_FRQ 120000000ULL
 +
  static void netduino2_init(MachineState *machine)
  {
-     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+     DeviceState *dev;
-+    uint64_t kernel_size = 0;
-     uint8_t *buffer;
++    /*
-     int size;
++     * TODO: ideally we would model the SoC RCC and let it handle
++     * system_clock_scale, including its ability to define different
-@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
++     * possible SYSCLK sources.
-          * is only valid if the image_size is non-zero.
++     */
-          */
++    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
          memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
 -        if (hdrvals[1] != 0) {
 +
-+        kernel_size = le64_to_cpu(hdrvals[1]);
+     dev = qdev_new(TYPE_STM32F205_SOC);
      qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduinoplus2.c
 +++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/stm32f405_soc.h"
  #include "hw/arm/boot.h"
 +/* Main SYSCLK frequency in Hz (168MHz) */
 +#define SYSCLK_FRQ 168000000ULL
 +
-+        if (kernel_size != 0) {
+ static void netduinoplus2_init(MachineState *machine)
-             kernel_load_offset = le64_to_cpu(hdrvals[0]);
+ {
+     DeviceState *dev;
              /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          }
      }
 +    /*
-+     * Kernels before v3.17 don't populate the image_size field, and
++     * TODO: ideally we would model the SoC RCC and let it handle
-+     * raw images have no header. For those our best guess at the size
++     * system_clock_scale, including its ability to define different
-+     * is the size of the Image file itself.
++     * possible SYSCLK sources.
 +     */
-+    if (kernel_size == 0) {
++    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
 +        kernel_size = size;
 +    }
 +
-     *entry = mem_base + kernel_load_offset;
+     dev = qdev_new(TYPE_STM32F405_SOC);
-     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
+     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
      g_free(buffer);
 -    return size;
 +    return kernel_size;
  }
  static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
 --
 .20.1

-[Qemu-devel] [PULL 24/24] target/arm: Only implement doubles if the FPU supports them
+[PULL 2/8] include/hw/irq.h: New function qemu_irq_is_connected()
-The architecture permits FPUs which have only single-precision
+Mostly devices don't need to care whether one of their output
-support, not double-precision; Cortex-M4 and Cortex-M33 are
+qemu_irq lines is connected, because functions like qemu_set_irq()
-both like that. Add the necessary checks on the MVFR0 FPDP
+silently do nothing if there is nothing on the other end.  However
-field so that we UNDEF any double-precision instructions on
+sometimes a device might want to implement default behaviour for the
-CPUs like this.
+case where the machine hasn't wired the line up to anywhere.
-Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
+Provide a function qemu_irq_is_connected() that devices can use for
-VLDM/VSTM, VLDR/VSTR which take double precision registers
+this purpose.  (The test is trivial but encapsulating it in a
-still exist.
+function makes it easier to see where we're doing it in case we need
 to change the implementation later.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h               |  6 +++
+ include/hw/irq.h | 18 ++++++++++++++++++
- target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
+file changed, 18 insertions(+)
 files changed, 90 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/include/hw/irq.h b/include/hw/irq.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/include/hw/irq.h
-+++ b/target/arm/cpu.h
++++ b/include/hw/irq.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
-     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
+    on an existing vector of qemu_irq.  */
- }
+ void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
-+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
++/**
 + * qemu_irq_is_connected: Return true if IRQ line is wired up
 + *
 + * If a qemu_irq has a device on the other (receiving) end of it,
 + * return true; otherwise return false.
 + *
 + * Usually device models don't need to care whether the machine model
 + * has wired up their outbound qemu_irq lines, because functions like
 + * qemu_set_irq() silently do nothing if there is nothing on the other
 + * end of the line. However occasionally a device model will want to
 + * provide default behaviour if its output is left floating, and
 + * it can use this function to identify when that is the case.
 + */
 +static inline bool qemu_irq_is_connected(qemu_irq irq)
 +{
-+    /* Return true if CPU supports double precision floating point */
++    return irq != NULL;
 +    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
 +}
 +
- /*
+ #endif
   * We always set the FP and SIMD FP16 fields to indicate identical
   * levels of support (assuming SIMD is implemented at all), so
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
          ((a->vm | a->vn | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rn = a->vn;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          ((a->vm | a->vd) & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
      if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
          return false;
      }
 +
 +    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      rd = a->vd;
      rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 +    if (!dc_isar_feature(aa32_fpdp, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

-[Qemu-devel] [PULL 07/24] hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
+[PULL 3/8] hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
-Create "vfp" and "dsp" properties on the armv7m container object
+The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals
-which will be forwarded to its CPU object, so that SoCs can
+when the guest sets the SYSRESETREQ bit in the AIRCR register.  This
-configure whether the CPU has these features.
+matches the hardware design (where the CPU has a signal of this name
 and it is up to the SoC to connect that up to an actual reset
 mechanism), but in QEMU it mostly results in duplicated code in SoC
 objects and bugs where SoC model implementors forget to wire up the
 SYSRESETREQ line.
 Provide a default behaviour for the case where SYSRESETREQ is not
 actually connected to anything: use qemu_system_reset_request() to
 perform a system reset.  This will allow us to remove the
 implementations of SYSRESETREQ handling from the boards where that's
 exactly what it does, and also fixes the bugs in the board models
 which forgot to wire up the signal:
  * microbit
  * mps2-an385
  * mps2-an505
  * mps2-an511
  * mps2-an521
  * musca-a
  * musca-b1
  * netduino
  * netduinoplus2
 We still allow the board to wire up the signal if it needs to, in case
 we need to model more complicated reset controller logic or to model
 buggy SoC hardware which forgot to wire up the line itself. But
 defaulting to "reset the system" is more often going to be correct
 than defaulting to "do nothing".
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
+Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
 ---
- include/hw/arm/armv7m.h |  4 ++++
+ include/hw/arm/armv7m.h |  4 +++-
- hw/arm/armv7m.c         | 18 ++++++++++++++++++
+ hw/intc/armv7m_nvic.c   | 17 ++++++++++++++++-
-files changed, 22 insertions(+)
+files changed, 19 insertions(+), 2 deletions(-)
 diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/armv7m.h
 +++ b/include/hw/arm/armv7m.h
 @@ -XXX,XX +XXX,XX @@ typedef struct {
-  *   devices will be automatically layered on top of this view.)
-  * + Property "idau": IDAU interface (forwarded to CPU object)
+ /* ARMv7M container object.
-  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
+  * + Unnamed GPIO input lines: external IRQ lines for the NVIC
-+ * + Property "vfp": enable VFP (forwarded to CPU object)
+- * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ
-+ * + Property "dsp": enable DSP (forwarded to CPU object)
++ * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ.
-  * + Property "enable-bitband": expose bitbanded IO
++ *   If this GPIO is not wired up then the NVIC will default to performing
-  */
++ *   a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET).
- typedef struct ARMv7MState {
+  * + Property "cpu-type": CPU type to instantiate
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
+  * + Property "num-irq": number of external IRQ lines
-     uint32_t init_svtor;
+  * + Property "memory": MemoryRegion defining the physical address space
-     bool enable_bitband;
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
      bool start_powered_off;
 +    bool vfp;
 +    bool dsp;
  } ARMv7MState;
  #endif
 diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
+--- a/hw/intc/armv7m_nvic.c
-+++ b/hw/arm/armv7m.c
++++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@
-             return;
+ #include "hw/intc/armv7m_nvic.h"
-         }
+ #include "hw/irq.h"
-     }
+ #include "hw/qdev-properties.h"
-+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
++#include "sysemu/runstate.h"
-+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
+ #include "target/arm/cpu.h"
-+                                 "vfp", &err);
+ #include "exec/exec-all.h"
-+        if (err != NULL) {
+ #include "exec/memop.h"
-+            error_propagate(errp, err);
+@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
-+            return;
+x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
-+        }
+ };
 +static void signal_sysresetreq(NVICState *s)
 +{
 +    if (qemu_irq_is_connected(s->sysresetreq)) {
 +        qemu_irq_pulse(s->sysresetreq);
 +    } else {
 +        /*
 +         * Default behaviour if the SoC doesn't need to wire up
 +         * SYSRESETREQ (eg to a system reset controller of some kind):
 +         * perform a system reset via the usual QEMU API.
 +         */
 +        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +    }
-+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
++}
-+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
++
-+                                 "dsp", &err);
+ static int nvic_pending_prio(NVICState *s)
-+        if (err != NULL) {
+ {
-+            error_propagate(errp, err);
+     /* return the group priority of the current pending interrupt,
-+            return;
+@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-+        }
+             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
-+    }
+                 if (attrs.secure ||
+                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
-     /*
+-                    qemu_irq_pulse(s->sysresetreq);
-      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
++                    signal_sysresetreq(s);
-@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
+                 }
-     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
+             }
-     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
+             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
                       false),
 +    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
 +    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
      DEFINE_PROP_END_OF_LIST(),
  };
 --
 .20.1

-[Qemu-devel] [PULL 18/24] target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
+[PULL 4/8] msf2-soc, stellaris: Don't wire up SYSRESETREQ
-Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
+The MSF2 SoC model and the Stellaris board code both wire
-Since this is the last user of cpu_F0s in the Neon 2rm-op
+SYSRESETREQ up to a function that just invokes
-loop, we can remove the handling code for it too.
+    qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 This is now the default action that the NVIC does if the line is
 not connected, so we can delete the handling code.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20190613163917.28589-9-peter.maydell@linaro.org
+Message-id: 20200728103744.6909-4-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 82 ++++++++++++------------------------------
+ hw/arm/msf2-soc.c  | 11 -----------
-file changed, 22 insertions(+), 60 deletions(-)
+ hw/arm/stellaris.c | 12 ------------
 files changed, 23 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/hw/arm/msf2-soc.c
-+++ b/target/arm/translate.c
++++ b/hw/arm/msf2-soc.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
+@@ -XXX,XX +XXX,XX @@
-     return statusptr;
+ #include "hw/irq.h"
- }
+ #include "hw/arm/msf2-soc.h"
+ #include "hw/misc/unimp.h"
--#define VFP_GEN_ITOF(name) \
+-#include "sysemu/runstate.h"
--static inline void gen_vfp_##name(int dp, int neon) \
+ #include "sysemu/sysemu.h"
--{ \
--    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+ #define MSF2_TIMER_BASE       0x40004000
--    if (dp) { \
+@@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 };
--        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
+ static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 };
--    } else { \
+ static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 };
--        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
--    } \
+-static void do_sys_reset(void *opaque, int n, int level)
--    tcg_temp_free_ptr(statusptr); \
+-{
 -    if (level) {
 -        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 -    }
 -}
 -
--VFP_GEN_ITOF(uito)
+ static void m2sxxx_soc_initfn(Object *obj)
--VFP_GEN_ITOF(sito)
+ {
--#undef VFP_GEN_ITOF
+     MSF2State *s = MSF2_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp)
          return;
      }
 -    qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0,
 -                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
 -
--#define VFP_GEN_FTOI(name) \
+     system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk;
--static inline void gen_vfp_##name(int dp, int neon) \
--{ \
+     for (i = 0; i < MSF2_NUM_UARTS; i++) {
--    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
--    if (dp) { \
+index XXXXXXX..XXXXXXX 100644
--        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
+--- a/hw/arm/stellaris.c
--    } else { \
++++ b/hw/arm/stellaris.c
--        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
+@@ -XXX,XX +XXX,XX @@
--    } \
+ #include "hw/boards.h"
--    tcg_temp_free_ptr(statusptr); \
+ #include "qemu/log.h"
  #include "exec/address-spaces.h"
 -#include "sysemu/runstate.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/armv7m.h"
  #include "hw/char/pl011.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
      qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
  }
 -static
 -void do_sys_reset(void *opaque, int n, int level)
 -{
 -    if (level) {
 -        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 -    }
 -}
 -
--VFP_GEN_FTOI(touiz)
+ /* Board init.  */
--VFP_GEN_FTOI(tosiz)
+ static stellaris_board_info stellaris_boards[] = {
--#undef VFP_GEN_FTOI
+   { "LM3S811EVB",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      /* This will exit with an error if the user passed us a bad cpu_type */
      sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
 -    qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
 -                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
 -
- #define VFP_GEN_FIX(name, round) \
+     if (board->dc1 & (1 << 16)) {
- static inline void gen_vfp_##name(int dp, int shift, int neon) \
+         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
- { \
+                                     qdev_get_gpio_in(nvic, 14),
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
  #define NEON_2RM_VCVT_SF 62
  #define NEON_2RM_VCVT_UF 63
 -static int neon_2rm_is_float_op(int op)
 -{
 -    /*
 -     * Return true if this neon 2reg-misc op is float-to-float.
 -     * This is not a property of the operation but of our code --
 -     * what we are asking here is "does the code for this case in
 -     * the Neon for-each-pass loop use cpu_F0s?".
 -     */
 -    return op >= NEON_2RM_VCVT_FS;
 -}
 -
  static bool neon_2rm_is_v8_op(int op)
  {
      /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                  default:
                  elementwise:
                      for (pass = 0; pass < (q ? 4 : 2); pass++) {
 -                        if (neon_2rm_is_float_op(op)) {
 -                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
 -                                           neon_reg_offset(rm, pass));
 -                            tmp = NULL;
 -                        } else {
 -                            tmp = neon_load_reg(rm, pass);
 -                        }
 +                        tmp = neon_load_reg(rm, pass);
                          switch (op) {
                          case NEON_2RM_VREV32:
                              switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                              break;
                          }
                          case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
 -                            gen_vfp_sito(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
 -                            gen_vfp_uito(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
 -                            gen_vfp_tosiz(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
 -                            gen_vfp_touiz(0, 1);
 +                        {
 +                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
 +                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
 +                            tcg_temp_free_ptr(fpstatus);
                              break;
 +                        }
                          default:
                              /* Reserved op values were caught by the
                               * neon_2rm_sizes[] check earlier.
                               */
                              abort();
                          }
 -                        if (neon_2rm_is_float_op(op)) {
 -                            tcg_gen_st_f32(cpu_F0s, cpu_env,
 -                                           neon_reg_offset(rd, pass));
 -                        } else {
 -                            neon_store_reg(rd, pass, tmp);
 -                        }
 +                        neon_store_reg(rd, pass, tmp);
                      }
                      break;
                  }
 --
 .20.1

