Series comparison

-[PULL 00/33] target-arm queue
+[PULL 00/24] target-arm queue
-Another arm pullreq; nothing particularly exciting here.
+The following changes since commit 5a67d7735d4162630769ef495cf813244fc850df:
--- PMM
+  Merge remote-tracking branch 'remotes/berrange-gitlab/tags/tls-deps-pull-request' into staging (2021-07-02 08:22:39 +0100)
 The following changes since commit e27d5b488ef08408691bfed61f34ee2858136287:
   Merge remote-tracking branch 'remotes/juanquintela/tags/pull-migration-pull-request' into staging (2020-02-28 14:02:31 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200228
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210702
-for you to fetch changes up to 1904f9b5f1d94fe12fe021db6b504c87d684f6db:
+for you to fetch changes up to 04ea4d3cfd0a21b248ece8eb7a9436a3d9898dd8:
-  hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2 (2020-02-28 16:14:57 +0000)
+  target/arm: Implement MVE shifts by register (2021-07-02 11:48:38 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm: Use TYPE_PL011 to create serial port
+ * more MVE instructions
- * target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
+ * hw/gpio/gpio_pwr: use shutdown function for reboot
- * hw/arm/integratorcp: Map the audio codec controller
+ * target/arm: Check NaN mode before silencing NaN
- * GICv2: Correctly implement the limited number of priority bits
+ * tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine
- * target/arm: refactoring of VFP related feature checks and decode
+ * hw/arm: Add basic power management to raspi.
- * xilinx_zynq: Fix USB port instantiation
+ * docs/system/arm: Add quanta-gbs-bmc, quanta-q7l1-bmc
  * acceptance tests for n800, n810, integratorcp
  * Implement v8.3-RCPC, v8.4-RCPC, v8.3-CCIDX
  * arm_gic_kvm: Don't assume kernel can provide a GICv2
    (provide better error message for user error)
 ----------------------------------------------------------------
-Gavin Shan (1):
+Joe Komlodi (1):
-      hw/arm: Use TYPE_PL011 to create serial port
+      target/arm: Check NaN mode before silencing NaN
-Guenter Roeck (2):
+Maxim Uvarov (1):
-      hw/arm/xilinx_zynq: Fix USB port instantiation
+      hw/gpio/gpio_pwr: use shutdown function for reboot
       hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class
-Peter Maydell (5):
+Nolan Leake (1):
-      target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
+      hw/arm: Add basic power management to raspi.
       target/arm: Implement v8.3-RCPC
       target/arm: Implement v8.4-RCPC
       target/arm: Implement ARMv8.3-CCIDX
       hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2
-Philippe Mathieu-Daudé (3):
+Patrick Venture (2):
-      hw/arm/integratorcp: Map the audio codec controller
+      docs/system/arm: Add quanta-q7l1-bmc reference
-      tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
+      docs/system/arm: Add quanta-gbs-bmc reference
       tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer
-Richard Henderson (17):
+Peter Maydell (18):
-      target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
+      target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation
-      target/arm: Add isar_feature_aa32_vfp_simd
+      target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH
-      target/arm: Rename isar_feature_aa32_fpdp_v2
+      target/arm: Make asimd_imm_const() public
-      target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
+      target/arm: Use asimd_imm_const for A64 decode
-      target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
+      target/arm: Use dup_const() instead of bitfield_replicate()
-      target/arm: Perform fpdp_v2 check first
+      target/arm: Implement MVE logical immediate insns
-      target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
+      target/arm: Implement MVE vector shift left by immediate insns
-      target/arm: Add missing checks for fpsp_v2
+      target/arm: Implement MVE vector shift right by immediate insns
-      target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
+      target/arm: Implement MVE VSHLL
-      target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
+      target/arm: Implement MVE VSRI, VSLI
-      target/arm: Move VLLDM and VLSTM to vfp.decode
+      target/arm: Implement MVE VSHRN, VRSHRN
-      target/arm: Move the vfp decodetree calls next to the base isa
+      target/arm: Implement MVE saturating narrowing shifts
-      linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
+      target/arm: Implement MVE VSHLC
-      target/arm: Remove ARM_FEATURE_VFP*
+      target/arm: Implement MVE VADDLV
-      target/arm: Add formats for some vfp 2 and 3-register insns
+      target/arm: Implement MVE long shifts by immediate
-      target/arm: Split VFM decode
+      target/arm: Implement MVE long shifts by register
-      target/arm: Split VMINMAXNM decode
+      target/arm: Implement MVE shifts by immediate
       target/arm: Implement MVE shifts by register
-Sai Pavan Boddu (3):
+Philippe Mathieu-Daudé (1):
-      arm_gic: Mask the un-supported priority bits
+      tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine
       cpu/a9mpcore: Set number of GIC priority bits to 5
       cpu/arm11mpcore: Set number of GIC priority bits to 4
-Thomas Huth (2):
+ docs/system/arm/aspeed.rst             |   1 +
-      tests/acceptance: Add a test for the N800 and N810 arm machines
+ docs/system/arm/nuvoton.rst            |   5 +-
-      tests/acceptance: Add a test for the integratorcp arm machine
+ include/hw/arm/bcm2835_peripherals.h   |   3 +-
  include/hw/misc/bcm2835_powermgt.h     |  29 ++
  target/arm/helper-mve.h                | 108 +++++++
  target/arm/translate.h                 |  41 +++
  target/arm/mve.decode                  | 177 ++++++++++-
  target/arm/t32.decode                  |  71 ++++-
  hw/arm/bcm2835_peripherals.c           |  13 +-
  hw/gpio/gpio_pwr.c                     |   2 +-
  hw/misc/bcm2835_powermgt.c             | 160 ++++++++++
  target/arm/helper-a64.c                |  12 +-
  target/arm/mve_helper.c                | 524 +++++++++++++++++++++++++++++++--
  target/arm/translate-a64.c             |  86 +-----
  target/arm/translate-mve.c             | 261 +++++++++++++++-
  target/arm/translate-neon.c            |  81 -----
  target/arm/translate.c                 | 327 +++++++++++++++++++-
  target/arm/vfp_helper.c                |  24 +-
  hw/misc/meson.build                    |   1 +
  tests/acceptance/boot_linux_console.py |  43 +++
 files changed, 1760 insertions(+), 209 deletions(-)
  create mode 100644 include/hw/misc/bcm2835_powermgt.h
  create mode 100644 hw/misc/bcm2835_powermgt.c
- include/hw/intc/arm_gic.h                    |   2 +
- include/hw/intc/arm_gic_common.h             |   1 +
- target/arm/cpu.h                             |  88 +++++-
- hw/arm/integratorcp.c                        |   1 +
- hw/arm/sbsa-ref.c                            |   3 +-
- hw/arm/virt.c                                |   3 +-
- hw/arm/xilinx_zynq.c                         |   5 +-
- hw/arm/xlnx-versal.c                         |   3 +-
- hw/cpu/a9mpcore.c                            |   4 +
- hw/cpu/arm11mpcore.c                         |   5 +
- hw/intc/arm_gic.c                            |  33 +-
- hw/intc/arm_gic_common.c                     |   1 +
- hw/intc/arm_gic_kvm.c                        |   9 +
- hw/intc/armv7m_nvic.c                        |  20 +-
- hw/usb/hcd-ehci-sysbus.c                     |  17 -
- linux-user/arm/signal.c                      |   4 +-
- linux-user/elfload.c                         |  25 +-
- target/arm/arch_dump.c                       |  11 +-
- target/arm/cpu.c                             |  44 +--
- target/arm/cpu64.c                           |   5 +-
- target/arm/helper.c                          |  23 +-
- target/arm/kvm32.c                           |   5 -
- target/arm/kvm64.c                           |   1 -
- target/arm/m_helper.c                        |  11 +-
- target/arm/machine.c                         |   5 +-
- target/arm/translate-a64.c                   | 114 +++++++
- target/arm/translate-vfp.inc.c               | 448 +++++++++++++++++----------
- target/arm/translate.c                       | 122 ++------
- MAINTAINERS                                  |   2 +
- hw/arm/Kconfig                               |   1 +
- target/arm/vfp-uncond.decode                 |  12 +-
- target/arm/vfp.decode                        | 153 ++++-----
- tests/acceptance/machine_arm_integratorcp.py |  99 ++++++
- tests/acceptance/machine_arm_n8x0.py         |  49 +++
-files changed, 865 insertions(+), 464 deletions(-)
- create mode 100644 tests/acceptance/machine_arm_integratorcp.py
- create mode 100644 tests/acceptance/machine_arm_n8x0.py

-[PULL 01/33] hw/arm: Use TYPE_PL011 to create serial port
+Deleted patch
-From: Gavin Shan <gshan@redhat.com>
-This uses TYPE_PL011 when creating the serial port so that the code
-looks cleaner.
-Signed-off-by: Gavin Shan <gshan@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20200224222223.4128-1-gshan@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/sbsa-ref.c    | 3 ++-
- hw/arm/virt.c        | 3 ++-
- hw/arm/xlnx-versal.c | 3 ++-
-files changed, 6 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/pci-host/gpex.h"
- #include "hw/qdev-properties.h"
- #include "hw/usb.h"
-+#include "hw/char/pl011.h"
- #include "net/net.h"
- #define RAMLIMIT_GB 8192
-@@ -XXX,XX +XXX,XX @@ static void create_uart(const SBSAMachineState *sms, int uart,
- {
-     hwaddr base = sbsa_ref_memmap[uart].base;
-     int irq = sbsa_ref_irqmap[uart];
--    DeviceState *dev = qdev_create(NULL, "pl011");
-+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
-     SysBusDevice *s = SYS_BUS_DEVICE(dev);
-     qdev_prop_set_chr(dev, "chardev", chr);
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/mem/nvdimm.h"
- #include "hw/acpi/generic_event_device.h"
- #include "hw/virtio/virtio-iommu.h"
-+#include "hw/char/pl011.h"
- #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
-     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
-@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, int uart,
-     int irq = vms->irqmap[uart];
-     const char compat[] = "arm,pl011\0arm,primecell";
-     const char clocknames[] = "uartclk\0apb_pclk";
--    DeviceState *dev = qdev_create(NULL, "pl011");
-+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
-     SysBusDevice *s = SYS_BUS_DEVICE(dev);
-     qdev_prop_set_chr(dev, "chardev", chr);
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/unimp.h"
- #include "hw/intc/arm_gicv3_common.h"
- #include "hw/arm/xlnx-versal.h"
-+#include "hw/char/pl011.h"
- #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
- #define GEM_REVISION        0x40070106
-@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
-         DeviceState *dev;
-         MemoryRegion *mr;
--        dev = qdev_create(NULL, "pl011");
-+        dev = qdev_create(NULL, TYPE_PL011);
-         s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
-         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
-         object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
---
-.20.1

-[PULL 02/33] target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
+[PULL 01/24] docs/system/arm: Add quanta-q7l1-bmc reference
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Patrick Venture <venture@google.com>
-We had set this for aarch32-only in arm_max_initfn, but
+Adds a line-item reference to the supported quanta-q71l-bmc aspeed
-failed to set the same bit for aarch64.
+entry.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Patrick Venture <venture@google.com>
-Message-id: 20200218190958.745-2-richard.henderson@linaro.org
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210615192848.1065297-2-venture@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu64.c | 1 +
+ docs/system/arm/aspeed.rst | 1 +
 file changed, 1 insertion(+)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/docs/system/arm/aspeed.rst
-+++ b/target/arm/cpu64.c
++++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ etc.
-         cpu->isar.id_mmfr3 = u;
+ AST2400 SoC based machines :
-         u = cpu->isar.id_mmfr4;
+ - ``palmetto-bmc``         OpenPOWER Palmetto POWER8 BMC
-+        u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
++- ``quanta-q71l-bmc``      OpenBMC Quanta BMC
-         u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-         cpu->isar.id_mmfr4 = u;
+ AST2500 SoC based machines :
 --
 .20.1