-[Qemu-devel] [PULL 03/24] hw/arm/boot: Avoid placing the initrd on top of the kernel
+[PULL 5/8] target/arm: Fix AddPAC error indication
-We currently put the initrd at the smaller of:
+From: Richard Henderson <richard.henderson@linaro.org>
  * 128MB into RAM
  * halfway into the RAM
 (with the dtb following it).
-However for large kernels this might mean that the kernel
+The definition of top_bit used in this function is one higher
-overlaps the initrd. For some kinds of kernel (self-decompressing
+than that used in the Arm ARM psuedo-code, which put the error
--bit kernels, and ELF images with a BSS section at the end)
+indication at top_bit - 1 at the wrong place, which meant that
-we don't know the exact size, but even there we have a
+it wasn't visible to Auth.
 minimum size. Put the initrd at least further into RAM than
 that. For image formats that can give us an exact kernel size, this
 will mean that we definitely avoid overlaying kernel and initrd.
+Fixing the definition of top_bit requires more changes, because
+its most common use is for the count of bits in top_bit:bot_bit,
+which would then need to be computed as top_bit - bot_bit + 1.
+For now, prefer the minimal fix to the error indication alone.
+Fixes: 63ff0ca94cb
+Reported-by: Derrick McKee <derrick.mckee@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20200728195706.11087-1-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: added comment about the divergence from the pseudocode]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 34 ++++++++++++++++++++--------------
+ target/arm/pauth_helper.c         |  6 +++++-
-file changed, 20 insertions(+), 14 deletions(-)
+ tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++
  tests/tcg/aarch64/Makefile.target |  2 +-
 files changed, 39 insertions(+), 2 deletions(-)
  create mode 100644 tests/tcg/aarch64/pauth-5.c
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/pauth_helper.c
-+++ b/hw/arm/boot.c
++++ b/target/arm/pauth_helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
-     if (info->nb_cpus == 0)
+      */
-         info->nb_cpus = 1;
+     test = sextract64(ptr, bot_bit, top_bit - bot_bit);
+     if (test != 0 && test != -1) {
--    /*
+-        pac ^= MAKE_64BIT_MASK(top_bit - 1, 1);
--     * We want to put the initrd far enough into RAM that when the
++        /*
--     * kernel is uncompressed it will not clobber the initrd. However
++         * Note that our top_bit is one greater than the pseudocode's
--     * on boards without much RAM we must ensure that we still leave
++         * version, hence "- 2" here.
--     * enough room for a decent sized initrd, and on boards with large
++         */
--     * amounts of RAM we must avoid the initrd being so far up in RAM
++        pac ^= MAKE_64BIT_MASK(top_bit - 2, 1);
 -     * that it is outside lowmem and inaccessible to the kernel.
 -     * So for boards with less  than 256MB of RAM we put the initrd
 -     * halfway into RAM, and for boards with 256MB of RAM or more we put
 -     * the initrd at 128MB.
 -     */
 -    info->initrd_start = info->loader_start +
 -        MIN(info->ram_size / 2, 128 * 1024 * 1024);
 -
      /* Assume that raw images are linux kernels, and ELF images are not.  */
      kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
                                 &elf_high_addr, elf_machine, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
      }
-     info->entry = entry;
+     /*
 diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/pauth-5.c
@@ -XXX,XX +XXX,XX @@
 +#include <assert.h>
 +
 +static int x;
 +
 +int main()
 +{
 +    int *p0 = &x, *p1, *p2, *p3;
 +    unsigned long salt = 0;
 +
 +    /*
-+     * We want to put the initrd far enough into RAM that when the
++     * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so
-+     * kernel is uncompressed it will not clobber the initrd. However
++     * a 1/128 chance of auth = pac(ptr,key,salt) producing zero.
-+     * on boards without much RAM we must ensure that we still leave
++     * Find a salt that creates auth != 0.
 +     * enough room for a decent sized initrd, and on boards with large
 +     * amounts of RAM we must avoid the initrd being so far up in RAM
 +     * that it is outside lowmem and inaccessible to the kernel.
 +     * So for boards with less  than 256MB of RAM we put the initrd
 +     * halfway into RAM, and for boards with 256MB of RAM or more we put
 +     * the initrd at 128MB.
 +     * We also refuse to put the initrd somewhere that will definitely
 +     * overlay the kernel we just loaded, though for kernel formats which
 +     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
 +     * we might still make a bad choice here.
 +     */
-+    info->initrd_start = info->loader_start +
++    do {
-+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
++        salt++;
-+    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
++        asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0));
 +    } while (p0 == p1);
 +
-     if (is_linux) {
++    /*
-         uint32_t fixupcontext[FIXUP_MAX];
++     * This pac must fail, because the input pointer bears an encryption,
++     * and so is not properly extended within bits [55:47].  This will
 +     * toggle bit 54 in the output...
 +     */
 +    asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1));
 +
 +    /* ... so that the aut must fail, setting bit 53 in the output ... */
 +    asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2));
 +
 +    /* ... which means this equality must not hold. */
 +    assert(p3 != p0);
 +    return 0;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
  # Pauth Tests
  ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),)
 -AARCH64_TESTS += pauth-1 pauth-2 pauth-4
 +AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5
  pauth-%: CFLAGS += -march=armv8.3-a
  run-pauth-%: QEMU_OPTS += -cpu max
  run-plugin-pauth-%: QEMU_OPTS += -cpu max
 --
 .20.1

-[Qemu-devel] [PULL 11/24] target/arm: Move vfp_expand_imm() to translate.[ch]
+[PULL 6/8] target/arm: Avoid maybe-uninitialized warning with gcc 4.9
-We want to use vfp_expand_imm() in the AArch32 VFP decode;
+From: Kaige Li <likaige@loongson.cn>
 move it from the a64-only header/source file to the
 AArch32 one (which is always compiled even for AArch64).
+GCC version 4.9.4 isn't clever enough to figure out that all
+execution paths in disas_ldst() that use 'fn' will have initialized
+it first, and so it warns:
+/home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’:
+/home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
+     fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
+     ^
+/home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here
+     AtomicThreeOpFn *fn;
+                      ^
+Make it happy by initializing the variable to NULL.
+Signed-off-by: Kaige Li <likaige@loongson.cn>
+Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: Clean up commit message and note which gcc version this was]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.h     |  1 -
+ target/arm/translate-a64.c | 2 +-
- target/arm/translate.h         |  7 +++++++
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/translate-a64.c     | 32 --------------------------------
  target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 files changed, 40 insertions(+), 33 deletions(-)
-diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.h
-+++ b/target/arm/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
- TCGv_ptr get_fpstatus_ptr(bool);
- bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
-                             unsigned int imms, unsigned int immr);
--uint64_t vfp_expand_imm(int size, uint8_t imm8);
- bool sve_access_check(DisasContext *s);
- /* We should have at some point before trying to access an FP register
-diff --git a/target/arm/translate.h b/target/arm/translate.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.h
-+++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
-     }
- }
-+/*
-+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
-+ * instruction, expand it to the actual constant value of the specified
-+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
-+ */
-+uint64_t vfp_expand_imm(int size, uint8_t imm8);
-+
- /* Vector operations shared between ARM and AArch64.  */
- extern const GVecGen3 mla_op[4];
- extern const GVecGen3 mls_op[4];
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
-     }
+     bool r = extract32(insn, 22, 1);
- }
+     bool a = extract32(insn, 23, 1);
+     TCGv_i64 tcg_rs, clean_addr;
--/* The imm8 encodes the sign bit, enough bits to represent an exponent in
+-    AtomicThreeOpFn *fn;
-- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
++    AtomicThreeOpFn *fn = NULL;
-- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
-- */
+     if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
--uint64_t vfp_expand_imm(int size, uint8_t imm8)
+         unallocated_encoding(s);
 -{
 -    uint64_t imm;
 -
 -    switch (size) {
 -    case MO_64:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 -            extract32(imm8, 0, 6);
 -        imm <<= 48;
 -        break;
 -    case MO_32:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 3);
 -        imm <<= 16;
 -        break;
 -    case MO_16:
 -        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 -            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 -            (extract32(imm8, 0, 6) << 6);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -    return imm;
 -}
 -
  /* Floating point immediate
   *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
   * +---+---+---+-----------+------+---+------------+-------+------+------+
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-vfp.inc.c
 +++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
  #include "decode-vfp.inc.c"
  #include "decode-vfp-uncond.inc.c"
 +/*
 + * The imm8 encodes the sign bit, enough bits to represent an exponent in
 + * the range 01....1xx to 10....0xx, and the most significant 4 bits of
 + * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
 + */
 +uint64_t vfp_expand_imm(int size, uint8_t imm8)
 +{
 +    uint64_t imm;
 +
 +    switch (size) {
 +    case MO_64:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
 +            extract32(imm8, 0, 6);
 +        imm <<= 48;
 +        break;
 +    case MO_32:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 3);
 +        imm <<= 16;
 +        break;
 +    case MO_16:
 +        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
 +            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
 +            (extract32(imm8, 0, 6) << 6);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +    return imm;
 +}
 +
  /*
   * Return the offset of a 16-bit half of the specified VFP single-precision
   * register. If top is true, returns the top 16 bits; otherwise the bottom
 --
 .20.1

-[Qemu-devel] [PULL 05/24] target/arm: Allow VFP and Neon to be disabled via a CPU property
+[PULL 7/8] hw/arm/nrf51_soc: Set system_clock_scale
-Allow VFP and neon to be disabled via a CPU property. As with
+The nrf51 SoC model wasn't setting the system_clock_scale
-the "pmu" property, we only allow these features to be removed
+global.which meant that if guest code used the systick timer in "use
-from CPUs which have it by default, not added to CPUs which
+the processor clock" mode it would hang because time never advances.
 don't have it.
-The primary motivation here is to be able to optionally
+Set the global to match the documented CPU clock speed for this SoC.
-create Cortex-M33 CPUs with no FPU, but we provide switches
-for both VFP and Neon because the two interact:
+This SoC in fact doesn't have a SysTick timer (which is the only thing
- * AArch64 can't have one without the other
+currently that cares about the system_clock_scale), because it's
- * Some ID register fields only change if both are disabled
+a configurable option in the Cortex-M0. However our Cortex-M0 and
 thus our nrf51 and our micro:bit board do provide a SysTick, so
 we ought to provide a functional one rather than a broken one.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20200727193458.31250-1-peter.maydell@linaro.org
 Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
 ---
- target/arm/cpu.h |   4 ++
+ hw/arm/nrf51_soc.c | 5 +++++
- target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
+file changed, 5 insertions(+)
 files changed, 148 insertions(+), 6 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/nrf51_soc.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/nrf51_soc.c
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@
-     bool has_el3;
-     /* CPU has PMU (Performance Monitor Unit) */
+ #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
-     bool has_pmu;
-+    /* CPU has VFP */
++/* HCLK (the main CPU clock) on this SoC is always 16MHz */
-+    bool has_vfp;
++#define HCLK_FRQ 16000000
 +    /* CPU has Neon */
 +    bool has_neon;
      /* CPU has memory protection unit */
      bool has_mpu;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
  static Property arm_cpu_has_pmu_property =
              DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 +static Property arm_cpu_has_vfp_property =
 +            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
 +
-+static Property arm_cpu_has_neon_property =
+ static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size)
-+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+ {
-+
+     qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
- static Property arm_cpu_has_mpu_property =
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
              DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
          set_feature(&cpu->env, ARM_FEATURE_PMSA);
      }
 +    /* Similarly for the VFP feature bits */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP3);
 +    }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
 +        set_feature(&cpu->env, ARM_FEATURE_VFP);
 +    }
      if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
          arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                   &error_abort);
      }
 +    /*
 +     * Allow user to turn off VFP and Neon support, but only for TCG --
 +     * KVM does not currently allow us to lie to the guest about its
 +     * ID/feature registers, so the guest always sees what the host has.
 +     */
 +    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +        cpu->has_vfp = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
 +                                     &error_abort);
 +        }
 +    }
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
 +        cpu->has_neon = true;
 +        if (!kvm_enabled()) {
 +            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
 +                                     &error_abort);
 +        }
 +    }
 +
      if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
          qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                   &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          return;
      }
-+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
++    system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ;
 +        cpu->has_vfp != cpu->has_neon) {
 +        /*
 +         * This is an architectural requirement for AArch64; AArch32 is
 +         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
 +         */
 +        error_setg(errp,
 +                   "AArch64 CPUs must have both VFP and Neon or neither");
 +        return;
 +    }
 +
-+    if (!cpu->has_vfp) {
+     object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
-+        uint64_t t;
+                              &error_abort);
-+        uint32_t u;
+     if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
 +
 +        unset_feature(env, ARM_FEATURE_VFP);
 +        unset_feature(env, ARM_FEATURE_VFP3);
 +        unset_feature(env, ARM_FEATURE_VFP4);
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, FPSP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
 +        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
 +        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
 +        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
 +        cpu->isar.mvfr0 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
 +        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
 +        u = FIELD_DP32(u, MVFR1, FPHP, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        unset_feature(env, ARM_FEATURE_NEON);
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        t = cpu->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
 +        cpu->isar.id_aa64pfr0 = t;
 +
 +        u = cpu->isar.id_isar5;
 +        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
 +        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
 +        cpu->isar.id_isar5 = u;
 +
 +        u = cpu->isar.id_isar6;
 +        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
 +        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
 +        cpu->isar.id_isar6 = u;
 +
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
 +        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
 +        cpu->isar.mvfr1 = u;
 +
 +        u = cpu->isar.mvfr2;
 +        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
 +        cpu->isar.mvfr2 = u;
 +    }
 +
 +    if (!cpu->has_neon && !cpu->has_vfp) {
 +        uint64_t t;
 +        uint32_t u;
 +
 +        t = cpu->isar.id_aa64isar0;
 +        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
 +        cpu->isar.id_aa64isar0 = t;
 +
 +        t = cpu->isar.id_aa64isar1;
 +        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
 +        cpu->isar.id_aa64isar1 = t;
 +
 +        u = cpu->isar.mvfr0;
 +        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
 +        cpu->isar.mvfr0 = u;
 +    }
 +
      /* Some features automatically imply others: */
      if (arm_feature(env, ARM_FEATURE_V8)) {
          if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
      if (arm_feature(env, ARM_FEATURE_V5)) {
          set_feature(env, ARM_FEATURE_V4T);
      }
 -    if (arm_feature(env, ARM_FEATURE_VFP4)) {
 -        set_feature(env, ARM_FEATURE_VFP3);
 -    }
 -    if (arm_feature(env, ARM_FEATURE_VFP3)) {
 -        set_feature(env, ARM_FEATURE_VFP);
 -    }
      if (arm_feature(env, ARM_FEATURE_LPAE)) {
          set_feature(env, ARM_FEATURE_V7MP);
          set_feature(env, ARM_FEATURE_PXN);
 --
 .20.1

-[Qemu-devel] [PULL 06/24] target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
+Deleted patch
-Allow the DSP extension to be disabled via a CPU property for
-M-profile CPUs. (A and R-profile CPUs don't have this extension
-as a defined separate optional architecture extension, so
-they don't need the property.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
----
- target/arm/cpu.h |  2 ++
- target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
-files changed, 31 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-     bool has_vfp;
-     /* CPU has Neon */
-     bool has_neon;
-+    /* CPU has M-profile DSP extension */
-+    bool has_dsp;
-     /* CPU has memory protection unit */
-     bool has_mpu;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
- static Property arm_cpu_has_neon_property =
-             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
-+static Property arm_cpu_has_dsp_property =
-+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
-+
- static Property arm_cpu_has_mpu_property =
-             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
-         }
-     }
-+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
-+        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
-+        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
-+                                 &error_abort);
-+    }
-+
-     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
-         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
-                                  &error_abort);
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-         cpu->isar.mvfr0 = u;
-     }
-+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
-+        uint32_t u;
-+
-+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
-+
-+        u = cpu->isar.id_isar1;
-+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
-+        cpu->isar.id_isar1 = u;
-+
-+        u = cpu->isar.id_isar2;
-+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
-+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
-+        cpu->isar.id_isar2 = u;
-+
-+        u = cpu->isar.id_isar3;
-+        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
-+        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
-+        cpu->isar.id_isar3 = u;
-+    }
-+
-     /* Some features automatically imply others: */
-     if (arm_feature(env, ARM_FEATURE_V8)) {
-         if (arm_feature(env, ARM_FEATURE_M)) {
---
-.20.1