-[PULL 03/33] hw/arm/integratorcp: Map the audio codec controller
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The Linux kernel displays errors why trying to detect the PL041
-audio interface:
-  Linux version 4.16.0 (linus@genomnajs) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #142 PREEMPT Wed May 9 13:24:55 CEST 2018
-  CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00093177
-  CPU: VIVT data cache, VIVT instruction cache
-  OF: fdt: Machine model: ARM Integrator/CP
-  ...
-  OF: amba_device_add() failed (-19) for /fpga/aaci@1d000000
-Since we have it already modelled, simply plug it.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200223233033.15371-2-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/integratorcp.c | 1 +
- hw/arm/Kconfig        | 1 +
-files changed, 2 insertions(+)
-diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/integratorcp.c
-+++ b/hw/arm/integratorcp.c
-@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
-                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_WPROT, 0));
-     qdev_connect_gpio_out(dev, 1,
-                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_CARDIN, 0));
-+    sysbus_create_varargs("pl041", 0x1d000000, pic[25], NULL);
-     if (nd_table[0].used)
-         smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
-     select INTEGRATOR_DEBUG
-     select PL011 # UART
-     select PL031 # RTC
-+    select PL041 # audio
-     select PL050 # keyboard/mouse
-     select PL110 # pl111 LCD controller
-     select PL181 # display
---
-.20.1

-[PULL 23/33] hw/arm/xilinx_zynq: Fix USB port instantiation
+[PULL 02/24] docs/system/arm: Add quanta-gbs-bmc reference
-From: Guenter Roeck <linux@roeck-us.net>
+From: Patrick Venture <venture@google.com>
-USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
+Add line item reference to quanta-gbs-bmc machine.
 Linux expects and checks various chipidea registers, which do not exist
 with the basic ehci emulation. This patch series fixes the problem.
-Without this patch, USB ports fail to instantiate under Linux.
+Signed-off-by: Patrick Venture <venture@google.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
-ci_hdrc ci_hdrc.0: doesn't support host
+Message-id: 20210615192848.1065297-3-venture@google.com
-ci_hdrc ci_hdrc.0: no supported roles
+[PMM: fixed underline Sphinx warning]
 With this patch, USB ports are instantiated, and it is possible
 to boot from USB drive.
 ci_hdrc ci_hdrc.0: EHCI Host Controller
 ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
 ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
 usb 1-1: new full-speed USB device number 2 using ci_hdrc
 usb 1-1: not running at top speed; connect to a high speed hub
 usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
 usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
 usb-storage 1-1:1.0: USB Mass Storage device detected
 scsi host0: usb-storage 1-1:1.0
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
 Message-id: 20200215122354.13706-2-linux@roeck-us.net
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xilinx_zynq.c | 5 +++--
+ docs/system/arm/nuvoton.rst | 5 +++--
 file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
+diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xilinx_zynq.c
+--- a/docs/system/arm/nuvoton.rst
-+++ b/hw/arm/xilinx_zynq.c
++++ b/docs/system/arm/nuvoton.rst
 @@ -XXX,XX +XXX,XX @@
- #include "hw/loader.h"
+-Nuvoton iBMC boards (``npcm750-evb``, ``quanta-gsj``)
- #include "hw/misc/zynq-xadc.h"
+-=====================================================
- #include "hw/ssi/ssi.h"
++Nuvoton iBMC boards (``*-bmc``, ``npcm750-evb``, ``quanta-gsj``)
-+#include "hw/usb/chipidea.h"
++================================================================
- #include "qemu/error-report.h"
- #include "hw/sd/sdhci.h"
+ The `Nuvoton iBMC`_ chips (NPCM7xx) are a family of ARM-based SoCs that are
- #include "hw/char/cadence_uart.h"
+ designed to be used as Baseboard Management Controllers (BMCs) in various
-@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ segment. The following machines are based on this chip :
-     zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
+ The NPCM730 SoC has two Cortex-A9 cores and is targeted for Data Center and
-     zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
+ Hyperscale applications. The following machines are based on this chip :
--    sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
++- ``quanta-gbs-bmc``    Quanta GBS server BMC
--    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
+ - ``quanta-gsj``        Quanta GSJ server BMC
-+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
-+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
+ There are also two more SoCs, NPCM710 and NPCM705, which are single-core
      cadence_uart_create(0xE0000000, pic[59 - IRQ_OFFSET], serial_hd(0));
      cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
 --
 .20.1

-[PULL 25/33] tests/acceptance: Add a test for the N800 and N810 arm machines
+[PULL 03/24] hw/arm: Add basic power management to raspi.
-From: Thomas Huth <thuth@redhat.com>
+From: Nolan Leake <nolan@sigbus.net>
-Old kernels from the Meego project can be used to check that Linux
+This is just enough to make reboot and poweroff work. Works for
-is at least starting on these machines.
+linux, u-boot, and the arm trusted firmware. Not tested, but should
+work for plan9, and bare-metal/hobby OSes, since they seem to generally
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+do what linux does for reset.
-Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+The watchdog timer functionality is not yet implemented.
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/64
-Message-id: 20200225172501.29609-2-philmd@redhat.com
+Signed-off-by: Nolan Leake <nolan@sigbus.net>
-Message-Id: <20200129131920.22302-1-thuth@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210625210209.1870217-1-nolan@sigbus.net
 [PMM: tweaked commit title; fixed region size to 0x200;
  moved header file to include/]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS                          |  1 +
+ include/hw/arm/bcm2835_peripherals.h |   3 +-
- tests/acceptance/machine_arm_n8x0.py | 49 ++++++++++++++++++++++++++++
+ include/hw/misc/bcm2835_powermgt.h   |  29 +++++
-files changed, 50 insertions(+)
+ hw/arm/bcm2835_peripherals.c         |  13 ++-
- create mode 100644 tests/acceptance/machine_arm_n8x0.py
+ hw/misc/bcm2835_powermgt.c           | 160 +++++++++++++++++++++++++++
+ hw/misc/meson.build                  |   1 +
-diff --git a/MAINTAINERS b/MAINTAINERS
+files changed, 204 insertions(+), 2 deletions(-)
  create mode 100644 include/hw/misc/bcm2835_powermgt.h
  create mode 100644 hw/misc/bcm2835_powermgt.c
 diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/include/hw/arm/bcm2835_peripherals.h
-+++ b/MAINTAINERS
++++ b/include/hw/arm/bcm2835_peripherals.h
-@@ -XXX,XX +XXX,XX @@ F: hw/rtc/twl92230.c
+@@ -XXX,XX +XXX,XX @@
- F: include/hw/display/blizzard.h
+ #include "hw/misc/bcm2835_mphi.h"
- F: include/hw/input/tsc2xxx.h
+ #include "hw/misc/bcm2835_thermal.h"
- F: include/hw/misc/cbus.h
+ #include "hw/misc/bcm2835_cprman.h"
-+F: tests/acceptance/machine_arm_n8x0.py
++#include "hw/misc/bcm2835_powermgt.h"
+ #include "hw/sd/sdhci.h"
- Palm
+ #include "hw/sd/bcm2835_sdhost.h"
- M: Andrzej Zaborowski <balrogg@gmail.com>
+ #include "hw/gpio/bcm2835_gpio.h"
-diff --git a/tests/acceptance/machine_arm_n8x0.py b/tests/acceptance/machine_arm_n8x0.py
+@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
      BCM2835MphiState mphi;
      UnimplementedDeviceState txp;
      UnimplementedDeviceState armtmr;
 -    UnimplementedDeviceState powermgt;
 +    BCM2835PowerMgtState powermgt;
      BCM2835CprmanState cprman;
      PL011State uart0;
      BCM2835AuxState aux;
 diff --git a/include/hw/misc/bcm2835_powermgt.h b/include/hw/misc/bcm2835_powermgt.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/acceptance/machine_arm_n8x0.py
++++ b/include/hw/misc/bcm2835_powermgt.h
 @@ -XXX,XX +XXX,XX @@
-+# Functional test that boots a Linux kernel and checks the console
++/*
-+#
++ * BCM2835 Power Management emulation
-+# Copyright (c) 2020 Red Hat, Inc.
++ *
-+#
++ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
-+# Author:
++ * Copyright (C) 2021 Nolan Leake <nolan@sigbus.net>
-+#  Thomas Huth <thuth@redhat.com>
++ *
-+#
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+# This work is licensed under the terms of the GNU GPL, version 2 or
++ * See the COPYING file in the top-level directory.
-+# later.  See the COPYING file in the top-level directory.
++ */
 +
-+import os
++#ifndef BCM2835_POWERMGT_H
-+
++#define BCM2835_POWERMGT_H
-+from avocado import skipUnless
++
-+from avocado_qemu import Test
++#include "hw/sysbus.h"
-+from avocado_qemu import wait_for_console_pattern
++#include "qom/object.h"
 +
-+class N8x0Machine(Test):
++#define TYPE_BCM2835_POWERMGT "bcm2835-powermgt"
-+    """Boots the Linux kernel and checks that the console is operational"""
++OBJECT_DECLARE_SIMPLE_TYPE(BCM2835PowerMgtState, BCM2835_POWERMGT)
 +
-+    timeout = 90
++struct BCM2835PowerMgtState {
-+
++    SysBusDevice busdev;
-+    def __do_test_n8x0(self):
++    MemoryRegion iomem;
-+        kernel_url = ('http://stskeeps.subnetmask.net/meego-n8x0/'
++
-+                      'meego-arm-n8x0-1.0.80.20100712.1431-'
++    uint32_t rstc;
-+                      'vmlinuz-2.6.35~rc4-129.1-n8x0')
++    uint32_t rsts;
-+        kernel_hash = 'e9d5ab8d7548923a0061b6fbf601465e479ed269'
++    uint32_t wdog;
-+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
++};
 +
-+        self.vm.set_console(console_index=1)
++#endif
-+        self.vm.add_args('-kernel', kernel_path,
+diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
-+                         '-append', 'printk.time=0 console=ttyS1')
+index XXXXXXX..XXXXXXX 100644
-+        self.vm.launch()
+--- a/hw/arm/bcm2835_peripherals.c
-+        wait_for_console_pattern(self, 'TSC2005 driver initializing')
++++ b/hw/arm/bcm2835_peripherals.c
-+
+@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
-+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
-+    def test_n800(self):
+     object_property_add_const_link(OBJECT(&s->dwc2), "dma-mr",
-+        """
+                                    OBJECT(&s->gpu_bus_mr));
-+        :avocado: tags=arch:arm
++
-+        :avocado: tags=machine:n800
++    /* Power Management */
-+        """
++    object_initialize_child(obj, "powermgt", &s->powermgt,
-+        self.__do_test_n8x0()
++                            TYPE_BCM2835_POWERMGT);
-+
+ }
-+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
-+    def test_n810(self):
+ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
-+        """
+@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
-+        :avocado: tags=arch:arm
+         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
-+        :avocado: tags=machine:n810
+                                INTERRUPT_USB));
-+        """
-+        self.__do_test_n8x0()
++    /* Power Management */
 +    if (!sysbus_realize(SYS_BUS_DEVICE(&s->powermgt), errp)) {
 +        return;
 +    }
 +
 +    memory_region_add_subregion(&s->peri_mr, PM_OFFSET,
 +                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->powermgt), 0));
 +
      create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
      create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
 -    create_unimp(s, &s->powermgt, "bcm2835-powermgt", PM_OFFSET, 0x114);
      create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
      create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
      create_unimp(s, &s->spi[0], "bcm2835-spi0", SPI0_OFFSET, 0x20);
 diff --git a/hw/misc/bcm2835_powermgt.c b/hw/misc/bcm2835_powermgt.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/bcm2835_powermgt.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * BCM2835 Power Management emulation
 + *
 + * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
 + * Copyright (C) 2021 Nolan Leake <nolan@sigbus.net>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "hw/misc/bcm2835_powermgt.h"
 +#include "migration/vmstate.h"
 +#include "sysemu/runstate.h"
 +
 +#define PASSWORD 0x5a000000
 +#define PASSWORD_MASK 0xff000000
 +
 +#define R_RSTC 0x1c
 +#define V_RSTC_RESET 0x20
 +#define R_RSTS 0x20
 +#define V_RSTS_POWEROFF 0x555 /* Linux uses partition 63 to indicate halt. */
 +#define R_WDOG 0x24
 +
 +static uint64_t bcm2835_powermgt_read(void *opaque, hwaddr offset,
 +                                      unsigned size)
 +{
 +    BCM2835PowerMgtState *s = (BCM2835PowerMgtState *)opaque;
 +    uint32_t res = 0;
 +
 +    switch (offset) {
 +    case R_RSTC:
 +        res = s->rstc;
 +        break;
 +    case R_RSTS:
 +        res = s->rsts;
 +        break;
 +    case R_WDOG:
 +        res = s->wdog;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "bcm2835_powermgt_read: Unknown offset 0x%08"HWADDR_PRIx
 +                      "\n", offset);
 +        res = 0;
 +        break;
 +    }
 +
 +    return res;
 +}
 +
 +static void bcm2835_powermgt_write(void *opaque, hwaddr offset,
 +                                   uint64_t value, unsigned size)
 +{
 +    BCM2835PowerMgtState *s = (BCM2835PowerMgtState *)opaque;
 +
 +    if ((value & PASSWORD_MASK) != PASSWORD) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "bcm2835_powermgt_write: Bad password 0x%"PRIx64
 +                      " at offset 0x%08"HWADDR_PRIx"\n",
 +                      value, offset);
 +        return;
 +    }
 +
 +    value = value & ~PASSWORD_MASK;
 +
 +    switch (offset) {
 +    case R_RSTC:
 +        s->rstc = value;
 +        if (value & V_RSTC_RESET) {
 +            if ((s->rsts & 0xfff) == V_RSTS_POWEROFF) {
 +                qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +            } else {
 +                qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
 +            }
 +        }
 +        break;
 +    case R_RSTS:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "bcm2835_powermgt_write: RSTS\n");
 +        s->rsts = value;
 +        break;
 +    case R_WDOG:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "bcm2835_powermgt_write: WDOG\n");
 +        s->wdog = value;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "bcm2835_powermgt_write: Unknown offset 0x%08"HWADDR_PRIx
 +                      "\n", offset);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps bcm2835_powermgt_ops = {
 +    .read = bcm2835_powermgt_read,
 +    .write = bcm2835_powermgt_write,
 +    .endianness = DEVICE_NATIVE_ENDIAN,
 +    .impl.min_access_size = 4,
 +    .impl.max_access_size = 4,
 +};
 +
 +static const VMStateDescription vmstate_bcm2835_powermgt = {
 +    .name = TYPE_BCM2835_POWERMGT,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(rstc, BCM2835PowerMgtState),
 +        VMSTATE_UINT32(rsts, BCM2835PowerMgtState),
 +        VMSTATE_UINT32(wdog, BCM2835PowerMgtState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void bcm2835_powermgt_init(Object *obj)
 +{
 +    BCM2835PowerMgtState *s = BCM2835_POWERMGT(obj);
 +
 +    memory_region_init_io(&s->iomem, obj, &bcm2835_powermgt_ops, s,
 +                          TYPE_BCM2835_POWERMGT, 0x200);
 +    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 +}
 +
 +static void bcm2835_powermgt_reset(DeviceState *dev)
 +{
 +    BCM2835PowerMgtState *s = BCM2835_POWERMGT(dev);
 +
 +    /* https://elinux.org/BCM2835_registers#PM */
 +    s->rstc = 0x00000102;
 +    s->rsts = 0x00001000;
 +    s->wdog = 0x00000000;
 +}
 +
 +static void bcm2835_powermgt_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = bcm2835_powermgt_reset;
 +    dc->vmsd = &vmstate_bcm2835_powermgt;
 +}
 +
 +static TypeInfo bcm2835_powermgt_info = {
 +    .name          = TYPE_BCM2835_POWERMGT,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(BCM2835PowerMgtState),
 +    .class_init    = bcm2835_powermgt_class_init,
 +    .instance_init = bcm2835_powermgt_init,
 +};
 +
 +static void bcm2835_powermgt_register_types(void)
 +{
 +    type_register_static(&bcm2835_powermgt_info);
 +}
 +
 +type_init(bcm2835_powermgt_register_types)
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
    'bcm2835_rng.c',
    'bcm2835_thermal.c',
    'bcm2835_cprman.c',
 +  'bcm2835_powermgt.c',
  ))
  softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
  softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c', 'zynq-xadc.c'))
 --
 .20.1