-[Qemu-devel] [PULL 08/24] hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
+[PULL 8/8] hw/timer/imx_epit: Avoid assertion when CR.SWR is written
-The SSE-200 hardware has configurable integration settings which
+The imx_epit device has a software-controllable reset triggered by
-determine whether its two CPUs have the FPU and DSP:
+setting the SWR bit in the CR register. An error in commit cc2722ec83ad9
- * CPU0_FPU (default 0)
+means that we will end up assert()ing if the guest does this, because
- * CPU0_DSP (default 0)
+the code in imx_epit_write() starts ptimer transactions, and then
- * CPU1_FPU (default 1)
+imx_epit_reset() also starts ptimer transactions, triggering
- * CPU1_DSP (default 1)
+"ptimer_transaction_begin: Assertion `!s->in_transaction' failed".
-Similarly, the IoTKit has settings for its single CPU:
+The cleanest way to avoid this double-transaction is to move the
- * CPU0_FPU (default 1)
+start-transaction for the CR write handling down below the check of
- * CPU0_DSP (default 1)
+the SWR bit.
-Of our four boards that use either the IoTKit or the SSE-200:
+Fixes: https://bugs.launchpad.net/qemu/+bug/1880424
- * mps2-an505, mps2-an521 and musca-a use the default settings
+Fixes: cc2722ec83ad944505fe
- * musca-b1 enables FPU and DSP on both CPUs
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20200727154550.3409-1-peter.maydell@linaro.org
 ---
  hw/timer/imx_epit.c | 13 ++++++++++---
 file changed, 10 insertions(+), 3 deletions(-)
-Currently QEMU models all these boards using CPUs with
+diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
 both FPU and DSP enabled. This means that we are incorrect
 for mps2-an521 and musca-a, which should not have FPU or DSP
 on CPU0.
 Create QOM properties on the ARMSSE devices corresponding to the
 default h/w integration settings, and make the Musca-B1 board
 enable FPU and DSP on both CPUs. This fixes the mps2-an521
 and musca-a behaviour, and leaves the musca-b1 and mps2-an505
 behaviour unchanged.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
 ---
  include/hw/arm/armsse.h |  7 +++++
  hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
  hw/arm/musca.c          |  8 ++++++
 files changed, 61 insertions(+), 12 deletions(-)
 diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/armsse.h
+--- a/hw/timer/imx_epit.c
-+++ b/include/hw/arm/armsse.h
++++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
-  *    address of each SRAM bank (and thus the total amount of internal SRAM)
-  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
+     switch (offset >> 2) {
-  *    (where it expects to load the PC and SP from the vector table on reset)
+     case 0: /* CR */
-+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
+-        ptimer_transaction_begin(s->timer_cmp);
-+ *    set whether the CPUs have the FPU and DSP features present. The default
+-        ptimer_transaction_begin(s->timer_reload);
-+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
-+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
+         oldcr = s->cr;
-+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
+         s->cr = value & 0x03ffffff;
-  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
+         if (s->cr & CR_SWR) {
-  *    which are wired to its NVIC lines 32 .. n+32
+             /* handle the reset */
-  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
+             imx_epit_reset(DEVICE(s));
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
+-        } else {
-     uint32_t mainclk_frq;
++            /*
-     uint32_t sram_addr_width;
++             * TODO: could we 'break' here? following operations appear
-     uint32_t init_svtor;
++             * to duplicate the work imx_epit_reset() already did.
-+    bool cpu_fpu[SSE_MAX_CPUS];
++             */
-+    bool cpu_dsp[SSE_MAX_CPUS];
++        }
  } ARMSSE;
  typedef struct ARMSSEInfo ARMSSEInfo;
 diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/armsse.c
 +++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
      bool has_cachectrl;
      bool has_cpusecctrl;
      bool has_cpuid;
 +    Property *props;
 +};
 +
-+static Property iotkit_properties[] = {
++        ptimer_transaction_begin(s->timer_cmp);
-+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
++        ptimer_transaction_begin(s->timer_reload);
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 +    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
 +    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
 +    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
 +    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
 +    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
-+static Property armsse_properties[] = {
++        if (!(s->cr & CR_SWR)) {
-+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+             imx_epit_set_freq(s);
 +                     MemoryRegion *),
 +    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
 +    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
 +    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
 +    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
 +    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
 +    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
 +    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
 +    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
 +    DEFINE_PROP_END_OF_LIST()
  };
  static const ARMSSEInfo armsse_variants[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
          .has_cachectrl = false,
          .has_cpusecctrl = false,
          .has_cpuid = false,
 +        .props = iotkit_properties,
      },
      {
          .name = TYPE_SSE200,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
          .has_cachectrl = true,
          .has_cpusecctrl = true,
          .has_cpuid = true,
 +        .props = armsse_properties,
      },
  };
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                  return;
              }
          }
-+        if (!s->cpu_fpu[i]) {
-+            object_property_set_bool(cpuobj, false, "vfp", &err);
-+            if (err) {
-+                error_propagate(errp, err);
-+                return;
-+            }
-+        }
-+        if (!s->cpu_dsp[i]) {
-+            object_property_set_bool(cpuobj, false, "dsp", &err);
-+            if (err) {
-+                error_propagate(errp, err);
-+                return;
-+            }
-+        }
-         if (i > 0) {
-             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
-     }
- };
--static Property armsse_properties[] = {
--    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
--                     MemoryRegion *),
--    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
--    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
--    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
--    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
--    DEFINE_PROP_END_OF_LIST()
--};
--
- static void armsse_reset(DeviceState *dev)
- {
-     ARMSSE *s = ARMSSE(dev);
-@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
-     DeviceClass *dc = DEVICE_CLASS(klass);
-     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
-     ARMSSEClass *asc = ARMSSE_CLASS(klass);
-+    const ARMSSEInfo *info = data;
-     dc->realize = armsse_realize;
-     dc->vmsd = &armsse_vmstate;
--    dc->props = armsse_properties;
-+    dc->props = info->props;
-     dc->reset = armsse_reset;
-     iic->check = armsse_idau_check;
--    asc->info = data;
-+    asc->info = info;
- }
- static const TypeInfo armsse_info = {
-diff --git a/hw/arm/musca.c b/hw/arm/musca.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musca.c
-+++ b/hw/arm/musca.c
-@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
-     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
-     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
-     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
-+    /*
-+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
-+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
-+     */
-+    if (mmc->type == MUSCA_B1) {
-+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
-+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
-+    }
-     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
-                              &error_fatal);
 --
 .20.1

-[Qemu-devel] [PULL 09/24] hw/intc/arm_gicv3: Fix decoding of ID register range
+Deleted patch
-The GIC ID registers cover an area 0x30 bytes in size
-(12 registers, 4 bytes each). We were incorrectly decoding
-only the first 0x20 bytes.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_dist.c   | 4 ++--
- hw/intc/arm_gicv3_redist.c | 4 ++--
-files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
-+++ b/hw/intc/arm_gicv3_dist.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
-         }
-         return MEMTX_OK;
-     }
--    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
-+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
-         /* ID registers */
-         *data = gicv3_idreg(offset - GICD_IDREGS);
-         return MEMTX_OK;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
-         gicd_write_irouter(s, attrs, irq, r);
-         return MEMTX_OK;
-     }
--    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
-+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
-     case GICD_TYPER:
-     case GICD_IIDR:
-         /* RO registers, ignore the write */
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
-+++ b/hw/intc/arm_gicv3_redist.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
-         }
-         *data = cs->gicr_nsacr;
-         return MEMTX_OK;
--    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
-+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
-         *data = gicv3_idreg(offset - GICR_IDREGS);
-         return MEMTX_OK;
-     default:
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
-         return MEMTX_OK;
-     case GICR_IIDR:
-     case GICR_TYPER:
--    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
-+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
-         /* RO registers, ignore the write */
-         qemu_log_mask(LOG_GUEST_ERROR,
-                       "%s: invalid guest write to RO register at offset "
---
-.20.1

-[Qemu-devel] [PULL 10/24] hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
+Deleted patch
-The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
-is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
-if the security extension is unsupported. "Security extension
-unsupported" always implies GICD_CTLR.DS == 1, but the guest can
-also set DS on a GIC which does support the security extension.
-Fix the condition to correctly check the GICD_CTLR.DS bit.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
----
- hw/intc/arm_gicv3_dist.c | 8 +++++++-
-file changed, 7 insertions(+), 1 deletion(-)
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
-+++ b/hw/intc/arm_gicv3_dist.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
-          * ITLinesNumber == (num external irqs / 32) - 1
-          */
-         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
-+        /*
-+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
-+         * "security extensions not supported" always implies DS == 1,
-+         * so we only need to check the DS bit.
-+         */
-+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
--        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
-+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
-             (0xf << 19) | itlinesnumber;
-         return MEMTX_OK;
-     }
---
-.20.1

-[Qemu-devel] [PULL 12/24] target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
+Deleted patch
-The AArch32 VMOV (immediate) instruction uses the same VFP encoded
-immediate format we already handle in vfp_expand_imm().  Use that
-function rather than hand-decoding it.
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
----
- target/arm/translate-vfp.inc.c | 28 ++++------------------------
- target/arm/vfp.decode          | 10 ++++++----
-files changed, 10 insertions(+), 28 deletions(-)
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
-+++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
-     uint32_t delta_d = 0;
-     int veclen = s->vec_len;
-     TCGv_i32 fd;
--    uint32_t n, i, vd;
-+    uint32_t vd;
-     vd = a->vd;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
-         }
-     }
--    n = (a->imm4h << 28) & 0x80000000;
--    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
--    if (i & 0x40) {
--        i |= 0x780;
--    } else {
--        i |= 0x800;
--    }
--    n |= i << 19;
--
--    fd = tcg_temp_new_i32();
--    tcg_gen_movi_i32(fd, n);
-+    fd = tcg_const_i32(vfp_expand_imm(MO_32, a->imm));
-     for (;;) {
-         neon_store_reg32(fd, vd);
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
-     uint32_t delta_d = 0;
-     int veclen = s->vec_len;
-     TCGv_i64 fd;
--    uint32_t n, i, vd;
-+    uint32_t vd;
-     vd = a->vd;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
-         }
-     }
--    n = (a->imm4h << 28) & 0x80000000;
--    i = ((a->imm4h << 4) & 0x70) | a->imm4l;
--    if (i & 0x40) {
--        i |= 0x3f80;
--    } else {
--        i |= 0x4000;
--    }
--    n |= i << 16;
--
--    fd = tcg_temp_new_i64();
--    tcg_gen_movi_i64(fd, ((uint64_t)n) << 32);
-+    fd = tcg_const_i64(vfp_expand_imm(MO_64, a->imm));
-     for (;;) {
-         neon_store_reg64(fd, vd);
-diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/vfp.decode
-+++ b/target/arm/vfp.decode
-@@ -XXX,XX +XXX,XX @@
- %vmov_idx_b     21:1 5:2
- %vmov_idx_h     21:1 6:1
-+%vmov_imm 16:4 0:4
-+
- # VMOV scalar to general-purpose register; note that this does
- # include some Neon cases.
- VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
-@@ -XXX,XX +XXX,XX @@ VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
- VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
-              vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
--VMOV_imm_sp  ---- 1110 1.11 imm4h:4 .... 1010 0000 imm4l:4 \
--             vd=%vd_sp
--VMOV_imm_dp  ---- 1110 1.11 imm4h:4 .... 1011 0000 imm4l:4 \
--             vd=%vd_dp
-+VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
-+             vd=%vd_sp imm=%vmov_imm
-+VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
-+             vd=%vd_dp imm=%vmov_imm
- VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
-              vd=%vd_sp vm=%vm_sp
---
-.20.1

-[Qemu-devel] [PULL 13/24] target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
+Deleted patch
-Where Neon instructions are floating point operations, we
-mostly use the old VFP utility functions like gen_vfp_abs()
-which work on the TCG globals cpu_F0s and cpu_F1s. The
-Neon for-each-element loop conditionally loads the inputs
-into either a plain old TCG temporary for most operations
-or into cpu_F0s for float operations, and similarly stores
-back either cpu_F0s or the temporary.
-Switch NEON_2RM_VABS_F away from using cpu_F0s, and
-update neon_2rm_is_float_op() accordingly.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-4-peter.maydell@linaro.org
----
- target/arm/translate.c | 19 ++++++++-----------
-file changed, 8 insertions(+), 11 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
-     return statusptr;
- }
--static inline void gen_vfp_abs(int dp)
--{
--    if (dp)
--        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
--    else
--        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
--}
--
- static inline void gen_vfp_neg(int dp)
- {
-     if (dp)
-@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
- static int neon_2rm_is_float_op(int op)
- {
--    /* Return true if this neon 2reg-misc op is float-to-float */
--    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
-+    /*
-+     * Return true if this neon 2reg-misc op is float-to-float.
-+     * This is not a property of the operation but of our code --
-+     * what we are asking here is "does the code for this case in
-+     * the Neon for-each-pass loop use cpu_F0s?".
-+     */
-+    return (op == NEON_2RM_VNEG_F ||
-             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-             op == NEON_2RM_VRINTM ||
-             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                             break;
-                         }
-                         case NEON_2RM_VABS_F:
--                            gen_vfp_abs(0);
-+                            gen_helper_vfp_abss(tmp, tmp);
-                             break;
-                         case NEON_2RM_VNEG_F:
-                             gen_vfp_neg(0);
---
-.20.1

-[Qemu-devel] [PULL 14/24] target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
+Deleted patch
-Switch NEON_2RM_VABS_F away from using cpu_F0s.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-5-peter.maydell@linaro.org
----
- target/arm/translate.c | 13 ++-----------
-file changed, 2 insertions(+), 11 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
-     return statusptr;
- }
--static inline void gen_vfp_neg(int dp)
--{
--    if (dp)
--        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
--    else
--        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
--}
--
- #define VFP_GEN_ITOF(name) \
- static inline void gen_vfp_##name(int dp, int neon) \
- { \
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return (op == NEON_2RM_VNEG_F ||
--            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-             op == NEON_2RM_VRINTM ||
-             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
-             op >= NEON_2RM_VRECPE_F);
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                             gen_helper_vfp_abss(tmp, tmp);
-                             break;
-                         case NEON_2RM_VNEG_F:
--                            gen_vfp_neg(0);
-+                            gen_helper_vfp_negs(tmp, tmp);
-                             break;
-                         case NEON_2RM_VSWP:
-                             tmp2 = neon_load_reg(rd, pass);
---
-.20.1

-[Qemu-devel] [PULL 15/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
+Deleted patch
-Switch NEON_2RM_VRINT* away from using cpu_F0s.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-6-peter.maydell@linaro.org
----
- target/arm/translate.c | 8 +++-----
-file changed, 3 insertions(+), 5 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
--            op == NEON_2RM_VRINTM ||
--            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
-+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-             op >= NEON_2RM_VRECPE_F);
- }
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
-                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
-                                                       cpu_env);
--                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
-+                            gen_helper_rints(tmp, tmp, fpstatus);
-                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
-                                                       cpu_env);
-                             tcg_temp_free_ptr(fpstatus);
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         case NEON_2RM_VRINTX:
-                         {
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
--                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
-+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
-                             tcg_temp_free_ptr(fpstatus);
-                             break;
-                         }
---
-.20.1

-[Qemu-devel] [PULL 16/24] target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
+Deleted patch
-Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-7-peter.maydell@linaro.org
----
- target/arm/translate.c | 7 +++----
-file changed, 3 insertions(+), 4 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
--            op >= NEON_2RM_VRECPE_F);
-+    return op >= NEON_2RM_VRECPE_F;
- }
- static bool neon_2rm_is_v8_op(int op)
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                                                       cpu_env);
-                             if (is_signed) {
--                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
-+                                gen_helper_vfp_tosls(tmp, tmp,
-                                                      tcg_shift, fpst);
-                             } else {
--                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
-+                                gen_helper_vfp_touls(tmp, tmp,
-                                                      tcg_shift, fpst);
-                             }
---
-.20.1

-[Qemu-devel] [PULL 17/24] target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
+Deleted patch
-Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-8-peter.maydell@linaro.org
----
- target/arm/translate.c | 6 +++---
-file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
-      * what we are asking here is "does the code for this case in
-      * the Neon for-each-pass loop use cpu_F0s?".
-      */
--    return op >= NEON_2RM_VRECPE_F;
-+    return op >= NEON_2RM_VCVT_FS;
- }
- static bool neon_2rm_is_v8_op(int op)
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         case NEON_2RM_VRECPE_F:
-                         {
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
--                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
-+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
-                             tcg_temp_free_ptr(fpstatus);
-                             break;
-                         }
-                         case NEON_2RM_VRSQRTE_F:
-                         {
-                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
--                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
-+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
-                             tcg_temp_free_ptr(fpstatus);
-                             break;
-                         }
---
-.20.1

-[Qemu-devel] [PULL 19/24] target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
+Deleted patch
-Stop using cpu_F0s in the Neon VCVT fixed-point operations.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
----
- target/arm/translate.c | 62 +++++++++++++++++++-----------------------
-file changed, 28 insertions(+), 34 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
- /* Function prototypes for gen_ functions calling Neon helpers.  */
- typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
-                                  TCGv_i32, TCGv_i32);
-+/* Function prototypes for gen_ functions for fix point conversions */
-+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
- /* initialize TCG globals.  */
- void arm_translate_init(void)
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
-     return statusptr;
- }
--#define VFP_GEN_FIX(name, round) \
--static inline void gen_vfp_##name(int dp, int shift, int neon) \
--{ \
--    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
--    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
--    if (dp) { \
--        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
--                                        statusptr); \
--    } else { \
--        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
--                                        statusptr); \
--    } \
--    tcg_temp_free_i32(tmp_shift); \
--    tcg_temp_free_ptr(statusptr); \
--}
--VFP_GEN_FIX(tosl, _round_to_zero)
--VFP_GEN_FIX(toul, _round_to_zero)
--VFP_GEN_FIX(slto, )
--VFP_GEN_FIX(ulto, )
--#undef VFP_GEN_FIX
--
- static inline long vfp_reg_offset(bool dp, unsigned reg)
- {
-     if (dp) {
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                 }
-             } else if (op >= 14) {
-                 /* VCVT fixed-point.  */
-+                TCGv_ptr fpst;
-+                TCGv_i32 shiftv;
-+                VFPGenFixPointFn *fn;
-+
-                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
-                     return 1;
-                 }
-+
-+                if (!(op & 1)) {
-+                    if (u) {
-+                        fn = gen_helper_vfp_ultos;
-+                    } else {
-+                        fn = gen_helper_vfp_sltos;
-+                    }
-+                } else {
-+                    if (u) {
-+                        fn = gen_helper_vfp_touls_round_to_zero;
-+                    } else {
-+                        fn = gen_helper_vfp_tosls_round_to_zero;
-+                    }
-+                }
-+
-                 /* We have already masked out the must-be-1 top bit of imm6,
-                  * hence this 32-shift where the ARM ARM has 64-imm6.
-                  */
-                 shift = 32 - shift;
-+                fpst = get_fpstatus_ptr(1);
-+                shiftv = tcg_const_i32(shift);
-                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
--                    if (!(op & 1)) {
--                        if (u)
--                            gen_vfp_ulto(0, shift, 1);
--                        else
--                            gen_vfp_slto(0, shift, 1);
--                    } else {
--                        if (u)
--                            gen_vfp_toul(0, shift, 1);
--                        else
--                            gen_vfp_tosl(0, shift, 1);
--                    }
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
-+                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
-+                    fn(tmpf, tmpf, shiftv, fpst);
-+                    neon_store_reg(rd, pass, tmpf);
-                 }
-+                tcg_temp_free_ptr(fpst);
-+                tcg_temp_free_i32(shiftv);
-             } else {
-                 return 1;
-             }
---
-.20.1

-[Qemu-devel] [PULL 20/24] target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
+Deleted patch
-Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
- * don't use cpu_F0s
- * don't use tcg_gen_ld_f32
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-11-peter.maydell@linaro.org
----
- target/arm/translate.c | 27 ++++++++++++---------------
-file changed, 12 insertions(+), 15 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-     return ret;
- }
--#define tcg_gen_ld_f32 tcg_gen_ld_i32
- #define tcg_gen_st_f32 tcg_gen_st_i32
- #define ARM_CP_RW_BIT   (1 << 20)
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                         q || (rm & 1)) {
-                         return 1;
-                     }
--                    tmp = tcg_temp_new_i32();
--                    tmp2 = tcg_temp_new_i32();
-                     fpst = get_fpstatus_ptr(true);
-                     ahp = get_ahp_flag();
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
-+                    tmp = neon_load_reg(rm, 0);
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
-+                    tmp2 = neon_load_reg(rm, 1);
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
-                     tcg_gen_shli_i32(tmp2, tmp2, 16);
-                     tcg_gen_or_i32(tmp2, tmp2, tmp);
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
--                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
-+                    tcg_temp_free_i32(tmp);
-+                    tmp = neon_load_reg(rm, 2);
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
-+                    tmp3 = neon_load_reg(rm, 3);
-                     neon_store_reg(rd, 0, tmp2);
--                    tmp2 = tcg_temp_new_i32();
--                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
--                    tcg_gen_shli_i32(tmp2, tmp2, 16);
--                    tcg_gen_or_i32(tmp2, tmp2, tmp);
--                    neon_store_reg(rd, 1, tmp2);
-+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
-+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
-+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
-+                    neon_store_reg(rd, 1, tmp3);
-                     tcg_temp_free_i32(tmp);
-                     tcg_temp_free_i32(ahp);
-                     tcg_temp_free_ptr(fpst);
---
-.20.1

-[Qemu-devel] [PULL 21/24] target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
+Deleted patch
-Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
- * don't use CPU_F0s
- * don't use tcg_gen_st_f32
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-12-peter.maydell@linaro.org
----
- target/arm/translate.c | 26 +++++++++++---------------
-file changed, 11 insertions(+), 15 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
-     return ret;
- }
--#define tcg_gen_st_f32 tcg_gen_st_i32
--
- #define ARM_CP_RW_BIT   (1 << 20)
- /* Include the VFP decoder */
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
-                     tmp = neon_load_reg(rm, 0);
-                     tmp2 = neon_load_reg(rm, 1);
-                     tcg_gen_ext16u_i32(tmp3, tmp);
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
--                    tcg_gen_shri_i32(tmp3, tmp, 16);
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
--                    tcg_temp_free_i32(tmp);
-+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
-+                    neon_store_reg(rd, 0, tmp3);
-+                    tcg_gen_shri_i32(tmp, tmp, 16);
-+                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
-+                    neon_store_reg(rd, 1, tmp);
-+                    tmp3 = tcg_temp_new_i32();
-                     tcg_gen_ext16u_i32(tmp3, tmp2);
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
--                    tcg_gen_shri_i32(tmp3, tmp2, 16);
--                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
--                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
--                    tcg_temp_free_i32(tmp2);
--                    tcg_temp_free_i32(tmp3);
-+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
-+                    neon_store_reg(rd, 2, tmp3);
-+                    tcg_gen_shri_i32(tmp2, tmp2, 16);
-+                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
-+                    neon_store_reg(rd, 3, tmp2);
-                     tcg_temp_free_i32(ahp);
-                     tcg_temp_free_ptr(fpst);
-                     break;
---
-.20.1

-[Qemu-devel] [PULL 22/24] target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
+Deleted patch
-Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.
-cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
-cpu_V1 are used by both iwmmxt and Neon.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190613163917.28589-13-peter.maydell@linaro.org
----
- target/arm/translate.c | 12 ++----------
-file changed, 2 insertions(+), 10 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
- TCGv_i64 cpu_exclusive_addr;
- TCGv_i64 cpu_exclusive_val;
--/* FIXME:  These should be removed.  */
--static TCGv_i32 cpu_F0s, cpu_F1s;
--static TCGv_i64 cpu_F0d, cpu_F1d;
--
- #include "exec/gen-icount.h"
- static const char * const regnames[] =
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
-         dc->base.max_insns = MIN(dc->base.max_insns, bound);
-     }
--    cpu_F0s = tcg_temp_new_i32();
--    cpu_F1s = tcg_temp_new_i32();
--    cpu_F0d = tcg_temp_new_i64();
--    cpu_F1d = tcg_temp_new_i64();
--    cpu_V0 = cpu_F0d;
--    cpu_V1 = cpu_F1d;
-+    cpu_V0 = tcg_temp_new_i64();
-+    cpu_V1 = tcg_temp_new_i64();
-     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
-     cpu_M0 = tcg_temp_new_i64();
- }
---
-.20.1

-[Qemu-devel] [PULL 23/24] target/arm: Fix typos in trans function prototypes
+Deleted patch
-In several places cut and paste errors meant we were using the wrong
-type for the 'arg' struct in trans_ functions called by the
-decodetree decoder, because we were using the _sp version of the
-struct in the _dp function.  These were harmless, because the two
-structs were identical and so decodetree made them typedefs of the
-same underlying structure (and we'd have had a compile error if they
-were not harmless), but we should clean them up anyway.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
----
- target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
-file changed, 14 insertions(+), 14 deletions(-)
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
-+++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
-     return true;
- }
--static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
-+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
- {
-     TCGv_i32 tmp;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-     return true;
- }
--static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
-+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
- {
-     uint32_t offset;
-     TCGv_i32 addr;
-@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-     tcg_temp_free_i64(tmp);
- }
--static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
-+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-     tcg_temp_free_i64(tmp);
- }
--static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
-+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-     tcg_temp_free_i64(tmp);
- }
--static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
-+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-     tcg_temp_free_i64(tmp);
- }
--static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
-+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
-     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
- }
--static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
-+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
- }
-@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
-     gen_helper_vfp_negd(vd, vd);
- }
--static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
-+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
-     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
- }
--static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
-+static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
-     return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
- }
--static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
-+static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
-     return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
- }
--static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
-+static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
- {
-     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
-     return true;
- }
--static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
-+static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
- {
-     /*
-      * VFNMA : fd = muladd(-fd,  fn, fm)
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
-     return true;
- }
--static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
-+static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
- {
-     TCGv_ptr fpst;
-     TCGv_i64 tmp;
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
-     return true;
- }
--static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
-+static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
- {
-     TCGv_ptr fpst;
-     TCGv_i64 tmp;
---
-.20.1

Latest arm queue, half minor code cleanups and half minor
bug fixes.

-- PMM

The following changes since commit 5d0e5694470d2952b4f257bc985cac8c89b4fd92:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-06-17 11:55:14 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190617

for you to fetch changes up to 1120827fa182f0e76226df7ffe7a86598d1df54f:

target/arm: Only implement doubles if the FPU supports them (2019-06-17 15:15:06 +0100)

----------------------------------------------------------------
target-arm queue:
 * support large kernel images in bootloader (by avoiding
   putting the initrd over the top of them)
 * correctly disable FPU/DSP in the CPU for the mps2-an521, musca-a boards
 * arm_gicv3: Fix decoding of ID register range
 * arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
 * some code cleanups following on from the VFP decodetree conversion
 * Only implement doubles if the FPU supports them
   (so we now correctly model Cortex-M4, -M33 as single precision only)

----------------------------------------------------------------
Peter Maydell (24):
      hw/arm/boot: Don't assume RAM starts at address zero
      hw/arm/boot: Diagnose layouts that put initrd or DTB off the end of RAM
      hw/arm/boot: Avoid placing the initrd on top of the kernel
      hw/arm/boot: Honour image size field in AArch64 Image format kernels
      target/arm: Allow VFP and Neon to be disabled via a CPU property
      target/arm: Allow M-profile CPUs to disable the DSP extension via CPU property
      hw/arm/armv7m: Forward "vfp" and "dsp" properties to CPU
      hw/arm: Correctly disable FPU/DSP for some ARMSSE-based boards
      hw/intc/arm_gicv3: Fix decoding of ID register range
      hw/intc/arm_gicv3: GICD_TYPER.SecurityExtn is RAZ if GICD_CTLR.DS == 1
      target/arm: Move vfp_expand_imm() to translate.[ch]
      target/arm: Use vfp_expand_imm() for AArch32 VFP VMOV_imm
      target/arm: Stop using cpu_F0s for NEON_2RM_VABS_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VNEG_F
      target/arm: Stop using cpu_F0s for NEON_2RM_VRINT*
      target/arm: Stop using cpu_F0s for NEON_2RM_VCVT[ANPM][US]
      target/arm: Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F
      target/arm: Stop using cpu_F0s for Neon f32/s32 VCVT
      target/arm: Stop using cpu_F0s in Neon VCVT fixed-point ops
      target/arm: stop using deprecated functions in NEON_2RM_VCVT_F16_F32
      target/arm: Stop using deprecated functions in NEON_2RM_VCVT_F32_F16
      target/arm: Remove unused cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d
      target/arm: Fix typos in trans function prototypes
      target/arm: Only implement doubles if the FPU supports them

In the Arm kernel/initrd loading code, in some places we make the
incorrect assumption that info->ram_size can be treated as the
address of the end of RAM, as for instance when we calculate the
available space for the initrd using "info->ram_size - info->initrd_start".
This is wrong, because many Arm boards (including "virt") specify
a non-zero info->loader_start to indicate that their RAM area
starts at a non-zero physical address.

Correct the places which make this incorrect assumption.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     int elf_machine;
     hwaddr entry;
     static const ARMInsnFixup *primary_loader;
+    uint64_t ram_end = info->loader_start + info->ram_size;
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         primary_loader = bootloader_aarch64;
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
-                                             info->ram_size - KERNEL_LOAD_ADDR,
-                                             as);
+                                             ram_end - KERNEL_LOAD_ADDR, as);
         is_linux = 1;
     }
     if (kernel_size < 0) {
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         if (info->initrd_filename) {
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
-                                          info->ram_size - info->initrd_start,
-                                          as);
+                                          ram_end - info->initrd_start, as);
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys_as(info->initrd_filename,
                                                      info->initrd_start,
-                                                     info->ram_size -
+                                                     ram_end -
                                                      info->initrd_start,
                                                      as);
             }
-- 
2.20.1

We calculate the locations in memory where we want to put the
initrd and the DTB based on the size of the kernel, since they
come after it. Add some explicit checks that these aren't off the
end of RAM entirely.

(At the moment the way we calculate the initrd_start means that
it can't ever be off the end of RAM, but that will change with
the next commit.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         error_report("could not load kernel '%s'", info->kernel_filename);
         exit(1);
     }
+
+    if (kernel_size > info->ram_size) {
+        error_report("kernel '%s' is too large to fit in RAM "
+                     "(kernel size %d, RAM size %" PRId64 ")",
+                     info->kernel_filename, kernel_size, info->ram_size);
+        exit(1);
+    }
+
     info->entry = entry;
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
         if (info->initrd_filename) {
+
+            if (info->initrd_start >= ram_end) {
+                error_report("not enough space after kernel to load initrd");
+                exit(1);
+            }
+
             initrd_size = load_ramdisk_as(info->initrd_filename,
                                           info->initrd_start,
                                           ram_end - info->initrd_start, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                              info->initrd_filename);
                 exit(1);
             }
+            if (info->initrd_start + initrd_size > info->ram_size) {
+                error_report("could not load initrd '%s': "
+                             "too big to fit into RAM after the kernel",
+                             info->initrd_filename);
+            }
         } else {
             initrd_size = 0;
         }
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
             /* Place the DTB after the initrd in memory with alignment. */
             info->dtb_start = QEMU_ALIGN_UP(info->initrd_start + initrd_size,
                                            align);
+            if (info->dtb_start >= ram_end) {
+                error_report("Not enough space for DTB after kernel/initrd");
+                exit(1);
+            }
             fixupcontext[FIXUP_ARGPTR_LO] = info->dtb_start;
             fixupcontext[FIXUP_ARGPTR_HI] = info->dtb_start >> 32;
         } else {
-- 
2.20.1

We currently put the initrd at the smaller of:
 * 128MB into RAM
 * halfway into the RAM
(with the dtb following it).

However for large kernels this might mean that the kernel
overlaps the initrd. For some kinds of kernel (self-decompressing
32-bit kernels, and ELF images with a BSS section at the end)
we don't know the exact size, but even there we have a
minimum size. Put the initrd at least further into RAM than
that. For image formats that can give us an exact kernel size, this
will mean that we definitely avoid overlaying kernel and initrd.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     if (info->nb_cpus == 0)
         info->nb_cpus = 1;
 
-    /*
-     * We want to put the initrd far enough into RAM that when the
-     * kernel is uncompressed it will not clobber the initrd. However
-     * on boards without much RAM we must ensure that we still leave
-     * enough room for a decent sized initrd, and on boards with large
-     * amounts of RAM we must avoid the initrd being so far up in RAM
-     * that it is outside lowmem and inaccessible to the kernel.
-     * So for boards with less  than 256MB of RAM we put the initrd
-     * halfway into RAM, and for boards with 256MB of RAM or more we put
-     * the initrd at 128MB.
-     */
-    info->initrd_start = info->loader_start +
-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
-
     /* Assume that raw images are linux kernels, and ELF images are not.  */
     kernel_size = arm_load_elf(info, &elf_entry, &elf_low_addr,
                                &elf_high_addr, elf_machine, as);
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
     }
 
     info->entry = entry;
+
+    /*
+     * We want to put the initrd far enough into RAM that when the
+     * kernel is uncompressed it will not clobber the initrd. However
+     * on boards without much RAM we must ensure that we still leave
+     * enough room for a decent sized initrd, and on boards with large
+     * amounts of RAM we must avoid the initrd being so far up in RAM
+     * that it is outside lowmem and inaccessible to the kernel.
+     * So for boards with less  than 256MB of RAM we put the initrd
+     * halfway into RAM, and for boards with 256MB of RAM or more we put
+     * the initrd at 128MB.
+     * We also refuse to put the initrd somewhere that will definitely
+     * overlay the kernel we just loaded, though for kernel formats which
+     * don't tell us their exact size (eg self-decompressing 32-bit kernels)
+     * we might still make a bad choice here.
+     */
+    info->initrd_start = info->loader_start +
+        MAX(MIN(info->ram_size / 2, 128 * 1024 * 1024), kernel_size);
+    info->initrd_start = TARGET_PAGE_ALIGN(info->initrd_start);
+
     if (is_linux) {
         uint32_t fixupcontext[FIXUP_MAX];
 
-- 
2.20.1

Since Linux v3.17, the kernel's Image header includes a field image_size,
which gives the total size of the kernel including unpopulated data
sections such as the BSS). If this is present, then return it from
load_aarch64_image() as the true size of the kernel rather than
just using the size of the Image file itself. This allows the code
which calculates where to put the initrd to avoid putting it in
the kernel's BSS area.