-[PULL 28/33] tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer
+[PULL 04/24] tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine
 From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Add a test that verifies the Tux logo is displayed on the framebuffer.
+Add a test booting and quickly shutdown a raspi2 machine,
 to test the power management model:
-We simply follow the OpenCV "Template Matching with Multiple Objects"
+   (1/1) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi2_initrd:
-tutorial, replacing Lionel Messi by Tux:
+  console: [    0.000000] Booting Linux on physical CPU 0xf00
-https://docs.opencv.org/4.2.0/d4/dc6/tutorial_py_template_matching.html
+  console: [    0.000000] Linux version 4.14.98-v7+ (dom@dom-XPS-13-9370) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 SMP Tue Feb 12 20:27:48 GMT 2019
+  console: [    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
-When OpenCV and NumPy are installed, this test can be run using:
+  console: [    0.000000] CPU: div instructions available: patching division code
+  console: [    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
-  $ AVOCADO_ALLOW_UNTRUSTED_CODE=hmmm \
+  console: [    0.000000] OF: fdt: Machine model: Raspberry Pi 2 Model B
-    avocado --show=app,framebuffer run -t device:framebuffer \
+  ...
-      tests/acceptance/machine_arm_integratorcp.py
+  console: Boot successful.
-  JOB ID     : 8c46b0f8269242e87d738247883ea2a470df949e
+  console: cat /proc/cpuinfo
-  JOB LOG    : avocado/job-results/job-2020-01-31T21.38-8c46b0f/job.log
+  console: / # cat /proc/cpuinfo
-   (1/1) tests/acceptance/machine_arm_integratorcp.py:IntegratorMachine.test_framebuffer_tux_logo:
+  ...
-  framebuffer: found Tux at position [x, y] = (0, 0)
+  console: processor      : 3
-  PASS (3.96 s)
+  console: model name     : ARMv7 Processor rev 5 (v7l)
   console: BogoMIPS       : 125.00
   console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
   console: CPU implementer        : 0x41
   console: CPU architecture: 7
   console: CPU variant    : 0x0
   console: CPU part       : 0xc07
   console: CPU revision   : 5
   console: Hardware       : BCM2835
   console: Revision       : 0000
   console: Serial         : 0000000000000000
   console: cat /proc/iomem
   console: / # cat /proc/iomem
   console: 00000000-3bffffff : System RAM
   console: 00008000-00afffff : Kernel code
   console: 00c00000-00d468ef : Kernel data
   console: 3f006000-3f006fff : dwc_otg
   console: 3f007000-3f007eff : /soc/dma@7e007000
   console: 3f00b880-3f00b8bf : /soc/mailbox@7e00b880
   console: 3f100000-3f100027 : /soc/watchdog@7e100000
   console: 3f101000-3f102fff : /soc/cprman@7e101000
   console: 3f200000-3f2000b3 : /soc/gpio@7e200000
   PASS (24.59 s)
   RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
-  JOB TIME   : 4.23 s
+  JOB TIME   : 25.02 s
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
-Message-id: 20200225172501.29609-5-philmd@redhat.com
+Message-id: 20210531113837.1689775-1-f4bug@amsat.org
 Message-Id: <20200131211102.29612-3-f4bug@amsat.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/acceptance/machine_arm_integratorcp.py | 52 ++++++++++++++++++++
+ tests/acceptance/boot_linux_console.py | 43 ++++++++++++++++++++++++++
-file changed, 52 insertions(+)
+file changed, 43 insertions(+)
-diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
+diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
 index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/machine_arm_integratorcp.py
+--- a/tests/acceptance/boot_linux_console.py
-+++ b/tests/acceptance/machine_arm_integratorcp.py
++++ b/tests/acceptance/boot_linux_console.py
 @@ -XXX,XX +XXX,XX @@
- # later.  See the COPYING file in the top-level directory.
+ from avocado import skip
  import os
 +import logging
  from avocado import skipUnless
  from avocado_qemu import Test
++from avocado_qemu import exec_command
+ from avocado_qemu import exec_command_and_wait_for_pattern
+ from avocado_qemu import interrupt_interactive_console_until_pattern
  from avocado_qemu import wait_for_console_pattern
+@@ -XXX,XX +XXX,XX @@ def test_arm_raspi2_uart0(self):
          """
          self.do_test_arm_raspi2(0)
 +    def test_arm_raspi2_initrd(self):
 +        """
 +        :avocado: tags=arch:arm
 +        :avocado: tags=machine:raspi2
 +        """
 +        deb_url = ('http://archive.raspberrypi.org/debian/'
 +                   'pool/main/r/raspberrypi-firmware/'
 +                   'raspberrypi-kernel_1.20190215-1_armhf.deb')
 +        deb_hash = 'cd284220b32128c5084037553db3c482426f3972'
 +        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
 +        kernel_path = self.extract_from_deb(deb_path, '/boot/kernel7.img')
 +        dtb_path = self.extract_from_deb(deb_path, '/boot/bcm2709-rpi-2-b.dtb')
 +
-+NUMPY_AVAILABLE = True
++        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
-+try:
++                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
-+    import numpy as np
++                      'arm/rootfs-armv7a.cpio.gz')
-+except ImportError:
++        initrd_hash = '604b2e45cdf35045846b8bbfbf2129b1891bdc9c'
-+    NUMPY_AVAILABLE = False
++        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
 +        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
 +        archive.gzip_uncompress(initrd_path_gz, initrd_path)
 +
-+CV2_AVAILABLE = True
++        self.vm.set_console()
-+try:
++        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
-+    import cv2
++                               'earlycon=pl011,0x3f201000 console=ttyAMA0 '
-+except ImportError:
++                               'panic=-1 noreboot ' +
-+    CV2_AVAILABLE = False
++                               'dwc_otg.fiq_fsm_enable=0')
 +        self.vm.add_args('-kernel', kernel_path,
 +                         '-dtb', dtb_path,
 +                         '-initrd', initrd_path,
 +                         '-append', kernel_command_line,
 +                         '-no-reboot')
 +        self.vm.launch()
 +        self.wait_for_console_pattern('Boot successful.')
 +
++        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
++                                                'BCM2835')
++        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
++                                                '/soc/cprman@7e101000')
++        exec_command(self, 'halt')
++        # Wait for VM to shut down gracefully
++        self.vm.wait()
 +
- class IntegratorMachine(Test):
+     def test_arm_exynos4210_initrd(self):
      timeout = 90
@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
          """
-         self.boot_integratorcp()
+         :avocado: tags=arch:arm
          wait_for_console_pattern(self, 'Log in as root')
 +
 +    @skipUnless(NUMPY_AVAILABLE, 'Python NumPy not installed')
 +    @skipUnless(CV2_AVAILABLE, 'Python OpenCV not installed')
 +    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
 +    def test_framebuffer_tux_logo(self):
 +        """
 +        Boot Linux and verify the Tux logo is displayed on the framebuffer.
 +        :avocado: tags=arch:arm
 +        :avocado: tags=machine:integratorcp
 +        :avocado: tags=device:pl110
 +        :avocado: tags=device:framebuffer
 +        """
 +        screendump_path = os.path.join(self.workdir, "screendump.pbm")
 +        tuxlogo_url = ('https://github.com/torvalds/linux/raw/v2.6.12/'
 +                       'drivers/video/logo/logo_linux_vga16.ppm')
 +        tuxlogo_hash = '3991c2ddbd1ddaecda7601f8aafbcf5b02dc86af'
 +        tuxlogo_path = self.fetch_asset(tuxlogo_url, asset_hash=tuxlogo_hash)
 +
 +        self.boot_integratorcp()
 +        framebuffer_ready = 'Console: switching to colour frame buffer device'
 +        wait_for_console_pattern(self, framebuffer_ready)
 +        self.vm.command('human-monitor-command', command_line='stop')
 +        self.vm.command('human-monitor-command',
 +                        command_line='screendump %s' % screendump_path)
 +        logger = logging.getLogger('framebuffer')
 +
 +        cpu_count = 1
 +        match_threshold = 0.92
 +        screendump_bgr = cv2.imread(screendump_path)
 +        screendump_gray = cv2.cvtColor(screendump_bgr, cv2.COLOR_BGR2GRAY)
 +        result = cv2.matchTemplate(screendump_gray, cv2.imread(tuxlogo_path, 0),
 +                                   cv2.TM_CCOEFF_NORMED)
 +        loc = np.where(result >= match_threshold)
 +        tux_count = 0
 +        for tux_count, pt in enumerate(zip(*loc[::-1]), start=1):
 +            logger.debug('found Tux at position [x, y] = %s', pt)
 +        self.assertGreaterEqual(tux_count, cpu_count)
 --
 .20.1