This means that we should be able to reliably load kernel images
which are larger than 128MB without accidentally putting the
initrd or dtb in locations that clash with the kernel itself.

Fixes: https://bugs.launchpad.net/qemu/+bug/1823998
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Mark Rutland <mark.rutland@arm.com>
Message-id: 20190516144733.32399-5-peter.maydell@linaro.org
---
 hw/arm/boot.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
                                    hwaddr *entry, AddressSpace *as)
 {
     hwaddr kernel_load_offset = KERNEL64_LOAD_ADDR;
+    uint64_t kernel_size = 0;
     uint8_t *buffer;
     int size;
 
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
          * is only valid if the image_size is non-zero.
          */
         memcpy(&hdrvals, buffer + ARM64_TEXT_OFFSET_OFFSET, sizeof(hdrvals));
-        if (hdrvals[1] != 0) {
+
+        kernel_size = le64_to_cpu(hdrvals[1]);
+
+        if (kernel_size != 0) {
             kernel_load_offset = le64_to_cpu(hdrvals[0]);
 
             /*
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
         }
     }
 
+    /*
+     * Kernels before v3.17 don't populate the image_size field, and
+     * raw images have no header. For those our best guess at the size
+     * is the size of the Image file itself.
+     */
+    if (kernel_size == 0) {
+        kernel_size = size;
+    }
+
     *entry = mem_base + kernel_load_offset;
     rom_add_blob_fixed_as(filename, buffer, size, *entry, as);
 
     g_free(buffer);
 
-    return size;
+    return kernel_size;
 }
 
 static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
-- 
2.20.1

Allow VFP and neon to be disabled via a CPU property. As with
the "pmu" property, we only allow these features to be removed
from CPUs which have it by default, not added to CPUs which
don't have it.

The primary motivation here is to be able to optionally
create Cortex-M33 CPUs with no FPU, but we provide switches
for both VFP and Neon because the two interact:
 * AArch64 can't have one without the other
 * Some ID register fields only change if both are disabled

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-2-peter.maydell@linaro.org
---
 target/arm/cpu.h |   4 ++
 target/arm/cpu.c | 150 +++++++++++++++++++++++++++++++++++++++++++++--
 2 files changed, 148 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_el3;
     /* CPU has PMU (Performance Monitor Unit) */
     bool has_pmu;
+    /* CPU has VFP */
+    bool has_vfp;
+    /* CPU has Neon */
+    bool has_neon;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_cfgend_property =
 static Property arm_cpu_has_pmu_property =
             DEFINE_PROP_BOOL("pmu", ARMCPU, has_pmu, true);
 
+static Property arm_cpu_has_vfp_property =
+            DEFINE_PROP_BOOL("vfp", ARMCPU, has_vfp, true);
+
+static Property arm_cpu_has_neon_property =
+            DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
+    /* Similarly for the VFP feature bits */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP3);
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
+        set_feature(&cpu->env, ARM_FEATURE_VFP);
+    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
                                  &error_abort);
     }
 
+    /*
+     * Allow user to turn off VFP and Neon support, but only for TCG --
+     * KVM does not currently allow us to lie to the guest about its
+     * ID/feature registers, so the guest always sees what the host has.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        cpu->has_vfp = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property,
+                                     &error_abort);
+        }
+    }
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_NEON)) {
+        cpu->has_neon = true;
+        if (!kvm_enabled()) {
+            qdev_property_add_static(DEVICE(obj), &arm_cpu_has_neon_property,
+                                     &error_abort);
+        }
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+        cpu->has_vfp != cpu->has_neon) {
+        /*
+         * This is an architectural requirement for AArch64; AArch32 is
+         * more flexible and permits VFP-no-Neon and Neon-no-VFP.
+         */
+        error_setg(errp,
+                   "AArch64 CPUs must have both VFP and Neon or neither");
+        return;
+    }
+
+    if (!cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_VFP);
+        unset_feature(env, ARM_FEATURE_VFP3);
+        unset_feature(env, ARM_FEATURE_VFP4);
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, FP, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, JSCVT, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, FPSP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDP, 0);
+        u = FIELD_DP32(u, MVFR0, FPTRAP, 0);
+        u = FIELD_DP32(u, MVFR0, FPDIVIDE, 0);
+        u = FIELD_DP32(u, MVFR0, FPSQRT, 0);
+        u = FIELD_DP32(u, MVFR0, FPSHVEC, 0);
+        u = FIELD_DP32(u, MVFR0, FPROUND, 0);
+        cpu->isar.mvfr0 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, FPFTZ, 0);
+        u = FIELD_DP32(u, MVFR1, FPDNAN, 0);
+        u = FIELD_DP32(u, MVFR1, FPHP, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, FPMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon) {
+        uint64_t t;
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_NEON);
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, DP, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        t = cpu->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 0xf);
+        cpu->isar.id_aa64pfr0 = t;
+
+        u = cpu->isar.id_isar5;
+        u = FIELD_DP32(u, ID_ISAR5, RDM, 0);
+        u = FIELD_DP32(u, ID_ISAR5, VCMA, 0);
+        cpu->isar.id_isar5 = u;
+
+        u = cpu->isar.id_isar6;
+        u = FIELD_DP32(u, ID_ISAR6, DP, 0);
+        u = FIELD_DP32(u, ID_ISAR6, FHM, 0);
+        cpu->isar.id_isar6 = u;
+
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDLS, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
+
+        u = cpu->isar.mvfr2;
+        u = FIELD_DP32(u, MVFR2, SIMDMISC, 0);
+        cpu->isar.mvfr2 = u;
+    }
+
+    if (!cpu->has_neon && !cpu->has_vfp) {
+        uint64_t t;
+        uint32_t u;
+
+        t = cpu->isar.id_aa64isar0;
+        t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 0);
+        cpu->isar.id_aa64isar0 = t;
+
+        t = cpu->isar.id_aa64isar1;
+        t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 0);
+        cpu->isar.id_aa64isar1 = t;
+
+        u = cpu->isar.mvfr0;
+        u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
+        cpu->isar.mvfr0 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     if (arm_feature(env, ARM_FEATURE_V5)) {
         set_feature(env, ARM_FEATURE_V4T);
     }
-    if (arm_feature(env, ARM_FEATURE_VFP4)) {
-        set_feature(env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(env, ARM_FEATURE_VFP3)) {
-        set_feature(env, ARM_FEATURE_VFP);
-    }
     if (arm_feature(env, ARM_FEATURE_LPAE)) {
         set_feature(env, ARM_FEATURE_V7MP);
         set_feature(env, ARM_FEATURE_PXN);
-- 
2.20.1

Allow the DSP extension to be disabled via a CPU property for
M-profile CPUs. (A and R-profile CPUs don't have this extension
as a defined separate optional architecture extension, so
they don't need the property.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-3-peter.maydell@linaro.org
---
 target/arm/cpu.h |  2 ++
 target/arm/cpu.c | 29 +++++++++++++++++++++++++++++
 2 files changed, 31 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_vfp;
     /* CPU has Neon */
     bool has_neon;
+    /* CPU has M-profile DSP extension */
+    bool has_dsp;
 
     /* CPU has memory protection unit */
     bool has_mpu;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_has_vfp_property =
 static Property arm_cpu_has_neon_property =
             DEFINE_PROP_BOOL("neon", ARMCPU, has_neon, true);
 
+static Property arm_cpu_has_dsp_property =
+            DEFINE_PROP_BOOL("dsp", ARMCPU, has_dsp, true);
+
 static Property arm_cpu_has_mpu_property =
             DEFINE_PROP_BOOL("has-mpu", ARMCPU, has_mpu, true);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
         }
     }
 
+    if (arm_feature(&cpu->env, ARM_FEATURE_M) &&
+        arm_feature(&cpu->env, ARM_FEATURE_THUMB_DSP)) {
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_has_dsp_property,
+                                 &error_abort);
+    }
+
     if (arm_feature(&cpu->env, ARM_FEATURE_PMSA)) {
         qdev_property_add_static(DEVICE(obj), &arm_cpu_has_mpu_property,
                                  &error_abort);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         cpu->isar.mvfr0 = u;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+        uint32_t u;
+
+        unset_feature(env, ARM_FEATURE_THUMB_DSP);
+
+        u = cpu->isar.id_isar1;
+        u = FIELD_DP32(u, ID_ISAR1, EXTEND, 1);
+        cpu->isar.id_isar1 = u;
+
+        u = cpu->isar.id_isar2;
+        u = FIELD_DP32(u, ID_ISAR2, MULTU, 1);
+        u = FIELD_DP32(u, ID_ISAR2, MULTS, 1);
+        cpu->isar.id_isar2 = u;
+
+        u = cpu->isar.id_isar3;
+        u = FIELD_DP32(u, ID_ISAR3, SIMD, 1);
+        u = FIELD_DP32(u, ID_ISAR3, SATURATE, 0);
+        cpu->isar.id_isar3 = u;
+    }
+
     /* Some features automatically imply others: */
     if (arm_feature(env, ARM_FEATURE_V8)) {
         if (arm_feature(env, ARM_FEATURE_M)) {
-- 
2.20.1

Create "vfp" and "dsp" properties on the armv7m container object
which will be forwarded to its CPU object, so that SoCs can
configure whether the CPU has these features.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-4-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 ++++
 hw/arm/armv7m.c         | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
  *   devices will be automatically layered on top of this view.)
  * + Property "idau": IDAU interface (forwarded to CPU object)
  * + Property "init-svtor": secure VTOR reset value (forwarded to CPU object)
+ * + Property "vfp": enable VFP (forwarded to CPU object)
+ * + Property "dsp": enable DSP (forwarded to CPU object)
  * + Property "enable-bitband": expose bitbanded IO
  */
 typedef struct ARMv7MState {
@@ -XXX,XX +XXX,XX @@ typedef struct ARMv7MState {
     uint32_t init_svtor;
     bool enable_bitband;
     bool start_powered_off;
+    bool vfp;
+    bool dsp;
 } ARMv7MState;
 
 #endif
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+    if (object_property_find(OBJECT(s->cpu), "vfp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->vfp,
+                                 "vfp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
+    if (object_property_find(OBJECT(s->cpu), "dsp", NULL)) {
+        object_property_set_bool(OBJECT(s->cpu), s->dsp,
+                                 "dsp", &err);
+        if (err != NULL) {
+            error_propagate(errp, err);
+            return;
+        }
+    }
 
     /*
      * Tell the CPU where the NVIC is; it will fail realize if it doesn't
@@ -XXX,XX +XXX,XX @@ static Property armv7m_properties[] = {
     DEFINE_PROP_BOOL("enable-bitband", ARMv7MState, enable_bitband, false),
     DEFINE_PROP_BOOL("start-powered-off", ARMv7MState, start_powered_off,
                      false),
+    DEFINE_PROP_BOOL("vfp", ARMv7MState, vfp, true),
+    DEFINE_PROP_BOOL("dsp", ARMv7MState, dsp, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

The SSE-200 hardware has configurable integration settings which
determine whether its two CPUs have the FPU and DSP:
 * CPU0_FPU (default 0)
 * CPU0_DSP (default 0)
 * CPU1_FPU (default 1)
 * CPU1_DSP (default 1)

Similarly, the IoTKit has settings for its single CPU:
 * CPU0_FPU (default 1)
 * CPU0_DSP (default 1)

Of our four boards that use either the IoTKit or the SSE-200:
 * mps2-an505, mps2-an521 and musca-a use the default settings
 * musca-b1 enables FPU and DSP on both CPUs

Currently QEMU models all these boards using CPUs with
both FPU and DSP enabled. This means that we are incorrect
for mps2-an521 and musca-a, which should not have FPU or DSP
on CPU0.

Create QOM properties on the ARMSSE devices corresponding to the
default h/w integration settings, and make the Musca-B1 board
enable FPU and DSP on both CPUs. This fixes the mps2-an521
and musca-a behaviour, and leaves the musca-b1 and mps2-an505
behaviour unchanged.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190517174046.11146-5-peter.maydell@linaro.org
---
 include/hw/arm/armsse.h |  7 +++++
 hw/arm/armsse.c         | 58 ++++++++++++++++++++++++++++++++---------
 hw/arm/musca.c          |  8 ++++++
 3 files changed, 61 insertions(+), 12 deletions(-)

diff --git a/include/hw/arm/armsse.h b/include/hw/arm/armsse.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armsse.h
+++ b/include/hw/arm/armsse.h
@@ -XXX,XX +XXX,XX @@
  *    address of each SRAM bank (and thus the total amount of internal SRAM)
  *  + QOM property "init-svtor" sets the initial value of the CPU SVTOR register
  *    (where it expects to load the PC and SP from the vector table on reset)
+ *  + QOM properties "CPU0_FPU", "CPU0_DSP", "CPU1_FPU" and "CPU1_DSP" which
+ *    set whether the CPUs have the FPU and DSP features present. The default
+ *    (matching the hardware) is that for CPU0 in an IoTKit and CPU1 in an
+ *    SSE-200 both are present; CPU0 in an SSE-200 has neither.
+ *    Since the IoTKit has only one CPU, it does not have the CPU1_* properties.
  *  + Named GPIO inputs "EXP_IRQ" 0..n are the expansion interrupts for CPU 0,
  *    which are wired to its NVIC lines 32 .. n+32
  *  + Named GPIO inputs "EXP_CPU1_IRQ" 0..n are the expansion interrupts for
@@ -XXX,XX +XXX,XX @@ typedef struct ARMSSE {
     uint32_t mainclk_frq;
     uint32_t sram_addr_width;
     uint32_t init_svtor;
+    bool cpu_fpu[SSE_MAX_CPUS];
+    bool cpu_dsp[SSE_MAX_CPUS];
 } ARMSSE;
 
 typedef struct ARMSSEInfo ARMSSEInfo;
diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ struct ARMSSEInfo {
     bool has_cachectrl;
     bool has_cpusecctrl;
     bool has_cpuid;
+    Property *props;
+};
+
+static Property iotkit_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], true),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], true),
+    DEFINE_PROP_END_OF_LIST()
+};
+
+static Property armsse_properties[] = {
+    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
+    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
+    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
+    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
+    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
+    DEFINE_PROP_BOOL("CPU0_FPU", ARMSSE, cpu_fpu[0], false),
+    DEFINE_PROP_BOOL("CPU0_DSP", ARMSSE, cpu_dsp[0], false),
+    DEFINE_PROP_BOOL("CPU1_FPU", ARMSSE, cpu_fpu[1], true),
+    DEFINE_PROP_BOOL("CPU1_DSP", ARMSSE, cpu_dsp[1], true),
+    DEFINE_PROP_END_OF_LIST()
 };
 
 static const ARMSSEInfo armsse_variants[] = {
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = false,
         .has_cpusecctrl = false,
         .has_cpuid = false,
+        .props = iotkit_properties,
     },
     {
         .name = TYPE_SSE200,
@@ -XXX,XX +XXX,XX @@ static const ARMSSEInfo armsse_variants[] = {
         .has_cachectrl = true,
         .has_cpusecctrl = true,
         .has_cpuid = true,
+        .props = armsse_properties,
     },
 };
 
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                 return;
             }
         }
+        if (!s->cpu_fpu[i]) {
+            object_property_set_bool(cpuobj, false, "vfp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
+        if (!s->cpu_dsp[i]) {
+            object_property_set_bool(cpuobj, false, "dsp", &err);
+            if (err) {
+                error_propagate(errp, err);
+                return;
+            }
+        }
 
         if (i > 0) {
             memory_region_add_subregion_overlap(&s->cpu_container[i], 0,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription armsse_vmstate = {
     }
 };
 
-static Property armsse_properties[] = {
-    DEFINE_PROP_LINK("memory", ARMSSE, board_memory, TYPE_MEMORY_REGION,
-                     MemoryRegion *),
-    DEFINE_PROP_UINT32("EXP_NUMIRQ", ARMSSE, exp_numirq, 64),
-    DEFINE_PROP_UINT32("MAINCLK", ARMSSE, mainclk_frq, 0),
-    DEFINE_PROP_UINT32("SRAM_ADDR_WIDTH", ARMSSE, sram_addr_width, 15),
-    DEFINE_PROP_UINT32("init-svtor", ARMSSE, init_svtor, 0x10000000),
-    DEFINE_PROP_END_OF_LIST()
-};
-
 static void armsse_reset(DeviceState *dev)
 {
     ARMSSE *s = ARMSSE(dev);
@@ -XXX,XX +XXX,XX @@ static void armsse_class_init(ObjectClass *klass, void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     IDAUInterfaceClass *iic = IDAU_INTERFACE_CLASS(klass);
     ARMSSEClass *asc = ARMSSE_CLASS(klass);
+    const ARMSSEInfo *info = data;
 
     dc->realize = armsse_realize;
     dc->vmsd = &armsse_vmstate;
-    dc->props = armsse_properties;
+    dc->props = info->props;
     dc->reset = armsse_reset;
     iic->check = armsse_idau_check;
-    asc->info = data;
+    asc->info = info;
 }
 
 static const TypeInfo armsse_info = {
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
     qdev_prop_set_uint32(ssedev, "init-svtor", mmc->init_svtor);
     qdev_prop_set_uint32(ssedev, "SRAM_ADDR_WIDTH", mmc->sram_addr_width);
     qdev_prop_set_uint32(ssedev, "MAINCLK", SYSCLK_FRQ);
+    /*
+     * Musca-A takes the default SSE-200 FPU/DSP settings (ie no for
+     * CPU0 and yes for CPU1); Musca-B1 explicitly enables them for CPU0.
+     */
+    if (mmc->type == MUSCA_B1) {
+        qdev_prop_set_bit(ssedev, "CPU0_FPU", true);
+        qdev_prop_set_bit(ssedev, "CPU0_DSP", true);
+    }
     object_property_set_bool(OBJECT(&mms->sse), true, "realized",
                              &error_fatal);
 
-- 
2.20.1

The GIC ID registers cover an area 0x30 bytes in size
(12 registers, 4 bytes each). We were incorrectly decoding
only the first 0x20 bytes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190524124248.28394-2-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c   | 4 ++--
 hw/intc/arm_gicv3_redist.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
         }
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
         /* ID registers */
         *data = gicv3_idreg(offset - GICD_IDREGS);
         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_writel(GICv3State *s, hwaddr offset,
         gicd_write_irouter(s, attrs, irq, r);
         return MEMTX_OK;
     }
-    case GICD_IDREGS ... GICD_IDREGS + 0x1f:
+    case GICD_IDREGS ... GICD_IDREGS + 0x2f:
     case GICD_TYPER:
     case GICD_IIDR:
         /* RO registers, ignore the write */
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_readl(GICv3CPUState *cs, hwaddr offset,
         }
         *data = cs->gicr_nsacr;
         return MEMTX_OK;
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         *data = gicv3_idreg(offset - GICR_IDREGS);
         return MEMTX_OK;
     default:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         return MEMTX_OK;
     case GICR_IIDR:
     case GICR_TYPER:
-    case GICR_IDREGS ... GICR_IDREGS + 0x1f:
+    case GICR_IDREGS ... GICR_IDREGS + 0x2f:
         /* RO registers, ignore the write */
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest write to RO register at offset "
-- 
2.20.1

The GICv3 specification says that the GICD_TYPER.SecurityExtn bit
is RAZ if GICD_CTLR.DS is 1. We were incorrectly making it RAZ
if the security extension is unsupported. "Security extension
unsupported" always implies GICD_CTLR.DS == 1, but the guest can
also set DS on a GIC which does support the security extension.
Fix the condition to correctly check the GICD_CTLR.DS bit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190524124248.28394-3-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_dist.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicd_readl(GICv3State *s, hwaddr offset,
          * ITLinesNumber == (num external irqs / 32) - 1
          */
         int itlinesnumber = ((s->num_irq - GIC_INTERNAL) / 32) - 1;
+        /*
+         * SecurityExtn must be RAZ if GICD_CTLR.DS == 1, and
+         * "security extensions not supported" always implies DS == 1,
+         * so we only need to check the DS bit.
+         */
+        bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
-        *data = (1 << 25) | (1 << 24) | (s->security_extn << 10) |
+        *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
             (0xf << 19) | itlinesnumber;
         return MEMTX_OK;
     }
-- 
2.20.1

We want to use vfp_expand_imm() in the AArch32 VFP decode;
move it from the a64-only header/source file to the
AArch32 one (which is always compiled even for AArch64).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-2-peter.maydell@linaro.org
---
 target/arm/translate-a64.h     |  1 -
 target/arm/translate.h         |  7 +++++++
 target/arm/translate-a64.c     | 32 --------------------------------
 target/arm/translate-vfp.inc.c | 33 +++++++++++++++++++++++++++++++++
 4 files changed, 40 insertions(+), 33 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ void write_fp_dreg(DisasContext *s, int reg, TCGv_i64 v);
 TCGv_ptr get_fpstatus_ptr(bool);
 bool logic_imm_decode_wmask(uint64_t *result, unsigned int immn,
                             unsigned int imms, unsigned int immr);
-uint64_t vfp_expand_imm(int size, uint8_t imm8);
 bool sve_access_check(DisasContext *s);
 
 /* We should have at some point before trying to access an FP register
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline void gen_ss_advance(DisasContext *s)
     }
 }
 
+/*
+ * Given a VFP floating point constant encoded into an 8 bit immediate in an
+ * instruction, expand it to the actual constant value of the specified
+ * size, as per the VFPExpandImm() pseudocode in the Arm ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8);
+
 /* Vector operations shared between ARM and AArch64.  */
 extern const GVecGen3 mla_op[4];
 extern const GVecGen3 mls_op[4];
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
     }
 }
 
-/* The imm8 encodes the sign bit, enough bits to represent an exponent in
- * the range 01....1xx to 10....0xx, and the most significant 4 bits of
- * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
- */
-uint64_t vfp_expand_imm(int size, uint8_t imm8)
-{
-    uint64_t imm;
-
-    switch (size) {
-    case MO_64:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
-            extract32(imm8, 0, 6);
-        imm <<= 48;
-        break;
-    case MO_32:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
-            (extract32(imm8, 0, 6) << 3);
-        imm <<= 16;
-        break;
-    case MO_16:
-        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
-            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
-            (extract32(imm8, 0, 6) << 6);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    return imm;
-}
-
 /* Floating point immediate
  *   31  30  29 28       24 23  22  21 20        13 12   10 9    5 4    0
  * +---+---+---+-----------+------+---+------------+-------+------+------+
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@
 #include "decode-vfp.inc.c"
 #include "decode-vfp-uncond.inc.c"
 
+/*
+ * The imm8 encodes the sign bit, enough bits to represent an exponent in
+ * the range 01....1xx to 10....0xx, and the most significant 4 bits of
+ * the mantissa; see VFPExpandImm() in the v8 ARM ARM.
+ */
+uint64_t vfp_expand_imm(int size, uint8_t imm8)
+{
+    uint64_t imm;
+
+    switch (size) {
+    case MO_64:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3fc0 : 0x4000) |
+            extract32(imm8, 0, 6);
+        imm <<= 48;
+        break;
+    case MO_32:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3e00 : 0x4000) |
+            (extract32(imm8, 0, 6) << 3);
+        imm <<= 16;
+        break;
+    case MO_16:
+        imm = (extract32(imm8, 7, 1) ? 0x8000 : 0) |
+            (extract32(imm8, 6, 1) ? 0x3000 : 0x4000) |
+            (extract32(imm8, 0, 6) << 6);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+    return imm;
+}
+
 /*
  * Return the offset of a 16-bit half of the specified VFP single-precision
  * register. If top is true, returns the top 16 bits; otherwise the bottom
-- 
2.20.1

The AArch32 VMOV (immediate) instruction uses the same VFP encoded
immediate format we already handle in vfp_expand_imm().  Use that
function rather than hand-decoding it.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-3-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++------------------------
 target/arm/vfp.decode          | 10 ++++++----
 2 files changed, 10 insertions(+), 28 deletions(-)

Where Neon instructions are floating point operations, we
mostly use the old VFP utility functions like gen_vfp_abs()
which work on the TCG globals cpu_F0s and cpu_F1s. The
Neon for-each-element loop conditionally loads the inputs
into either a plain old TCG temporary for most operations
or into cpu_F0s for float operations, and similarly stores
back either cpu_F0s or the temporary.

Switch NEON_2RM_VABS_F away from using cpu_F0s, and
update neon_2rm_is_float_op() accordingly.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_abs(int dp)
-{
-    if (dp)
-        gen_helper_vfp_absd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_abss(cpu_F0s, cpu_F0s);
-}
-
 static inline void gen_vfp_neg(int dp)
 {
     if (dp)
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 
 static int neon_2rm_is_float_op(int op)
 {
-    /* Return true if this neon 2reg-misc op is float-to-float */
-    return (op == NEON_2RM_VABS_F || op == NEON_2RM_VNEG_F ||
+    /*
+     * Return true if this neon 2reg-misc op is float-to-float.
+     * This is not a property of the operation but of our code --
+     * what we are asking here is "does the code for this case in
+     * the Neon for-each-pass loop use cpu_F0s?".
+     */
+    return (op == NEON_2RM_VNEG_F ||
             (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VABS_F:
-                            gen_vfp_abs(0);
+                            gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
                             gen_vfp_neg(0);
-- 
2.20.1

Switch NEON_2RM_VABS_F away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-static inline void gen_vfp_neg(int dp)
-{
-    if (dp)
-        gen_helper_vfp_negd(cpu_F0d, cpu_F0d);
-    else
-        gen_helper_vfp_negs(cpu_F0s, cpu_F0s);
-}
-
 #define VFP_GEN_ITOF(name) \
 static inline void gen_vfp_##name(int dp, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return (op == NEON_2RM_VNEG_F ||
-            (op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
+    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
             op == NEON_2RM_VRINTM ||
             (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             gen_helper_vfp_abss(tmp, tmp);
                             break;
                         case NEON_2RM_VNEG_F:
-                            gen_vfp_neg(0);
+                            gen_helper_vfp_negs(tmp, tmp);
                             break;
                         case NEON_2RM_VSWP:
                             tmp2 = neon_load_reg(rd, pass);
-- 
2.20.1

Switch NEON_2RM_VRINT* away from using cpu_F0s.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VRINTN && op <= NEON_2RM_VRINTZ) ||
-            op == NEON_2RM_VRINTM ||
-            (op >= NEON_2RM_VRINTP && op <= NEON_2RM_VCVTMS) ||
+    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
             op >= NEON_2RM_VRECPE_F);
 }
 
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             tcg_rmode = tcg_const_i32(arm_rmode_to_sf(rmode));
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
-                            gen_helper_rints(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints(tmp, tmp, fpstatus);
                             gen_helper_set_neon_rmode(tcg_rmode, tcg_rmode,
                                                       cpu_env);
                             tcg_temp_free_ptr(fpstatus);
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRINTX:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rints_exact(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rints_exact(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the NEON_2RM_VCVT[ANPM][US] ops.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return ((op >= NEON_2RM_VCVTAU && op <= NEON_2RM_VCVTMS) ||
-            op >= NEON_2RM_VRECPE_F);
+    return op >= NEON_2RM_VRECPE_F;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                                                       cpu_env);
 
                             if (is_signed) {
-                                gen_helper_vfp_tosls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_tosls(tmp, tmp,
                                                      tcg_shift, fpst);
                             } else {
-                                gen_helper_vfp_touls(cpu_F0s, cpu_F0s,
+                                gen_helper_vfp_touls(tmp, tmp,
                                                      tcg_shift, fpst);
                             }
 
-- 
2.20.1

Stop using cpu_F0s for NEON_2RM_VRECPE_F and NEON_2RM_VRSQRTE_F.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int neon_2rm_is_float_op(int op)
      * what we are asking here is "does the code for this case in
      * the Neon for-each-pass loop use cpu_F0s?".
      */
-    return op >= NEON_2RM_VRECPE_F;
+    return op >= NEON_2RM_VCVT_FS;
 }
 
 static bool neon_2rm_is_v8_op(int op)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         case NEON_2RM_VRECPE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_recpe_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_recpe_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
                         case NEON_2RM_VRSQRTE_F:
                         {
                             TCGv_ptr fpstatus = get_fpstatus_ptr(1);
-                            gen_helper_rsqrte_f32(cpu_F0s, cpu_F0s, fpstatus);
+                            gen_helper_rsqrte_f32(tmp, tmp, fpstatus);
                             tcg_temp_free_ptr(fpstatus);
                             break;
                         }
-- 
2.20.1

Stop using cpu_F0s for the Neon f32/s32 VCVT operations.
Since this is the last user of cpu_F0s in the Neon 2rm-op
loop, we can remove the handling code for it too.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_ITOF(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0d, cpu_F0s, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_ITOF(uito)
-VFP_GEN_ITOF(sito)
-#undef VFP_GEN_ITOF
-
-#define VFP_GEN_FTOI(name) \
-static inline void gen_vfp_##name(int dp, int neon) \
-{ \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d(cpu_F0s, cpu_F0d, statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s(cpu_F0s, cpu_F0s, statusptr); \
-    } \
-    tcg_temp_free_ptr(statusptr); \
-}
-
-VFP_GEN_FTOI(touiz)
-VFP_GEN_FTOI(tosiz)
-#undef VFP_GEN_FTOI
-
 #define VFP_GEN_FIX(name, round) \
 static inline void gen_vfp_##name(int dp, int shift, int neon) \
 { \
@@ -XXX,XX +XXX,XX @@ static const uint8_t neon_3r_sizes[] = {
 #define NEON_2RM_VCVT_SF 62
 #define NEON_2RM_VCVT_UF 63
 
-static int neon_2rm_is_float_op(int op)
-{
-    /*
-     * Return true if this neon 2reg-misc op is float-to-float.
-     * This is not a property of the operation but of our code --
-     * what we are asking here is "does the code for this case in
-     * the Neon for-each-pass loop use cpu_F0s?".
-     */
-    return op >= NEON_2RM_VCVT_FS;
-}
-
 static bool neon_2rm_is_v8_op(int op)
 {
     /* Return true if this neon 2reg-misc op is ARMv8 and up */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 default:
                 elementwise:
                     for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_ld_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rm, pass));
-                            tmp = NULL;
-                        } else {
-                            tmp = neon_load_reg(rm, pass);
-                        }
+                        tmp = neon_load_reg(rm, pass);
                         switch (op) {
                         case NEON_2RM_VREV32:
                             switch (size) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                             break;
                         }
                         case NEON_2RM_VCVT_FS: /* VCVT.F32.S32 */
-                            gen_vfp_sito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_sitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_FU: /* VCVT.F32.U32 */
-                            gen_vfp_uito(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_uitos(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_SF: /* VCVT.S32.F32 */
-                            gen_vfp_tosiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_tosizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         case NEON_2RM_VCVT_UF: /* VCVT.U32.F32 */
-                            gen_vfp_touiz(0, 1);
+                        {
+                            TCGv_ptr fpstatus = get_fpstatus_ptr(1);
+                            gen_helper_vfp_touizs(tmp, tmp, fpstatus);
+                            tcg_temp_free_ptr(fpstatus);
                             break;
+                        }
                         default:
                             /* Reserved op values were caught by the
                              * neon_2rm_sizes[] check earlier.
                              */
                             abort();
                         }
-                        if (neon_2rm_is_float_op(op)) {
-                            tcg_gen_st_f32(cpu_F0s, cpu_env,
-                                           neon_reg_offset(rd, pass));
-                        } else {
-                            neon_store_reg(rd, pass, tmp);
-                        }
+                        neon_store_reg(rd, pass, tmp);
                     }
                     break;
                 }
-- 
2.20.1