-[PULL 05/33] cpu/a9mpcore: Set number of GIC priority bits to 5
+[PULL 05/24] target/arm: Check NaN mode before silencing NaN
-From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+From: Joe Komlodi <joe.komlodi@xilinx.com>
-All A9 CPUs have a GIC with 5 bits of priority.
+If the CPU is running in default NaN mode (FPCR.DN == 1) and we execute
 FRSQRTE, FRECPE, or FRECPX with a signaling NaN, parts_silence_nan_frac() will
 assert due to fpst->default_nan_mode being set.
-Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+To avoid this, we check to see what NaN mode we're running in before we call
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+floatxx_silence_nan().
-Message-id: 1582537164-764-3-git-send-email-sai.pavan.boddu@xilinx.com
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1624662174-175828-2-git-send-email-joe.komlodi@xilinx.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/cpu/a9mpcore.c | 4 ++++
+ target/arm/helper-a64.c | 12 +++++++++---
-file changed, 4 insertions(+)
+ target/arm/vfp_helper.c | 24 ++++++++++++++++++------
 files changed, 27 insertions(+), 9 deletions(-)
-diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
+diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/cpu/a9mpcore.c
+--- a/target/arm/helper-a64.c
-+++ b/hw/cpu/a9mpcore.c
++++ b/target/arm/helper-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(frecpx_f16)(uint32_t a, void *fpstp)
- #include "hw/qdev-properties.h"
+         float16 nan = a;
- #include "hw/core/cpu.h"
+         if (float16_is_signaling_nan(a, fpst)) {
+             float_raise(float_flag_invalid, fpst);
-+#define A9_GIC_NUM_PRIORITY_BITS    5
+-            nan = float16_silence_nan(a, fpst);
-+
++            if (!fpst->default_nan_mode) {
- static void a9mp_priv_set_irq(void *opaque, int irq, int level)
++                nan = float16_silence_nan(a, fpst);
- {
++            }
-     A9MPPrivState *s = (A9MPPrivState *)opaque;
+         }
-@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_realize(DeviceState *dev, Error **errp)
+         if (fpst->default_nan_mode) {
-     gicdev = DEVICE(&s->gic);
+             nan = float16_default_nan(fpst);
-     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
+@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)
-     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
+         float32 nan = a;
-+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
+         if (float32_is_signaling_nan(a, fpst)) {
-+                         A9_GIC_NUM_PRIORITY_BITS);
+             float_raise(float_flag_invalid, fpst);
+-            nan = float32_silence_nan(a, fpst);
-     /* Make the GIC's TZ support match the CPUs. We assume that
++            if (!fpst->default_nan_mode) {
-      * either all the CPUs have TZ, or none do.
++                nan = float32_silence_nan(a, fpst);
 +            }
          }
          if (fpst->default_nan_mode) {
              nan = float32_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)
          float64 nan = a;
          if (float64_is_signaling_nan(a, fpst)) {
              float_raise(float_flag_invalid, fpst);
 -            nan = float64_silence_nan(a, fpst);
 +            if (!fpst->default_nan_mode) {
 +                nan = float64_silence_nan(a, fpst);
 +            }
          }
          if (fpst->default_nan_mode) {
              nan = float64_default_nan(fpst);
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)
          float16 nan = f16;
          if (float16_is_signaling_nan(f16, fpst)) {
              float_raise(float_flag_invalid, fpst);
 -            nan = float16_silence_nan(f16, fpst);
 +            if (!fpst->default_nan_mode) {
 +                nan = float16_silence_nan(f16, fpst);
 +            }
          }
          if (fpst->default_nan_mode) {
              nan =  float16_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(recpe_f32)(float32 input, void *fpstp)
          float32 nan = f32;
          if (float32_is_signaling_nan(f32, fpst)) {
              float_raise(float_flag_invalid, fpst);
 -            nan = float32_silence_nan(f32, fpst);
 +            if (!fpst->default_nan_mode) {
 +                nan = float32_silence_nan(f32, fpst);
 +            }
          }
          if (fpst->default_nan_mode) {
              nan =  float32_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpe_f64)(float64 input, void *fpstp)
          float64 nan = f64;
          if (float64_is_signaling_nan(f64, fpst)) {
              float_raise(float_flag_invalid, fpst);
 -            nan = float64_silence_nan(f64, fpst);
 +            if (!fpst->default_nan_mode) {
 +                nan = float64_silence_nan(f64, fpst);
 +            }
          }
          if (fpst->default_nan_mode) {
              nan =  float64_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)
          float16 nan = f16;
          if (float16_is_signaling_nan(f16, s)) {
              float_raise(float_flag_invalid, s);
 -            nan = float16_silence_nan(f16, s);
 +            if (!s->default_nan_mode) {
 +                nan = float16_silence_nan(f16, fpstp);
 +            }
          }
          if (s->default_nan_mode) {
              nan =  float16_default_nan(s);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
          float32 nan = f32;
          if (float32_is_signaling_nan(f32, s)) {
              float_raise(float_flag_invalid, s);
 -            nan = float32_silence_nan(f32, s);
 +            if (!s->default_nan_mode) {
 +                nan = float32_silence_nan(f32, fpstp);
 +            }
          }
          if (s->default_nan_mode) {
              nan =  float32_default_nan(s);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
          float64 nan = f64;
          if (float64_is_signaling_nan(f64, s)) {
              float_raise(float_flag_invalid, s);
 -            nan = float64_silence_nan(f64, s);
 +            if (!s->default_nan_mode) {
 +                nan = float64_silence_nan(f64, fpstp);
 +            }
          }
          if (s->default_nan_mode) {
              nan =  float64_default_nan(s);
 --
 .20.1

-[PULL 07/33] target/arm: Add isar_feature_aa32_vfp_simd
+[PULL 06/24] hw/gpio/gpio_pwr: use shutdown function for reboot
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Maxim Uvarov <maxim.uvarov@linaro.org>
-Use this in the places that were checking ARM_FEATURE_VFP, and
+qemu has 2 type of functions: shutdown and reboot. Shutdown
-are obviously testing for the existance of the register set
+function has to be used for machine shutdown. Otherwise we cause
-as opposed to testing for some particular instruction extension.
+a reset with a bogus "cause" value, when we intended a shutdown.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200224222232.13807-2-richard.henderson@linaro.org
+Message-id: 20210625111842.3790-3-maxim.uvarov@linaro.org
 [PMM: tweaked commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h        |  9 +++++++++
+ hw/gpio/gpio_pwr.c | 2 +-
- hw/intc/armv7m_nvic.c   | 20 ++++++++++----------
+file changed, 1 insertion(+), 1 deletion(-)
  linux-user/arm/signal.c |  4 ++--
  target/arm/arch_dump.c  | 11 ++++++-----
  target/arm/cpu.c        |  4 ++--
  target/arm/helper.c     |  4 ++--
  target/arm/m_helper.c   | 11 ++++++-----
 files changed, 37 insertions(+), 26 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/gpio/gpio_pwr.c
-+++ b/target/arm/cpu.h
++++ b/hw/gpio/gpio_pwr.c
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static void gpio_pwr_reset(void *opaque, int n, int level)
-     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
+ static void gpio_pwr_shutdown(void *opaque, int n, int level)
  {
      if (level) {
 -        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
 +        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
      }
  }
-+static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
-+{
-+    /*
-+     * Return true if either VFP or SIMD is implemented.
-+     * In this case, a minimum of VFP w/ D0-D15.
-+     */
-+    return FIELD_EX32(id->mvfr0, MVFR0, SIMDREG) > 0;
-+}
-+
- static inline bool isar_feature_aa32_simd_r32(const ARMISARegisters *id)
- {
-     /* Return true if D16-D31 are implemented */
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-     case 0xd84: /* CSSELR */
-         return cpu->env.v7m.csselr[attrs.secure];
-     case 0xd88: /* CPACR */
--        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             return 0;
-         }
-         return cpu->env.v7m.cpacr[attrs.secure];
-     case 0xd8c: /* NSACR */
--        if (!attrs.secure || !arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             return 0;
-         }
-         return cpu->env.v7m.nsacr;
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-         }
-         return cpu->env.v7m.sfar;
-     case 0xf34: /* FPCCR */
--        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             return 0;
-         }
-         if (attrs.secure) {
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
-             return value;
-         }
-     case 0xf38: /* FPCAR */
--        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             return 0;
-         }
-         return cpu->env.v7m.fpcar[attrs.secure];
-     case 0xf3c: /* FPDSCR */
--        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             return 0;
-         }
-         return cpu->env.v7m.fpdscr[attrs.secure];
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         }
-         break;
-     case 0xd88: /* CPACR */
--        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             /* We implement only the Floating Point extension's CP10/CP11 */
-             cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
-         }
-         break;
-     case 0xd8c: /* NSACR */
--        if (attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             /* We implement only the Floating Point extension's CP10/CP11 */
-             cpu->env.v7m.nsacr = value & (3 << 10);
-         }
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         break;
-     }
-     case 0xf34: /* FPCCR */
--        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             /* Not all bits here are banked. */
-             uint32_t fpccr_s;
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
-         }
-         break;
-     case 0xf38: /* FPCAR */
--        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             value &= ~7;
-             cpu->env.v7m.fpcar[attrs.secure] = value;
-         }
-         break;
-     case 0xf3c: /* FPDSCR */
--        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             value &= 0x07c00000;
-             cpu->env.v7m.fpdscr[attrs.secure] = value;
-         }
-diff --git a/linux-user/arm/signal.c b/linux-user/arm/signal.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/signal.c
-+++ b/linux-user/arm/signal.c
-@@ -XXX,XX +XXX,XX @@ static void setup_sigframe_v2(struct target_ucontext_v2 *uc,
-     setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);
-     /* Save coprocessor signal frame.  */
-     regspace = uc->tuc_regspace;
--    if (arm_feature(env, ARM_FEATURE_VFP)) {
-+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
-         regspace = setup_sigframe_v2_vfp(regspace, env);
-     }
-     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-@@ -XXX,XX +XXX,XX @@ static int do_sigframe_return_v2(CPUARMState *env,
-     /* Restore coprocessor signal frame */
-     regspace = uc->tuc_regspace;
--    if (arm_feature(env, ARM_FEATURE_VFP)) {
-+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
-         regspace = restore_sigframe_v2_vfp(env, regspace);
-         if (!regspace) {
-             return 1;
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
-+++ b/target/arm/arch_dump.c
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
-                              int cpuid, void *opaque)
- {
-     struct arm_note note;
--    CPUARMState *env = &ARM_CPU(cs)->env;
-+    ARMCPU *cpu = ARM_CPU(cs);
-+    CPUARMState *env = &cpu->env;
-     DumpState *s = opaque;
--    int ret, i, fpvalid = !!arm_feature(env, ARM_FEATURE_VFP);
-+    int ret, i;
-+    bool fpvalid = cpu_isar_feature(aa32_vfp_simd, cpu);
-     arm_note_init(&note, s, "CORE", 5, NT_PRSTATUS, sizeof(note.prstatus));
-@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
- ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
- {
-     ARMCPU *cpu = ARM_CPU(first_cpu);
--    CPUARMState *env = &cpu->env;
-     size_t note_size;
-     if (class == ELFCLASS64) {
-@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
-         note_size += AARCH64_PRFPREG_NOTE_SIZE;
- #ifdef TARGET_AARCH64
-         if (cpu_isar_feature(aa64_sve, cpu)) {
--            note_size += AARCH64_SVE_NOTE_SIZE(env);
-+            note_size += AARCH64_SVE_NOTE_SIZE(&cpu->env);
-         }
- #endif
-     } else {
-         note_size = ARM_PRSTATUS_NOTE_SIZE;
--        if (arm_feature(env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             note_size += ARM_VFP_NOTE_SIZE;
-         }
-     }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
-         }
--        if (arm_feature(env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
-             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
-                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
-         int numvfpregs = 0;
-         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
-             numvfpregs = 32;
--        } else if (arm_feature(env, ARM_FEATURE_VFP)) {
-+        } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             numvfpregs = 16;
-         }
-         for (i = 0; i < numvfpregs; i++) {
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
-          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
-          */
--        if (arm_feature(env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
-             /* VFP coprocessor: cp10 & cp11 [23:20] */
-             mask |= (1 << 31) | (1 << 30) | (0xf << 20);
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
-     } else if (cpu_isar_feature(aa32_simd_r32, cpu)) {
-         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
-, "arm-vfp3.xml", 0);
--    } else if (arm_feature(env, ARM_FEATURE_VFP)) {
-+    } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
-         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
-, "arm-vfp.xml", 0);
-     }
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
-+++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
-      */
-     uint32_t sig = 0xfefa125a;
--    if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
-+    if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
-+        || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
-         sig |= 1;
-     }
-     return sig;
-@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
-     if (dotailchain) {
-         /* Sanitize LR FType and PREFIX bits */
--        if (!arm_feature(env, ARM_FEATURE_VFP)) {
-+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
-             lr |= R_V7M_EXCRET_FTYPE_MASK;
-         }
-         lr = deposit32(lr, 24, 8, 0xff);
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-     ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
--    if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
-+    if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
-         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
-                       "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
-                       "if FPU not present\n",
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
-              * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
-              * RES0 if the FPU is not present, and is stored in the S bank
-              */
--            if (arm_feature(env, ARM_FEATURE_VFP) &&
-+            if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
-                 extract32(env->v7m.nsacr, 10, 1)) {
-                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
-                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
-             env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
-             env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
-         }
--        if (arm_feature(env, ARM_FEATURE_VFP)) {
-+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
-             /*
-              * SFPA is RAZ/WI from NS or if no FPU.
-              * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
 --
 .20.1