Stop using cpu_F0s in the Neon VCVT fixed-point operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190613163917.28589-10-peter.maydell@linaro.org
---
 target/arm/translate.c | 62 +++++++++++++++++++-----------------------
 1 file changed, 28 insertions(+), 34 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static const char * const regnames[] =
 /* Function prototypes for gen_ functions calling Neon helpers.  */
 typedef void NeonGenThreeOpEnvFn(TCGv_i32, TCGv_env, TCGv_i32,
                                  TCGv_i32, TCGv_i32);
+/* Function prototypes for gen_ functions for fix point conversions */
+typedef void VFPGenFixPointFn(TCGv_i32, TCGv_i32, TCGv_i32, TCGv_ptr);
 
 /* initialize TCG globals.  */
 void arm_translate_init(void)
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr get_fpstatus_ptr(int neon)
     return statusptr;
 }
 
-#define VFP_GEN_FIX(name, round) \
-static inline void gen_vfp_##name(int dp, int shift, int neon) \
-{ \
-    TCGv_i32 tmp_shift = tcg_const_i32(shift); \
-    TCGv_ptr statusptr = get_fpstatus_ptr(neon); \
-    if (dp) { \
-        gen_helper_vfp_##name##d##round(cpu_F0d, cpu_F0d, tmp_shift, \
-                                        statusptr); \
-    } else { \
-        gen_helper_vfp_##name##s##round(cpu_F0s, cpu_F0s, tmp_shift, \
-                                        statusptr); \
-    } \
-    tcg_temp_free_i32(tmp_shift); \
-    tcg_temp_free_ptr(statusptr); \
-}
-VFP_GEN_FIX(tosl, _round_to_zero)
-VFP_GEN_FIX(toul, _round_to_zero)
-VFP_GEN_FIX(slto, )
-VFP_GEN_FIX(ulto, )
-#undef VFP_GEN_FIX
-
 static inline long vfp_reg_offset(bool dp, unsigned reg)
 {
     if (dp) {
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                 }
             } else if (op >= 14) {
                 /* VCVT fixed-point.  */
+                TCGv_ptr fpst;
+                TCGv_i32 shiftv;
+                VFPGenFixPointFn *fn;
+
                 if (!(insn & (1 << 21)) || (q && ((rd | rm) & 1))) {
                     return 1;
                 }
+
+                if (!(op & 1)) {
+                    if (u) {
+                        fn = gen_helper_vfp_ultos;
+                    } else {
+                        fn = gen_helper_vfp_sltos;
+                    }
+                } else {
+                    if (u) {
+                        fn = gen_helper_vfp_touls_round_to_zero;
+                    } else {
+                        fn = gen_helper_vfp_tosls_round_to_zero;
+                    }
+                }
+
                 /* We have already masked out the must-be-1 top bit of imm6,
                  * hence this 32-shift where the ARM ARM has 64-imm6.
                  */
                 shift = 32 - shift;
+                fpst = get_fpstatus_ptr(1);
+                shiftv = tcg_const_i32(shift);
                 for (pass = 0; pass < (q ? 4 : 2); pass++) {
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, pass));
-                    if (!(op & 1)) {
-                        if (u)
-                            gen_vfp_ulto(0, shift, 1);
-                        else
-                            gen_vfp_slto(0, shift, 1);
-                    } else {
-                        if (u)
-                            gen_vfp_toul(0, shift, 1);
-                        else
-                            gen_vfp_tosl(0, shift, 1);
-                    }
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, pass));
+                    TCGv_i32 tmpf = neon_load_reg(rm, pass);
+                    fn(tmpf, tmpf, shiftv, fpst);
+                    neon_store_reg(rd, pass, tmpf);
                 }
+                tcg_temp_free_ptr(fpst);
+                tcg_temp_free_i32(shiftv);
             } else {
                 return 1;
             }
-- 
2.20.1

Remove some old constructs from NEON_2RM_VCVT_F16_F32 code:
 * don't use cpu_F0s
 * don't use tcg_gen_ld_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_ld_f32 tcg_gen_ld_i32
 #define tcg_gen_st_f32 tcg_gen_st_i32
 
 #define ARM_CP_RW_BIT   (1 << 20)
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                         q || (rm & 1)) {
                         return 1;
                     }
-                    tmp = tcg_temp_new_i32();
-                    tmp2 = tcg_temp_new_i32();
                     fpst = get_fpstatus_ptr(true);
                     ahp = get_ahp_flag();
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 0));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 1));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
+                    tmp = neon_load_reg(rm, 0);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp2 = neon_load_reg(rm, 1);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, tmp2, fpst, ahp);
                     tcg_gen_shli_i32(tmp2, tmp2, 16);
                     tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 2));
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp, cpu_F0s, fpst, ahp);
-                    tcg_gen_ld_f32(cpu_F0s, cpu_env, neon_reg_offset(rm, 3));
+                    tcg_temp_free_i32(tmp);
+                    tmp = neon_load_reg(rm, 2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+                    tmp3 = neon_load_reg(rm, 3);
                     neon_store_reg(rd, 0, tmp2);
-                    tmp2 = tcg_temp_new_i32();
-                    gen_helper_vfp_fcvt_f32_to_f16(tmp2, cpu_F0s, fpst, ahp);
-                    tcg_gen_shli_i32(tmp2, tmp2, 16);
-                    tcg_gen_or_i32(tmp2, tmp2, tmp);
-                    neon_store_reg(rd, 1, tmp2);
+                    gen_helper_vfp_fcvt_f32_to_f16(tmp3, tmp3, fpst, ahp);
+                    tcg_gen_shli_i32(tmp3, tmp3, 16);
+                    tcg_gen_or_i32(tmp3, tmp3, tmp);
+                    neon_store_reg(rd, 1, tmp3);
                     tcg_temp_free_i32(tmp);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
-- 
2.20.1

Remove some old constructns from NEON_2RM_VCVT_F16_F32 code:
 * don't use CPU_F0s
 * don't use tcg_gen_st_f32

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static TCGv_ptr vfp_reg_ptr(bool dp, int reg)
     return ret;
 }
 
-#define tcg_gen_st_f32 tcg_gen_st_i32
-
 #define ARM_CP_RW_BIT   (1 << 20)
 
 /* Include the VFP decoder */
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
                     tmp = neon_load_reg(rm, 0);
                     tmp2 = neon_load_reg(rm, 1);
                     tcg_gen_ext16u_i32(tmp3, tmp);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 0));
-                    tcg_gen_shri_i32(tmp3, tmp, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 1));
-                    tcg_temp_free_i32(tmp);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 0, tmp3);
+                    tcg_gen_shri_i32(tmp, tmp, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp, tmp, fpst, ahp);
+                    neon_store_reg(rd, 1, tmp);
+                    tmp3 = tcg_temp_new_i32();
                     tcg_gen_ext16u_i32(tmp3, tmp2);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 2));
-                    tcg_gen_shri_i32(tmp3, tmp2, 16);
-                    gen_helper_vfp_fcvt_f16_to_f32(cpu_F0s, tmp3, fpst, ahp);
-                    tcg_gen_st_f32(cpu_F0s, cpu_env, neon_reg_offset(rd, 3));
-                    tcg_temp_free_i32(tmp2);
-                    tcg_temp_free_i32(tmp3);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp3, tmp3, fpst, ahp);
+                    neon_store_reg(rd, 2, tmp3);
+                    tcg_gen_shri_i32(tmp2, tmp2, 16);
+                    gen_helper_vfp_fcvt_f16_to_f32(tmp2, tmp2, fpst, ahp);
+                    neon_store_reg(rd, 3, tmp2);
                     tcg_temp_free_i32(ahp);
                     tcg_temp_free_ptr(fpst);
                     break;
-- 
2.20.1

Remove the now unused TCG globals cpu_F0s, cpu_F0d, cpu_F1s, cpu_F1d.

cpu_M0 is still used by the iwmmxt code, and cpu_V0 and
cpu_V1 are used by both iwmmxt and Neon.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
 TCGv_i64 cpu_exclusive_addr;
 TCGv_i64 cpu_exclusive_val;
 
-/* FIXME:  These should be removed.  */
-static TCGv_i32 cpu_F0s, cpu_F1s;
-static TCGv_i64 cpu_F0d, cpu_F1d;
-
 #include "exec/gen-icount.h"
 
 static const char * const regnames[] =
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->base.max_insns = MIN(dc->base.max_insns, bound);
     }
 
-    cpu_F0s = tcg_temp_new_i32();
-    cpu_F1s = tcg_temp_new_i32();
-    cpu_F0d = tcg_temp_new_i64();
-    cpu_F1d = tcg_temp_new_i64();
-    cpu_V0 = cpu_F0d;
-    cpu_V1 = cpu_F1d;
+    cpu_V0 = tcg_temp_new_i64();
+    cpu_V1 = tcg_temp_new_i64();
     /* FIXME: cpu_M0 can probably be the same as cpu_V0.  */
     cpu_M0 = tcg_temp_new_i64();
 }
-- 
2.20.1

In several places cut and paste errors meant we were using the wrong
type for the 'arg' struct in trans_ functions called by the
decodetree decoder, because we were using the _sp version of the
struct in the _dp function.  These were harmless, because the two
structs were identical and so decodetree made them typedefs of the
same underlying structure (and we'd have had a compile error if they
were not harmless), but we should clean them up anyway.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190614104457.24703-2-peter.maydell@linaro.org
---
 target/arm/translate-vfp.inc.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
     return true;
 }
 
-static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_sp *a)
+static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
 {
     TCGv_i32 tmp;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
     return true;
 }
 
-static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_sp *a)
+static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
 {
     uint32_t offset;
     TCGv_i32 addr;
@@ -XXX,XX +XXX,XX @@ static void gen_VMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_sp *a)
+static bool trans_VMLA_dp(DisasContext *s, arg_VMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_sp *a)
+static bool trans_VMLS_dp(DisasContext *s, arg_VMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLS_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_sp *a)
+static bool trans_VNMLS_dp(DisasContext *s, arg_VNMLS_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLS_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMLA_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     tcg_temp_free_i64(tmp);
 }
 
-static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_sp *a)
+static bool trans_VNMLA_dp(DisasContext *s, arg_VNMLA_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMLA_dp, a->vd, a->vn, a->vm, true);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMUL_sp(DisasContext *s, arg_VMUL_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_muls, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_sp *a)
+static bool trans_VMUL_dp(DisasContext *s, arg_VMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_muld, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static void gen_VNMUL_dp(TCGv_i64 vd, TCGv_i64 vn, TCGv_i64 vm, TCGv_ptr fpst)
     gen_helper_vfp_negd(vd, vd);
 }
 
-static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_sp *a)
+static bool trans_VNMUL_dp(DisasContext *s, arg_VNMUL_dp *a)
 {
     return do_vfp_3op_dp(s, gen_VNMUL_dp, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VADD_sp(DisasContext *s, arg_VADD_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_adds, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VADD_dp(DisasContext *s, arg_VADD_sp *a)
+static bool trans_VADD_dp(DisasContext *s, arg_VADD_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_addd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VSUB_sp(DisasContext *s, arg_VSUB_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_subs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_sp *a)
+static bool trans_VSUB_dp(DisasContext *s, arg_VSUB_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_subd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_sp(DisasContext *s, arg_VDIV_sp *a)
     return do_vfp_3op_sp(s, gen_helper_vfp_divs, a->vd, a->vn, a->vm, false);
 }
 
-static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_sp *a)
+static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
 {
     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
     return true;
 }
 
-static bool trans_VFM_dp(DisasContext *s, arg_VFM_sp *a)
+static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 {
     /*
      * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
     return true;
 }
 
-static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_sp *a)
+static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
     return true;
 }
 
-static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_sp *a)
+static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 {
     TCGv_ptr fpst;
     TCGv_i64 tmp;
-- 
2.20.1

The architecture permits FPUs which have only single-precision
support, not double-precision; Cortex-M4 and Cortex-M33 are
both like that. Add the necessary checks on the MVFR0 FPDP
field so that we UNDEF any double-precision instructions on
CPUs like this.

Note that even if FPDP==0 the insns like VMOV-to/from-gpreg,
VLDM/VSTM, VLDR/VSTR which take double precision registers
still exist.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190614104457.24703-3-peter.maydell@linaro.org
---
 target/arm/cpu.h               |  6 +++
 target/arm/translate-vfp.inc.c | 84 ++++++++++++++++++++++++++++++++++
 2 files changed, 90 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
     return FIELD_EX64(id->mvfr0, MVFR0, FPSHVEC) > 0;
 }
 
+static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
+{
+    /* Return true if CPU supports double precision floating point */
+    return FIELD_EX64(id->mvfr0, MVFR0, FPDP) > 0;
+}
+
 /*
  * We always set the FP and SIMD FP16 fields to indicate identical
  * levels of support (assuming SIMD is implemented at all), so
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rn = a->vn;
     rm = a->vm;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         ((a->vm | a->vd) & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (dp && !dc_isar_feature(aa32_fp_d32, s) && (a->vm & 0x10)) {
         return false;
     }
+
+    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     rd = a->vd;
     rm = a->vm;
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fpshvec, s) &&
         (veclen != 0 || s->vec_stride != 0)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return false;
     }
 
+    if (!dc_isar_feature(aa32_fpdp, s)) {
+        return false;
+    }
+
     if (!vfp_access_check(s)) {
         return true;
     }
-- 
2.20.1

Handful of bugfixes for rc2. None of these are particularly critical
or exciting.

-- PMM

The following changes since commit 45a150aa2b3492acf6691c7bdbeb25a8545d8345:

Merge remote-tracking branch 'remotes/ericb/tags/pull-bitmaps-2020-08-03' into staging (2020-08-03 15:13:49 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200803

for you to fetch changes up to 13557fd392890cbd985bceba7f717e01efd674b8:

hw/timer/imx_epit: Avoid assertion when CR.SWR is written (2020-08-03 17:56:11 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/timer/imx_epit: Avoid assertion when CR.SWR is written
 * netduino2, netduinoplus2, microbit: set system_clock_scale so that
   SysTick running on the CPU clock works
 * target/arm: Avoid maybe-uninitialized warning with gcc 4.9
 * target/arm: Fix AddPAC error indication
 * Make AIRCR.SYSRESETREQ actually reset the system for the
   microbit, mps2-*, musca-*, netduino* boards

----------------------------------------------------------------
Kaige Li (1):
      target/arm: Avoid maybe-uninitialized warning with gcc 4.9

Peter Maydell (6):
      hw/arm/netduino2, netduinoplus2: Set system_clock_scale
      include/hw/irq.h: New function qemu_irq_is_connected()
      hw/intc/armv7m_nvic: Provide default "reset the system" behaviour for SYSRESETREQ
      msf2-soc, stellaris: Don't wire up SYSRESETREQ
      hw/arm/nrf51_soc: Set system_clock_scale
      hw/timer/imx_epit: Avoid assertion when CR.SWR is written

Richard Henderson (1):
      target/arm: Fix AddPAC error indication

include/hw/arm/armv7m.h           |  4 +++-
 include/hw/irq.h                  | 18 ++++++++++++++++++
 hw/arm/msf2-soc.c                 | 11 -----------
 hw/arm/netduino2.c                | 10 ++++++++++
 hw/arm/netduinoplus2.c            | 10 ++++++++++
 hw/arm/nrf51_soc.c                |  5 +++++
 hw/arm/stellaris.c                | 12 ------------
 hw/intc/armv7m_nvic.c             | 17 ++++++++++++++++-
 hw/timer/imx_epit.c               | 13 ++++++++++---
 target/arm/pauth_helper.c         |  6 +++++-
 target/arm/translate-a64.c        |  2 +-
 tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 13 files changed, 112 insertions(+), 31 deletions(-)
 create mode 100644 tests/tcg/aarch64/pauth-5.c

The netduino2 and netduinoplus2 boards forgot to set the system_clock_scale
global, which meant that if guest code used the systick timer in "use
the processor clock" mode it would hang because time never advances.