-[PULL 08/33] target/arm: Rename isar_feature_aa32_fpdp_v2
+[PULL 07/24] target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation
-From: Richard Henderson <richard.henderson@linaro.org>
+In do_ldst(), the calculation of the offset needs to be based on the
 size of the memory access, not the size of the elements in the
 vector.  This meant we were getting it wrong for the widening and
 narrowing variants of the various VLDR and VSTR insns.
-The old name, isar_feature_aa32_fpdp, does not reflect
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-that the test includes VFPv2.  We will introduce another
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-feature tests for VFPv3.
+Message-id: 20210628135835.6690-2-peter.maydell@linaro.org
 ---
  target/arm/translate-mve.c | 17 +++++++++--------
 file changed, 9 insertions(+), 8 deletions(-)
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h               |  4 ++--
  target/arm/translate-vfp.inc.c | 40 +++++++++++++++++-----------------
 files changed, 22 insertions(+), 22 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/translate-mve.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static bool mve_skip_first_beat(DisasContext *s)
-     return FIELD_EX32(id->mvfr0, MVFR0, FPSHVEC) > 0;
+     }
  }
--static inline bool isar_feature_aa32_fpdp(const ARMISARegisters *id)
+-static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn)
-+static inline bool isar_feature_aa32_fpdp_v2(const ARMISARegisters *id)
++static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn,
 +                    unsigned msize)
  {
--    /* Return true if CPU supports double precision floating point */
+     TCGv_i32 addr;
-+    /* Return true if CPU supports double precision floating point, VFPv2 */
+     uint32_t offset;
-     return FIELD_EX32(id->mvfr0, MVFR0, FPDP) > 0;
+@@ -XXX,XX +XXX,XX @@ static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn)
          return true;
      }
 -    offset = a->imm << a->size;
 +    offset = a->imm << msize;
      if (!a->a) {
          offset = -offset;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR(DisasContext *s, arg_VLDR_VSTR *a)
          { gen_helper_mve_vstrw, gen_helper_mve_vldrw },
          { NULL, NULL }
      };
 -    return do_ldst(s, a, ldstfns[a->size][a->l]);
 +    return do_ldst(s, a, ldstfns[a->size][a->l], a->size);
  }
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+-#define DO_VLDST_WIDE_NARROW(OP, SLD, ULD, ST)                  \
-index XXXXXXX..XXXXXXX 100644
++#define DO_VLDST_WIDE_NARROW(OP, SLD, ULD, ST, MSIZE)           \
---- a/target/arm/translate-vfp.inc.c
+     static bool trans_##OP(DisasContext *s, arg_VLDR_VSTR *a)   \
-+++ b/target/arm/translate-vfp.inc.c
+     {                                                           \
-@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
+         static MVEGenLdStFn * const ldstfns[2][2] = {           \
-         return false;
+             { gen_helper_mve_##ST, gen_helper_mve_##SLD },      \
              { NULL, gen_helper_mve_##ULD },                     \
          };                                                      \
 -        return do_ldst(s, a, ldstfns[a->u][a->l]);              \
 +        return do_ldst(s, a, ldstfns[a->u][a->l], MSIZE);       \
      }
--    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
+-DO_VLDST_WIDE_NARROW(VLDSTB_H, vldrb_sh, vldrb_uh, vstrb_h)
-+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+-DO_VLDST_WIDE_NARROW(VLDSTB_W, vldrb_sw, vldrb_uw, vstrb_w)
-         return false;
+-DO_VLDST_WIDE_NARROW(VLDSTH_W, vldrh_sw, vldrh_uw, vstrh_w)
-     }
++DO_VLDST_WIDE_NARROW(VLDSTB_H, vldrb_sh, vldrb_uh, vstrb_h, MO_8)
++DO_VLDST_WIDE_NARROW(VLDSTB_W, vldrb_sw, vldrb_uw, vstrb_w, MO_8)
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
++DO_VLDST_WIDE_NARROW(VLDSTH_W, vldrh_sw, vldrh_uw, vstrh_w, MO_16)
-         return false;
-     }
+ static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
+ {
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
          return false;
      }
 -    if (dp && !dc_isar_feature(aa32_fpdp, s)) {
 +    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp, s)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 --
 .20.1

-[PULL 12/33] target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
+[PULL 08/24] target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH
-From: Richard Henderson <richard.henderson@linaro.org>
+The initial implementation of the MVE VRMLALDAVH and VRMLSLDAVH
 insns had some bugs:
  * the 32x32 multiply of elements was being done as 32x32->32,
    not 32x32->64
  * we were incorrectly maintaining the accumulator in its full
 -bit form across all 4 beats of the insn; in the pseudocode
    it is squashed back into the 64 bits of the RdaHi:RdaLo
    registers after each beat
-Sort this check to the start of a trans_* function.
+In particular, fixing the second of these allows us to recast
-Merge this with any existing test for fpdp_v2.
+the implementation to avoid 128-bit arithmetic entirely.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Since the element size here is always 4, we can also drop the
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+parameterization of ESIZE to make the code a little more readable.
-Message-id: 20200224222232.13807-8-richard.henderson@linaro.org
 Suggested-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210628135835.6690-3-peter.maydell@linaro.org
 ---
- target/arm/translate-vfp.inc.c | 24 ++++++++----------------
+ target/arm/mve_helper.c | 38 +++++++++++++++++++++-----------------
-file changed, 8 insertions(+), 16 deletions(-)
+file changed, 21 insertions(+), 17 deletions(-)
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/mve_helper.c
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/mve_helper.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
+@@ -XXX,XX +XXX,XX @@
-          * VFPv2 allows access to FPSID from userspace; VFPv3 restricts
+  */
-          * all ID registers to privileged access only.
-          */
+ #include "qemu/osdep.h"
--        if (IS_USER(s) && arm_dc_feature(s, ARM_FEATURE_VFP3)) {
+-#include "qemu/int128.h"
-+        if (IS_USER(s) && dc_isar_feature(aa32_fpsp_v3, s)) {
+ #include "cpu.h"
-             return false;
+ #include "internals.h"
-         }
+ #include "vec_internal.h"
-         ignore_vfp_enabled = true;
+@@ -XXX,XX +XXX,XX @@ DO_LDAV(vmlsldavsw, 4, int32_t, false, +=, -=)
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
+ DO_LDAV(vmlsldavxsw, 4, int32_t, true, +=, -=)
-     case ARM_VFP_FPINST:
-     case ARM_VFP_FPINST2:
+ /*
-         /* Not present in VFPv3 */
+- * Rounding multiply add long dual accumulate high: we must keep
--        if (IS_USER(s) || arm_dc_feature(s, ARM_FEATURE_VFP3)) {
+- * a 72-bit internal accumulator value and return the top 64 bits.
-+        if (IS_USER(s) || dc_isar_feature(aa32_fpsp_v3, s)) {
++ * Rounding multiply add long dual accumulate high. In the pseudocode
-             return false;
++ * this is implemented with a 72-bit internal accumulator value of which
-         }
++ * the top 64 bits are returned. We optimize this to avoid having to
-         break;
++ * use 128-bit arithmetic -- we can do this because the 74-bit accumulator
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
++ * is squashed back into 64-bits after each beat.
+  */
-     vd = a->vd;
+-#define DO_LDAVH(OP, ESIZE, TYPE, XCHG, EVENACC, ODDACC, TO128)         \
++#define DO_LDAVH(OP, TYPE, LTYPE, XCHG, SUB)                            \
--    if (!dc_isar_feature(aa32_fpshvec, s) &&
+     uint64_t HELPER(glue(mve_, OP))(CPUARMState *env, void *vn,         \
--        (veclen != 0 || s->vec_stride != 0)) {
+                                     void *vm, uint64_t a)               \
-+    if (!dc_isar_feature(aa32_fpsp_v3, s)) {
+     {                                                                   \
-         return false;
+         uint16_t mask = mve_element_mask(env);                          \
          unsigned e;                                                     \
          TYPE *n = vn, *m = vm;                                          \
 -        Int128 acc = int128_lshift(TO128(a), 8);                        \
 -        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
 +        for (e = 0; e < 16 / 4; e++, mask >>= 4) {                      \
              if (mask & 1) {                                             \
 +                LTYPE mul;                                              \
                  if (e & 1) {                                            \
 -                    acc = ODDACC(acc, TO128(n[H##ESIZE(e - 1 * XCHG)] * \
 -                                            m[H##ESIZE(e)]));           \
 +                    mul = (LTYPE)n[H4(e - 1 * XCHG)] * m[H4(e)];        \
 +                    if (SUB) {                                          \
 +                        mul = -mul;                                     \
 +                    }                                                   \
                  } else {                                                \
 -                    acc = EVENACC(acc, TO128(n[H##ESIZE(e + 1 * XCHG)] * \
 -                                             m[H##ESIZE(e)]));          \
 +                    mul = (LTYPE)n[H4(e + 1 * XCHG)] * m[H4(e)];        \
                  }                                                       \
 -                acc = int128_add(acc, int128_make64(1 << 7));           \
 +                mul = (mul >> 8) + ((mul >> 7) & 1);                    \
 +                a += mul;                                               \
              }                                                           \
          }                                                               \
          mve_advance_vpt(env);                                           \
 -        return int128_getlo(int128_rshift(acc, 8));                     \
 +        return a;                                                       \
      }
--    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
+-DO_LDAVH(vrmlaldavhsw, 4, int32_t, false, int128_add, int128_add, int128_makes64)
-+    if (!dc_isar_feature(aa32_fpshvec, s) &&
+-DO_LDAVH(vrmlaldavhxsw, 4, int32_t, true, int128_add, int128_add, int128_makes64)
-+        (veclen != 0 || s->vec_stride != 0)) {
++DO_LDAVH(vrmlaldavhsw, int32_t, int64_t, false, false)
-         return false;
++DO_LDAVH(vrmlaldavhxsw, int32_t, int64_t, true, false)
-     }
+-DO_LDAVH(vrmlaldavhuw, 4, uint32_t, false, int128_add, int128_add, int128_make64)
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
++DO_LDAVH(vrmlaldavhuw, uint32_t, uint64_t, false, false)
-     vd = a->vd;
+-DO_LDAVH(vrmlsldavhsw, 4, int32_t, false, int128_add, int128_sub, int128_makes64)
+-DO_LDAVH(vrmlsldavhxsw, 4, int32_t, true, int128_add, int128_sub, int128_makes64)
--    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
++DO_LDAVH(vrmlsldavhsw, int32_t, int64_t, false, true)
-+    if (!dc_isar_feature(aa32_fpdp_v3, s)) {
++DO_LDAVH(vrmlsldavhxsw, int32_t, int64_t, true, true)
-         return false;
-     }
+ /* Vector add across vector */
+ #define DO_VADDV(OP, ESIZE, TYPE)                               \
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
          return false;
      }
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
      TCGv_ptr fpst;
      int frac_bits;
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 +    if (!dc_isar_feature(aa32_fpsp_v3, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
      TCGv_ptr fpst;
      int frac_bits;
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
 +    if (!dc_isar_feature(aa32_fpdp_v3, s)) {
          return false;
      }
 --
 .20.1

-[PULL 17/33] target/arm: Move the vfp decodetree calls next to the base isa
+[PULL 09/24] target/arm: Make asimd_imm_const() public
-From: Richard Henderson <richard.henderson@linaro.org>
+The function asimd_imm_const() in translate-neon.c is an
 implementation of the pseudocode AdvSIMDExpandImm(), which we will
 also want for MVE.  Move the implementation to translate.c, with a
 prototype in translate.h.
-Have the calls adjacent as an intermediate step toward
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-actually merging the decodes.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210628135835.6690-4-peter.maydell@linaro.org
 ---
  target/arm/translate.h      | 16 ++++++++++
  target/arm/translate-neon.c | 63 -------------------------------------
  target/arm/translate.c      | 57 +++++++++++++++++++++++++++++++++
 files changed, 73 insertions(+), 63 deletions(-)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+diff --git a/target/arm/translate.h b/target/arm/translate.h
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+index XXXXXXX..XXXXXXX 100644
-Message-id: 20200224222232.13807-13-richard.henderson@linaro.org
+--- a/target/arm/translate.h
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++++ b/target/arm/translate.h
----
+@@ -XXX,XX +XXX,XX @@ static inline MemOp finalize_memop(DisasContext *s, MemOp opc)
- target/arm/translate.c | 83 +++++++++++++++---------------------------
+     return opc | s->be_data;
-file changed, 29 insertions(+), 54 deletions(-)
+ }
 +/**
 + * asimd_imm_const: Expand an encoded SIMD constant value
 + *
 + * Expand a SIMD constant value. This is essentially the pseudocode
 + * AdvSIMDExpandImm, except that we also perform the boolean NOT needed for
 + * VMVN and VBIC (when cmode < 14 && op == 1).
 + *
 + * The combination cmode == 15 op == 1 is a reserved encoding for AArch32;
 + * callers must catch this.
 + *
 + * cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 was UNPREDICTABLE in v7A but
 + * is either not unpredictable or merely CONSTRAINED UNPREDICTABLE in v8A;
 + * we produce an immediate constant value of 0 in these cases.
 + */
 +uint64_t asimd_imm_const(uint32_t imm, int cmode, int op);
 +
  #endif /* TARGET_ARM_TRANSLATE_H */
 diff --git a/target/arm/translate-neon.c b/target/arm/translate-neon.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c
 +++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@ DO_FP_2SH(VCVT_UH, gen_helper_gvec_vcvt_uh)
  DO_FP_2SH(VCVT_HS, gen_helper_gvec_vcvt_hs)
  DO_FP_2SH(VCVT_HU, gen_helper_gvec_vcvt_hu)
 -static uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
 -{
 -    /*
 -     * Expand the encoded constant.
 -     * Note that cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 is UNPREDICTABLE.
 -     * We choose to not special-case this and will behave as if a
 -     * valid constant encoding of 0 had been given.
 -     * cmode = 15 op = 1 must UNDEF; we assume decode has handled that.
 -     */
 -    switch (cmode) {
 -    case 0: case 1:
 -        /* no-op */
 -        break;
 -    case 2: case 3:
 -        imm <<= 8;
 -        break;
 -    case 4: case 5:
 -        imm <<= 16;
 -        break;
 -    case 6: case 7:
 -        imm <<= 24;
 -        break;
 -    case 8: case 9:
 -        imm |= imm << 16;
 -        break;
 -    case 10: case 11:
 -        imm = (imm << 8) | (imm << 24);
 -        break;
 -    case 12:
 -        imm = (imm << 8) | 0xff;
 -        break;
 -    case 13:
 -        imm = (imm << 16) | 0xffff;
 -        break;
 -    case 14:
 -        if (op) {
 -            /*
 -             * This is the only case where the top and bottom 32 bits
 -             * of the encoded constant differ.
 -             */
 -            uint64_t imm64 = 0;
 -            int n;
 -
 -            for (n = 0; n < 8; n++) {
 -                if (imm & (1 << n)) {
 -                    imm64 |= (0xffULL << (n * 8));
 -                }
 -            }
 -            return imm64;
 -        }
 -        imm |= (imm << 8) | (imm << 16) | (imm << 24);
 -        break;
 -    case 15:
 -        imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
 -            | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
 -        break;
 -    }
 -    if (op) {
 -        imm = ~imm;
 -    }
 -    return dup_const(MO_32, imm);
 -}
 -
  static bool do_1reg_imm(DisasContext *s, arg_1reg_imm *a,
                          GVecGen2iFn *fn)
  {
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
+@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
-     tcg_temp_free_i32(tmp);
+     a64_translate_init();
  }
--/*
++uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
-- * Disassemble a VFP instruction.  Returns nonzero if an error occurred
++{
-- * (ie. an undefined instruction).
++    /* Expand the encoded constant as per AdvSIMDExpandImm pseudocode */
-- */
++    switch (cmode) {
--static int disas_vfp_insn(DisasContext *s, uint32_t insn)
++    case 0: case 1:
--{
++        /* no-op */
--    /*
++        break;
--     * If the decodetree decoder handles this insn it will always
++    case 2: case 3:
--     * emit code to either execute the insn or generate an appropriate
++        imm <<= 8;
--     * exception; so we don't need to ever return non-zero to tell
++        break;
--     * the calling code to emit an UNDEF exception.
++    case 4: case 5:
--     */
++        imm <<= 16;
--    if (extract32(insn, 28, 4) == 0xf) {
++        break;
--        if (disas_vfp_uncond(s, insn)) {
++    case 6: case 7:
--            return 0;
++        imm <<= 24;
--        }
++        break;
--    } else {
++    case 8: case 9:
--        if (disas_vfp(s, insn)) {
++        imm |= imm << 16;
--            return 0;
++        break;
--        }
++    case 10: case 11:
--    }
++        imm = (imm << 8) | (imm << 24);
--    /* If the decodetree decoder didn't handle this insn, it must be UNDEF */
++        break;
--    return 1;
++    case 12:
--}
++        imm = (imm << 8) | 0xff;
--
++        break;
- static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
++    case 13:
 +        imm = (imm << 16) | 0xffff;
 +        break;
 +    case 14:
 +        if (op) {
 +            /*
 +             * This is the only case where the top and bottom 32 bits
 +             * of the encoded constant differ.
 +             */
 +            uint64_t imm64 = 0;
 +            int n;
 +
 +            for (n = 0; n < 8; n++) {
 +                if (imm & (1 << n)) {
 +                    imm64 |= (0xffULL << (n * 8));
 +                }
 +            }
 +            return imm64;
 +        }
 +        imm |= (imm << 8) | (imm << 16) | (imm << 24);
 +        break;
 +    case 15:
 +        imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
 +            | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
 +        break;
 +    }
 +    if (op) {
 +        imm = ~imm;
 +    }
 +    return dup_const(MO_32, imm);
 +}
 +
  /* Generate a label used for skipping this instruction */
  void arm_gen_condlabel(DisasContext *s)
  {
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-         ARCH(5);
-         /* Unconditional instructions.  */
--        if (disas_a32_uncond(s, insn)) {
-+        /* TODO: Perhaps merge these into one decodetree output file.  */
-+        if (disas_a32_uncond(s, insn) ||
-+            disas_vfp_uncond(s, insn)) {
-             return;
-         }
-         /* fall back to legacy decoder */
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-             }
-             return;
-         }
--        if ((insn & 0x0f000e10) == 0x0e000a00) {
--            /* VFP.  */
--            if (disas_vfp_insn(s, insn)) {
--                goto illegal_op;
--            }
--            return;
--        }
-         if ((insn & 0x0e000f00) == 0x0c000100) {
-             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
-                 /* iWMMXt register transfer.  */
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-         arm_skip_unless(s, cond);
-     }
--    if (disas_a32(s, insn)) {
-+    /* TODO: Perhaps merge these into one decodetree output file.  */
-+    if (disas_a32(s, insn) ||
-+        disas_vfp(s, insn)) {
-         return;
-     }
-     /* fall back to legacy decoder */
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
-     case 0xd:
-     case 0xe:
-         if (((insn >> 8) & 0xe) == 10) {
--            /* VFP.  */
--            if (disas_vfp_insn(s, insn)) {
--                goto illegal_op;
--            }
--        } else if (disas_coproc_insn(s, insn)) {
-+            /* VFP, but failed disas_vfp.  */
-+            goto illegal_op;
-+        }
-+        if (disas_coproc_insn(s, insn)) {
-             /* Coprocessor.  */
-             goto illegal_op;
-         }
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-         ARCH(6T2);
-     }
--    if (disas_t32(s, insn)) {
-+    /*
-+     * TODO: Perhaps merge these into one decodetree output file.
-+     * Note disas_vfp is written for a32 with cond field in the
-+     * top nibble.  The t32 encoding requires 0xe in the top nibble.
-+     */
-+    if (disas_t32(s, insn) ||
-+        disas_vfp_uncond(s, insn) ||
-+        ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
-         return;
-     }
-     /* fall back to legacy decoder */
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-                 goto illegal_op; /* op0 = 0b11 : unallocated */
-             }
--            if (disas_vfp_insn(s, insn)) {
--                if (((insn >> 8) & 0xe) == 10 &&
--                    dc_isar_feature(aa32_fpsp_v2, s)) {
--                    /* FP, and the CPU supports it */
--                    goto illegal_op;
--                } else {
--                    /* All other insns: NOCP */
--                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
--                                       syn_uncategorized(),
--                                       default_exception_el(s));
--                }
-+            if (((insn >> 8) & 0xe) == 10 &&
-+                dc_isar_feature(aa32_fpsp_v2, s)) {
-+                /* FP, and the CPU supports it */
-+                goto illegal_op;
-+            } else {
-+                /* All other insns: NOCP */
-+                gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-+                                   syn_uncategorized(),
-+                                   default_exception_el(s));
-             }
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-                 goto illegal_op;
-             }
-         } else if (((insn >> 8) & 0xe) == 10) {
--            if (disas_vfp_insn(s, insn)) {
--                goto illegal_op;
--            }
-+            /* VFP, but failed disas_vfp.  */
-+            goto illegal_op;
-         } else {
-             if (insn & (1 << 28))
-                 goto illegal_op;
 --
 .20.1