Set the global to match the documented CPU clock speed of these boards.
Judging by the data sheet this is slightly simplistic because the
SoC allows configuration of the SYSCLK source and frequency via the
RCC (reset and clock control) module, but we don't model that.

Fixes: https://bugs.launchpad.net/qemu/+bug/1876187
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200727162617.26227-1-peter.maydell@linaro.org
---
 hw/arm/netduino2.c     | 10 ++++++++++
 hw/arm/netduinoplus2.c | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/stm32f205_soc.h"
 #include "hw/arm/boot.h"
 
+/* Main SYSCLK frequency in Hz (120MHz) */
+#define SYSCLK_FRQ 120000000ULL
+
 static void netduino2_init(MachineState *machine)
 {
     DeviceState *dev;
 
+    /*
+     * TODO: ideally we would model the SoC RCC and let it handle
+     * system_clock_scale, including its ability to define different
+     * possible SYSCLK sources.
+     */
+    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+
     dev = qdev_new(TYPE_STM32F205_SOC);
     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m3"));
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/stm32f405_soc.h"
 #include "hw/arm/boot.h"
 
+/* Main SYSCLK frequency in Hz (168MHz) */
+#define SYSCLK_FRQ 168000000ULL
+
 static void netduinoplus2_init(MachineState *machine)
 {
     DeviceState *dev;
 
+    /*
+     * TODO: ideally we would model the SoC RCC and let it handle
+     * system_clock_scale, including its ability to define different
+     * possible SYSCLK sources.
+     */
+    system_clock_scale = NANOSECONDS_PER_SECOND / SYSCLK_FRQ;
+
     dev = qdev_new(TYPE_STM32F405_SOC);
     qdev_prop_set_string(dev, "cpu-type", ARM_CPU_TYPE_NAME("cortex-m4"));
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-- 
2.20.1

Mostly devices don't need to care whether one of their output
qemu_irq lines is connected, because functions like qemu_set_irq()
silently do nothing if there is nothing on the other end.  However
sometimes a device might want to implement default behaviour for the
case where the machine hasn't wired the line up to anywhere.

Provide a function qemu_irq_is_connected() that devices can use for
this purpose.  (The test is trivial but encapsulating it in a
function makes it easier to see where we're doing it in case we need
to change the implementation later.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-2-peter.maydell@linaro.org
---
 include/hw/irq.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/include/hw/irq.h b/include/hw/irq.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -XXX,XX +XXX,XX @@ qemu_irq qemu_irq_split(qemu_irq irq1, qemu_irq irq2);
    on an existing vector of qemu_irq.  */
 void qemu_irq_intercept_in(qemu_irq *gpio_in, qemu_irq_handler handler, int n);
 
+/**
+ * qemu_irq_is_connected: Return true if IRQ line is wired up
+ *
+ * If a qemu_irq has a device on the other (receiving) end of it,
+ * return true; otherwise return false.
+ *
+ * Usually device models don't need to care whether the machine model
+ * has wired up their outbound qemu_irq lines, because functions like
+ * qemu_set_irq() silently do nothing if there is nothing on the other
+ * end of the line. However occasionally a device model will want to
+ * provide default behaviour if its output is left floating, and
+ * it can use this function to identify when that is the case.
+ */
+static inline bool qemu_irq_is_connected(qemu_irq irq)
+{
+    return irq != NULL;
+}
+
 #endif
-- 
2.20.1

The NVIC provides an outbound qemu_irq "SYSRESETREQ" which it signals
when the guest sets the SYSRESETREQ bit in the AIRCR register.  This
matches the hardware design (where the CPU has a signal of this name
and it is up to the SoC to connect that up to an actual reset
mechanism), but in QEMU it mostly results in duplicated code in SoC
objects and bugs where SoC model implementors forget to wire up the
SYSRESETREQ line.

Provide a default behaviour for the case where SYSRESETREQ is not
actually connected to anything: use qemu_system_reset_request() to
perform a system reset.  This will allow us to remove the
implementations of SYSRESETREQ handling from the boards where that's
exactly what it does, and also fixes the bugs in the board models
which forgot to wire up the signal:

* microbit
 * mps2-an385
 * mps2-an505
 * mps2-an511
 * mps2-an521
 * musca-a
 * musca-b1
 * netduino
 * netduinoplus2

We still allow the board to wire up the signal if it needs to, in case
we need to model more complicated reset controller logic or to model
buggy SoC hardware which forgot to wire up the line itself. But
defaulting to "reset the system" is more often going to be correct
than defaulting to "do nothing".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-3-peter.maydell@linaro.org
---
 include/hw/arm/armv7m.h |  4 +++-
 hw/intc/armv7m_nvic.c   | 17 ++++++++++++++++-
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/include/hw/arm/armv7m.h b/include/hw/arm/armv7m.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/armv7m.h
+++ b/include/hw/arm/armv7m.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 /* ARMv7M container object.
  * + Unnamed GPIO input lines: external IRQ lines for the NVIC
- * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ
+ * + Named GPIO output SYSRESETREQ: signalled for guest AIRCR.SYSRESETREQ.
+ *   If this GPIO is not wired up then the NVIC will default to performing
+ *   a qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET).
  * + Property "cpu-type": CPU type to instantiate
  * + Property "num-irq": number of external IRQ lines
  * + Property "memory": MemoryRegion defining the physical address space
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/armv7m_nvic.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
+#include "sysemu/runstate.h"
 #include "target/arm/cpu.h"
 #include "exec/exec-all.h"
 #include "exec/memop.h"
@@ -XXX,XX +XXX,XX @@ static const uint8_t nvic_id[] = {
     0x00, 0xb0, 0x1b, 0x00, 0x0d, 0xe0, 0x05, 0xb1
 };
 
+static void signal_sysresetreq(NVICState *s)
+{
+    if (qemu_irq_is_connected(s->sysresetreq)) {
+        qemu_irq_pulse(s->sysresetreq);
+    } else {
+        /*
+         * Default behaviour if the SoC doesn't need to wire up
+         * SYSRESETREQ (eg to a system reset controller of some kind):
+         * perform a system reset via the usual QEMU API.
+         */
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+    }
+}
+
 static int nvic_pending_prio(NVICState *s)
 {
     /* return the group priority of the current pending interrupt,
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
             if (value & R_V7M_AIRCR_SYSRESETREQ_MASK) {
                 if (attrs.secure ||
                     !(cpu->env.v7m.aircr & R_V7M_AIRCR_SYSRESETREQS_MASK)) {
-                    qemu_irq_pulse(s->sysresetreq);
+                    signal_sysresetreq(s);
                 }
             }
             if (value & R_V7M_AIRCR_VECTCLRACTIVE_MASK) {
-- 
2.20.1

The MSF2 SoC model and the Stellaris board code both wire
SYSRESETREQ up to a function that just invokes
    qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
This is now the default action that the NVIC does if the line is
not connected, so we can delete the handling code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200728103744.6909-4-peter.maydell@linaro.org
---
 hw/arm/msf2-soc.c  | 11 -----------
 hw/arm/stellaris.c | 12 ------------
 2 files changed, 23 deletions(-)

diff --git a/hw/arm/msf2-soc.c b/hw/arm/msf2-soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-soc.c
+++ b/hw/arm/msf2-soc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/arm/msf2-soc.h"
 #include "hw/misc/unimp.h"
-#include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
 
 #define MSF2_TIMER_BASE       0x40004000
@@ -XXX,XX +XXX,XX @@ static const int spi_irq[MSF2_NUM_SPIS] = { 2, 3 };
 static const int uart_irq[MSF2_NUM_UARTS] = { 10, 11 };
 static const int timer_irq[MSF2_NUM_TIMERS] = { 14, 15 };
 
-static void do_sys_reset(void *opaque, int n, int level)
-{
-    if (level) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-    }
-}
-
 static void m2sxxx_soc_initfn(Object *obj)
 {
     MSF2State *s = MSF2_SOC(obj);
@@ -XXX,XX +XXX,XX @@ static void m2sxxx_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    qdev_connect_gpio_out_named(DEVICE(&s->armv7m.nvic), "SYSRESETREQ", 0,
-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-
     system_clock_scale = NANOSECONDS_PER_SECOND / s->m3clk;
 
     for (i = 0; i < MSF2_NUM_UARTS; i++) {
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #include "qemu/log.h"
 #include "exec/address-spaces.h"
-#include "sysemu/runstate.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/armv7m.h"
 #include "hw/char/pl011.h"
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
     qdev_init_gpio_in(dev, stellaris_adc_trigger, 1);
 }
 
-static
-void do_sys_reset(void *opaque, int n, int level)
-{
-    if (level) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-    }
-}
-
 /* Board init.  */
 static stellaris_board_info stellaris_boards[] = {
   { "LM3S811EVB",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* This will exit with an error if the user passed us a bad cpu_type */
     sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
 
-    qdev_connect_gpio_out_named(nvic, "SYSRESETREQ", 0,
-                                qemu_allocate_irq(&do_sys_reset, NULL, 0));
-
     if (board->dc1 & (1 << 16)) {
         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     qdev_get_gpio_in(nvic, 14),
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The definition of top_bit used in this function is one higher
than that used in the Arm ARM psuedo-code, which put the error
indication at top_bit - 1 at the wrong place, which meant that
it wasn't visible to Auth.

Fixing the definition of top_bit requires more changes, because
its most common use is for the count of bits in top_bit:bot_bit,
which would then need to be computed as top_bit - bot_bit + 1.

For now, prefer the minimal fix to the error indication alone.

Fixes: 63ff0ca94cb
Reported-by: Derrick McKee <derrick.mckee@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200728195706.11087-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added comment about the divergence from the pseudocode]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/pauth_helper.c         |  6 +++++-
 tests/tcg/aarch64/pauth-5.c       | 33 +++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  2 +-
 3 files changed, 39 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/aarch64/pauth-5.c

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
      */
     test = sextract64(ptr, bot_bit, top_bit - bot_bit);
     if (test != 0 && test != -1) {
-        pac ^= MAKE_64BIT_MASK(top_bit - 1, 1);
+        /*
+         * Note that our top_bit is one greater than the pseudocode's
+         * version, hence "- 2" here.
+         */
+        pac ^= MAKE_64BIT_MASK(top_bit - 2, 1);
     }
 
     /*
diff --git a/tests/tcg/aarch64/pauth-5.c b/tests/tcg/aarch64/pauth-5.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/pauth-5.c
@@ -XXX,XX +XXX,XX @@
+#include <assert.h>
+
+static int x;
+
+int main()
+{
+    int *p0 = &x, *p1, *p2, *p3;
+    unsigned long salt = 0;
+
+    /*
+     * With TBI enabled and a 48-bit VA, there are 7 bits of auth, and so
+     * a 1/128 chance of auth = pac(ptr,key,salt) producing zero.
+     * Find a salt that creates auth != 0.
+     */
+    do {
+        salt++;
+        asm("pacda %0, %1" : "=r"(p1) : "r"(salt), "0"(p0));
+    } while (p0 == p1);
+
+    /*
+     * This pac must fail, because the input pointer bears an encryption,
+     * and so is not properly extended within bits [55:47].  This will
+     * toggle bit 54 in the output...
+     */
+    asm("pacda %0, %1" : "=r"(p2) : "r"(salt), "0"(p1));
+
+    /* ... so that the aut must fail, setting bit 53 in the output ... */
+    asm("autda %0, %1" : "=r"(p3) : "r"(salt), "0"(p2));
+
+    /* ... which means this equality must not hold. */
+    assert(p3 != p0);
+    return 0;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 
 # Pauth Tests
 ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_ARMV8_3),)
-AARCH64_TESTS += pauth-1 pauth-2 pauth-4
+AARCH64_TESTS += pauth-1 pauth-2 pauth-4 pauth-5
 pauth-%: CFLAGS += -march=armv8.3-a
 run-pauth-%: QEMU_OPTS += -cpu max
 run-plugin-pauth-%: QEMU_OPTS += -cpu max
-- 
2.20.1

From: Kaige Li <likaige@loongson.cn>

GCC version 4.9.4 isn't clever enough to figure out that all
execution paths in disas_ldst() that use 'fn' will have initialized
it first, and so it warns:

/home/LiKaige/qemu/target/arm/translate-a64.c: In function ‘disas_ldst’:
/home/LiKaige/qemu/target/arm/translate-a64.c:3392:5: error: ‘fn’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     fn(cpu_reg(s, rt), clean_addr, tcg_rs, get_mem_index(s),
     ^
/home/LiKaige/qemu/target/arm/translate-a64.c:3318:22: note: ‘fn’ was declared here
     AtomicThreeOpFn *fn;
                      ^

Make it happy by initializing the variable to NULL.

Signed-off-by: Kaige Li <likaige@loongson.cn>
Message-id: 1596110248-7366-2-git-send-email-likaige@loongson.cn
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: Clean up commit message and note which gcc version this was]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
     bool r = extract32(insn, 22, 1);
     bool a = extract32(insn, 23, 1);
     TCGv_i64 tcg_rs, clean_addr;
-    AtomicThreeOpFn *fn;
+    AtomicThreeOpFn *fn = NULL;
 
     if (is_vector || !dc_isar_feature(aa64_atomics, s)) {
         unallocated_encoding(s);
-- 
2.20.1

The nrf51 SoC model wasn't setting the system_clock_scale
global.which meant that if guest code used the systick timer in "use
the processor clock" mode it would hang because time never advances.

Set the global to match the documented CPU clock speed for this SoC.

This SoC in fact doesn't have a SysTick timer (which is the only thing
currently that cares about the system_clock_scale), because it's
a configurable option in the Cortex-M0. However our Cortex-M0 and
thus our nrf51 and our micro:bit board do provide a SysTick, so
we ought to provide a functional one rather than a broken one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200727193458.31250-1-peter.maydell@linaro.org
---
 hw/arm/nrf51_soc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@
 
 #define BASE_TO_IRQ(base) ((base >> 12) & 0x1F)
 
+/* HCLK (the main CPU clock) on this SoC is always 16MHz */
+#define HCLK_FRQ 16000000
+
 static uint64_t clock_read(void *opaque, hwaddr addr, unsigned int size)
 {
     qemu_log_mask(LOG_UNIMP, "%s: 0x%" HWADDR_PRIx " [%u]\n",
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
+    system_clock_scale = NANOSECONDS_PER_SECOND / HCLK_FRQ;
+
     object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
                              &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
-- 
2.20.1

The imx_epit device has a software-controllable reset triggered by
setting the SWR bit in the CR register. An error in commit cc2722ec83ad9
means that we will end up assert()ing if the guest does this, because
the code in imx_epit_write() starts ptimer transactions, and then
imx_epit_reset() also starts ptimer transactions, triggering
"ptimer_transaction_begin: Assertion `!s->in_transaction' failed".

The cleanest way to avoid this double-transaction is to move the
start-transaction for the CR write handling down below the check of
the SWR bit.

Fixes: https://bugs.launchpad.net/qemu/+bug/1880424
Fixes: cc2722ec83ad944505fe
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200727154550.3409-1-peter.maydell@linaro.org
---
 hw/timer/imx_epit.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
 
     switch (offset >> 2) {
     case 0: /* CR */
-        ptimer_transaction_begin(s->timer_cmp);
-        ptimer_transaction_begin(s->timer_reload);
 
         oldcr = s->cr;
         s->cr = value & 0x03ffffff;
         if (s->cr & CR_SWR) {
             /* handle the reset */
             imx_epit_reset(DEVICE(s));
-        } else {
+            /*
+             * TODO: could we 'break' here? following operations appear
+             * to duplicate the work imx_epit_reset() already did.
+             */
+        }
+
+        ptimer_transaction_begin(s->timer_cmp);
+        ptimer_transaction_begin(s->timer_reload);
+
+        if (!(s->cr & CR_SWR)) {
             imx_epit_set_freq(s);
         }
 
-- 
2.20.1