-[PULL 14/33] target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
+[PULL 10/24] target/arm: Use asimd_imm_const for A64 decode
-From: Richard Henderson <richard.henderson@linaro.org>
+The A64 AdvSIMD modified-immediate grouping uses almost the same
 constant encoding that A32 Neon does; reuse asimd_imm_const() (to
 which we add the AArch64-specific case for cmode 15 op 1) instead of
 reimplementing it all.
-All remaining tests for VFP4 are for fused multiply-add insns.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210628135835.6690-5-peter.maydell@linaro.org
 ---
  target/arm/translate.h     |  3 +-
  target/arm/translate-a64.c | 86 ++++----------------------------------
  target/arm/translate.c     | 17 +++++++-
 files changed, 24 insertions(+), 82 deletions(-)
-Since the MVFR1 field is used for both VFP and NEON, move its adjustment
+diff --git a/target/arm/translate.h b/target/arm/translate.h
 from the !has_neon block to the (!has_vfp && !has_neon) block.
 Test for vfp of the appropraite width alongside the test for simdfmac
 within translate-vfp.inc.c.  Within disas_neon_data_insn, we have
 already tested for ARM_FEATURE_NEON.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200224222232.13807-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h               | 12 ++++++++++++
  target/arm/cpu.c               |  6 +++++-
  target/arm/translate-vfp.inc.c | 22 ++++++++++++++++++----
  target/arm/translate.c         |  2 +-
 files changed, 36 insertions(+), 6 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/translate.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/translate.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static inline MemOp finalize_memop(DisasContext *s, MemOp opc)
-     return FIELD_EX32(id->mvfr1, MVFR1, FPHP) > 1;
+  * VMVN and VBIC (when cmode < 14 && op == 1).
- }
+  *
+  * The combination cmode == 15 op == 1 is a reserved encoding for AArch32;
-+/*
+- * callers must catch this.
-+ * Note that this ID register field covers both VFP and Neon FMAC,
++ * callers must catch this; we return the 64-bit constant value defined
-+ * so should usually be tested in combination with some other
++ * for AArch64.
-+ * check that confirms the presence of whichever of VFP or Neon is
+  *
-+ * relevant, to avoid accidentally enabling a Neon feature on
+  * cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 was UNPREDICTABLE in v7A but
-+ * a VFP-no-Neon core or vice-versa.
+  * is either not unpredictable or merely CONSTRAINED UNPREDICTABLE in v8A;
-+ */
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-+static inline bool isar_feature_aa32_simdfmac(const ARMISARegisters *id)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/target/arm/translate-a64.c
-+    return FIELD_EX32(id->mvfr1, MVFR1, SIMDFMAC) != 0;
++++ b/target/arm/translate-a64.c
-+}
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
 +
  static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id)
  {
-     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 1;
+     int rd = extract32(insn, 0, 5);
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+     int cmode = extract32(insn, 12, 4);
-index XXXXXXX..XXXXXXX 100644
+-    int cmode_3_1 = extract32(cmode, 1, 3);
---- a/target/arm/cpu.c
+-    int cmode_0 = extract32(cmode, 0, 1);
-+++ b/target/arm/cpu.c
+     int o2 = extract32(insn, 11, 1);
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+     uint64_t abcdefgh = extract32(insn, 5, 5) | (extract32(insn, 16, 3) << 5);
-         u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
+     bool is_neg = extract32(insn, 29, 1);
-         u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
-         u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
+         return;
 -        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
          cpu->isar.mvfr1 = u;
          u = cpu->isar.mvfr2;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          u = cpu->isar.mvfr0;
          u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
          cpu->isar.mvfr0 = u;
 +
 +        /* Despite the name, this field covers both VFP and Neon */
 +        u = cpu->isar.mvfr1;
 +        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
 +        cpu->isar.mvfr1 = u;
      }
-     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
+-    /* See AdvSIMDExpandImm() in ARM ARM */
-diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
+-    switch (cmode_3_1) {
-index XXXXXXX..XXXXXXX 100644
+-    case 0: /* Replicate(Zeros(24):imm8, 2) */
---- a/target/arm/translate-vfp.inc.c
+-    case 1: /* Replicate(Zeros(16):imm8:Zeros(8), 2) */
-+++ b/target/arm/translate-vfp.inc.c
+-    case 2: /* Replicate(Zeros(8):imm8:Zeros(16), 2) */
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
+-    case 3: /* Replicate(imm8:Zeros(24), 2) */
+-    {
-     /*
+-        int shift = cmode_3_1 * 8;
-      * Present in VFPv4 only.
+-        imm = bitfield_replicate(abcdefgh << shift, 32);
-+     * Note that we can't rely on the SIMDFMAC check alone, because
+-        break;
-+     * in a Neon-no-VFP core that ID register field will be non-zero.
+-    }
-+     */
+-    case 4: /* Replicate(Zeros(8):imm8, 4) */
-+    if (!dc_isar_feature(aa32_simdfmac, s) ||
+-    case 5: /* Replicate(imm8:Zeros(8), 4) */
-+        !dc_isar_feature(aa32_fpsp_v2, s)) {
+-    {
-+        return false;
+-        int shift = (cmode_3_1 & 0x1) * 8;
-+    }
+-        imm = bitfield_replicate(abcdefgh << shift, 16);
-+    /*
+-        break;
-      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
+-    }
-      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
+-    case 6:
-      */
+-        if (cmode_0) {
--    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
+-            /* Replicate(Zeros(8):imm8:Ones(16), 2) */
--        (s->vec_len != 0 || s->vec_stride != 0)) {
+-            imm = (abcdefgh << 16) | 0xffff;
-+    if (s->vec_len != 0 || s->vec_stride != 0) {
+-        } else {
-         return false;
+-            /* Replicate(Zeros(16):imm8:Ones(8), 2) */
 -            imm = (abcdefgh << 8) | 0xff;
 -        }
 -        imm = bitfield_replicate(imm, 32);
 -        break;
 -    case 7:
 -        if (!cmode_0 && !is_neg) {
 -            imm = bitfield_replicate(abcdefgh, 8);
 -        } else if (!cmode_0 && is_neg) {
 -            int i;
 -            imm = 0;
 -            for (i = 0; i < 8; i++) {
 -                if ((abcdefgh) & (1 << i)) {
 -                    imm |= 0xffULL << (i * 8);
 -                }
 -            }
 -        } else if (cmode_0) {
 -            if (is_neg) {
 -                imm = (abcdefgh & 0x3f) << 48;
 -                if (abcdefgh & 0x80) {
 -                    imm |= 0x8000000000000000ULL;
 -                }
 -                if (abcdefgh & 0x40) {
 -                    imm |= 0x3fc0000000000000ULL;
 -                } else {
 -                    imm |= 0x4000000000000000ULL;
 -                }
 -            } else {
 -                if (o2) {
 -                    /* FMOV (vector, immediate) - half-precision */
 -                    imm = vfp_expand_imm(MO_16, abcdefgh);
 -                    /* now duplicate across the lanes */
 -                    imm = bitfield_replicate(imm, 16);
 -                } else {
 -                    imm = (abcdefgh & 0x3f) << 19;
 -                    if (abcdefgh & 0x80) {
 -                        imm |= 0x80000000;
 -                    }
 -                    if (abcdefgh & 0x40) {
 -                        imm |= 0x3e000000;
 -                    } else {
 -                        imm |= 0x40000000;
 -                    }
 -                    imm |= (imm << 32);
 -                }
 -            }
 -        }
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -
 -    if (cmode_3_1 != 7 && is_neg) {
 -        imm = ~imm;
 +    if (cmode == 15 && o2 && !is_neg) {
 +        /* FMOV (vector, immediate) - half-precision */
 +        imm = vfp_expand_imm(MO_16, abcdefgh);
 +        /* now duplicate across the lanes */
 +        imm = bitfield_replicate(imm, 16);
 +    } else {
 +        imm = asimd_imm_const(abcdefgh, cmode, is_neg);
      }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
+     if (!((cmode & 0x9) == 0x1 || (cmode & 0xd) == 0x9)) {
      /*
       * Present in VFPv4 only.
 +     * Note that we can't rely on the SIMDFMAC check alone, because
 +     * in a Neon-no-VFP core that ID register field will be non-zero.
 +     */
 +    if (!dc_isar_feature(aa32_simdfmac, s) ||
 +        !dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +    /*
       * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
       * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
       */
 -    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
 -        (s->vec_len != 0 || s->vec_stride != 0)) {
 +    if (s->vec_len != 0 || s->vec_stride != 0) {
          return false;
      }
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
-             }
+     case 14:
-             break;
+         if (op) {
-         case NEON_3R_VFM_VQRDMLSH:
+             /*
--            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
+-             * This is the only case where the top and bottom 32 bits
-+            if (!dc_isar_feature(aa32_simdfmac, s)) {
+-             * of the encoded constant differ.
-                 return 1;
++             * This and cmode == 15 op == 1 are the only cases where
-             }
++             * the top and bottom 32 bits of the encoded constant differ.
-             break;
+              */
              uint64_t imm64 = 0;
              int n;
@@ -XXX,XX +XXX,XX @@ uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
          imm |= (imm << 8) | (imm << 16) | (imm << 24);
          break;
      case 15:
 +        if (op) {
 +            /* Reserved encoding for AArch32; valid for AArch64 */
 +            uint64_t imm64 = (uint64_t)(imm & 0x3f) << 48;
 +            if (imm & 0x80) {
 +                imm64 |= 0x8000000000000000ULL;
 +            }
 +            if (imm & 0x40) {
 +                imm64 |= 0x3fc0000000000000ULL;
 +            } else {
 +                imm64 |= 0x4000000000000000ULL;
 +            }
 +            return imm64;
 +        }
          imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
              | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
          break;
 --
 .20.1

-[PULL 30/33] target/arm: Implement v8.3-RCPC
+[PULL 11/24] target/arm: Use dup_const() instead of bitfield_replicate()
-The v8.3-RCPC extension implements three new load instructions
+Use dup_const() instead of bitfield_replicate() in
-which provide slightly weaker consistency guarantees than the
+disas_simd_mod_imm().
-existing load-acquire operations. For QEMU we choose to simply
-implement them with a full LDAQ barrier.
+(We can't replace the other use of bitfield_replicate() in this file,
 in logic_imm_decode_wmask(), because that location needs to handle 2
 and 4 bit elements, which dup_const() cannot.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224172846.13053-3-peter.maydell@linaro.org
+Message-id: 20210628135835.6690-6-peter.maydell@linaro.org
 ---
- target/arm/cpu.h           |  5 +++++
+ target/arm/translate-a64.c | 2 +-
- linux-user/elfload.c       |  1 +
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/cpu64.c         |  1 +
  target/arm/translate-a64.c | 24 ++++++++++++++++++++++++
 files changed, 31 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
-         FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
- }
-+static inline bool isar_feature_aa64_rcpc_8_3(const ARMISARegisters *id)
-+{
-+    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) != 0;
-+}
-+
- /*
-  * Feature tests for "does this exist in either 32-bit or 64-bit?"
-  */
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
-     GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
-     GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
-     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
-+    GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
-     return hwcaps;
- }
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-         t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
-         t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
-         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
-+        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 1); /* ARMv8.3-RCPC */
-         cpu->isar.id_aa64isar1 = t;
-         t = cpu->isar.id_aa64pfr0;
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
-     int rs = extract32(insn, 16, 5);
+         /* FMOV (vector, immediate) - half-precision */
-     int rn = extract32(insn, 5, 5);
+         imm = vfp_expand_imm(MO_16, abcdefgh);
-     int o3_opc = extract32(insn, 12, 4);
+         /* now duplicate across the lanes */
-+    bool r = extract32(insn, 22, 1);
+-        imm = bitfield_replicate(imm, 16);
-+    bool a = extract32(insn, 23, 1);
++        imm = dup_const(MO_16, imm);
-     TCGv_i64 tcg_rs, clean_addr;
+     } else {
-     AtomicThreeOpFn *fn;
+         imm = asimd_imm_const(abcdefgh, cmode, is_neg);
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
      case 010: /* SWP */
          fn = tcg_gen_atomic_xchg_i64;
          break;
 +    case 014: /* LDAPR, LDAPRH, LDAPRB */
 +        if (!dc_isar_feature(aa64_rcpc_8_3, s) ||
 +            rs != 31 || a != 1 || r != 0) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        break;
      default:
          unallocated_encoding(s);
          return;
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_atomic(DisasContext *s, uint32_t insn,
          gen_check_sp_alignment(s);
      }
-     clean_addr = clean_data_tbi(s, cpu_reg_sp(s, rn));
-+
-+    if (o3_opc == 014) {
-+        /*
-+         * LDAPR* are a special case because they are a simple load, not a
-+         * fetch-and-do-something op.
-+         * The architectural consistency requirements here are weaker than
-+         * full load-acquire (we only need "load-acquire processor consistent"),
-+         * but we choose to implement them as full LDAQ.
-+         */
-+        do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, false, false,
-+                  true, rt, disas_ldst_compute_iss_sf(size, false, 0), true);
-+        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
-+        return;
-+    }
-+
-     tcg_rs = read_cpu_reg(s, rs, true);
-     if (o3_opc == 1) { /* LDCLR */
 --
 .20.1

-[PULL 16/33] target/arm: Move VLLDM and VLSTM to vfp.decode
+[PULL 12/24] target/arm: Implement MVE logical immediate insns
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE logical-immediate insns (VMOV, VMVN,
 VORR and VBIC). These have essentially the same encoding
 as their Neon equivalents, and we implement the decode
 in the same way.
-Now that we no longer have an early check for ARM_FEATURE_VFP,
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-we can use the proper ISA check in trans_VLLDM_VLSTM.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210628135835.6690-7-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h    |  4 +++
  target/arm/mve.decode      | 17 +++++++++++++
  target/arm/mve_helper.c    | 24 ++++++++++++++++++
  target/arm/translate-mve.c | 50 ++++++++++++++++++++++++++++++++++++++
 files changed, 95 insertions(+)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200224222232.13807-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 39 +++++++++++++++++++++++++
  target/arm/translate.c         | 53 ++++++----------------------------
  target/arm/vfp.decode          |  2 ++
 files changed, 50 insertions(+), 44 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_vaddvsh, TCG_CALL_NO_WG, i32, env, ptr, i32)
-     tcg_temp_free_ptr(fpst);
+ DEF_HELPER_FLAGS_3(mve_vaddvuh, TCG_CALL_NO_WG, i32, env, ptr, i32)
  DEF_HELPER_FLAGS_3(mve_vaddvsw, TCG_CALL_NO_WG, i32, env, ptr, i32)
  DEF_HELPER_FLAGS_3(mve_vaddvuw, TCG_CALL_NO_WG, i32, env, ptr, i32)
 +
 +DEF_HELPER_FLAGS_3(mve_vmovi, TCG_CALL_NO_WG, void, env, ptr, i64)
 +DEF_HELPER_FLAGS_3(mve_vandi, TCG_CALL_NO_WG, void, env, ptr, i64)
 +DEF_HELPER_FLAGS_3(mve_vorri, TCG_CALL_NO_WG, void, env, ptr, i64)
 diff --git a/target/arm/mve.decode b/target/arm/mve.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve.decode
 +++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@
  # VQDMULL has size in bit 28: 0 for 16 bit, 1 for 32 bit
  %size_28 28:1 !function=plus_1
 +# 1imm format immediate
 +%imm_28_16_0 28:1 16:3 0:4
 +
  &vldr_vstr rn qd imm p a w size l u
  &1op qd qm size
  &2op qd qm qn size
  &2scalar qd qn rm size
 +&1imm qd imm cmode op
  @vldr_vstr ....... . . . . l:1 rn:4 ... ...... imm:7 &vldr_vstr qd=%qd u=0
  # Note that both Rn and Qd are 3 bits only (no D bit)
@@ -XXX,XX +XXX,XX @@
  @2op_nosz .... .... .... .... .... .... .... .... &2op qd=%qd qm=%qm qn=%qn size=0
  @2op_sz28 .... .... .... .... .... .... .... .... &2op qd=%qd qm=%qm qn=%qn \
       size=%size_28
 +@1imm .... .... .... .... .... cmode:4 .. op:1 . .... &1imm qd=%qd imm=%imm_28_16_0
  # The _rev suffix indicates that Vn and Vm are reversed. This is
  # the case for shifts. In the Arm ARM these insns are documented
@@ -XXX,XX +XXX,XX @@ VADDV            111 u:1 1110 1111 size:2 01 ... 0 1111 0 0 a:1 0 qm:3 0 rda=%rd
  # Predicate operations
  %mask_22_13      22:1 13:3
  VPST             1111 1110 0 . 11 000 1 ... 0 1111 0100 1101 mask=%mask_22_13
 +
 +# Logical immediate operations (1 reg and modified-immediate)
 +
 +# The cmode/op bits here decode VORR/VBIC/VMOV/VMVN, but
 +# not in a way we can conveniently represent in decodetree without
 +# a lot of repetition:
 +# VORR: op=0, (cmode & 1) && cmode < 12
 +# VBIC: op=1, (cmode & 1) && cmode < 12
 +# VMOV: everything else
 +# So we have a single decode line and check the cmode/op in the
 +# trans function.
 +Vimm_1r 111 . 1111 1 . 00 0 ... ... 0 .... 0 1 . 1 .... @1imm
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_1OP(vnegw, 4, int32_t, DO_NEG)
  DO_1OP(vfnegh, 8, uint64_t, DO_FNEGH)
  DO_1OP(vfnegs, 8, uint64_t, DO_FNEGS)
 +/*
 + * 1 operand immediates: Vda is destination and possibly also one source.
 + * All these insns work at 64-bit widths.
 + */
 +#define DO_1OP_IMM(OP, FN)                                              \
 +    void HELPER(mve_##OP)(CPUARMState *env, void *vda, uint64_t imm)    \
 +    {                                                                   \
 +        uint64_t *da = vda;                                             \
 +        uint16_t mask = mve_element_mask(env);                          \
 +        unsigned e;                                                     \
 +        for (e = 0; e < 16 / 8; e++, mask >>= 8) {                      \
 +            mergemask(&da[H8(e)], FN(da[H8(e)], imm), mask);            \
 +        }                                                               \
 +        mve_advance_vpt(env);                                           \
 +    }
 +
 +#define DO_MOVI(N, I) (I)
 +#define DO_ANDI(N, I) ((N) & (I))
 +#define DO_ORRI(N, I) ((N) | (I))
 +
 +DO_1OP_IMM(vmovi, DO_MOVI)
 +DO_1OP_IMM(vandi, DO_ANDI)
 +DO_1OP_IMM(vorri, DO_ORRI)
 +
  #define DO_2OP(OP, ESIZE, TYPE, FN)                                     \
      void HELPER(glue(mve_, OP))(CPUARMState *env,                       \
                                  void *vd, void *vn, void *vm)           \
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ typedef void MVEGenTwoOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void MVEGenTwoOpScalarFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void MVEGenDualAccOpFn(TCGv_i64, TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i64);
  typedef void MVEGenVADDVFn(TCGv_i32, TCGv_ptr, TCGv_ptr, TCGv_i32);
 +typedef void MVEGenOneOpImmFn(TCGv_ptr, TCGv_ptr, TCGv_i64);
  /* Return the offset of a Qn register (same semantics as aa32_vfp_qreg()) */
  static inline long mve_qreg_offset(unsigned reg)
@@ -XXX,XX +XXX,XX @@ static bool trans_VADDV(DisasContext *s, arg_VADDV *a)
      mve_update_eci(s);
      return true;
  }
 +
-+/*
++static bool do_1imm(DisasContext *s, arg_1imm *a, MVEGenOneOpImmFn *fn)
 + * Decode VLLDM and VLSTM are nonstandard because:
 + *  * if there is no FPU then these insns must NOP in
 + *    Secure state and UNDEF in Nonsecure state
 + *  * if there is an FPU then these insns do not have
 + *    the usual behaviour that vfp_access_check() provides of
 + *    being controlled by CPACR/NSACR enable bits or the
 + *    lazy-stacking logic.
 + */
 +static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
 +{
-+    TCGv_i32 fptr;
++    TCGv_ptr qd;
 +    uint64_t imm;
 +
-+    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
++    if (!dc_isar_feature(aa32_mve, s) ||
-+        !arm_dc_feature(s, ARM_FEATURE_V8)) {
++        !mve_check_qreg_bank(s, a->qd) ||
 +        !fn) {
 +        return false;
 +    }
-+    /* If not secure, UNDEF. */
++    if (!mve_eci_check(s) || !vfp_access_check(s)) {
 +    if (!s->v8m_secure) {
 +        return false;
 +    }
 +    /* If no fpu, NOP. */
 +    if (!dc_isar_feature(aa32_vfp, s)) {
 +        return true;
 +    }
 +
-+    fptr = load_reg(s, a->rn);
++    imm = asimd_imm_const(a->imm, a->cmode, a->op);
 +    if (a->l) {
 +        gen_helper_v7m_vlldm(cpu_env, fptr);
 +    } else {
 +        gen_helper_v7m_vlstm(cpu_env, fptr);
 +    }
 +    tcg_temp_free_i32(fptr);
 +
-+    /* End the TB, because we have updated FP control bits */
++    qd = mve_qreg_ptr(a->qd);
-+    s->base.is_jmp = DISAS_UPDATE;
++    fn(cpu_env, qd, tcg_constant_i64(imm));
 +    tcg_temp_free_ptr(qd);
 +    mve_update_eci(s);
 +    return true;
 +}
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
-                 goto illegal_op; /* op0 = 0b11 : unallocated */
-             }
--            /*
--             * Decode VLLDM and VLSTM first: these are nonstandard because:
--             *  * if there is no FPU then these insns must NOP in
--             *    Secure state and UNDEF in Nonsecure state
--             *  * if there is an FPU then these insns do not have
--             *    the usual behaviour that disas_vfp_insn() provides of
--             *    being controlled by CPACR/NSACR enable bits or the
--             *    lazy-stacking logic.
--             */
--            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
--                (insn & 0xffa00f00) == 0xec200a00) {
--                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
--                 *  - VLLDM, VLSTM
--                 * We choose to UNDEF if the RAZ bits are non-zero.
--                 */
--                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
-+            if (disas_vfp_insn(s, insn)) {
-+                if (((insn >> 8) & 0xe) == 10 &&
-+                    dc_isar_feature(aa32_fpsp_v2, s)) {
-+                    /* FP, and the CPU supports it */
-                     goto illegal_op;
-+                } else {
-+                    /* All other insns: NOCP */
-+                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-+                                       syn_uncategorized(),
-+                                       default_exception_el(s));
-                 }
--
--                if (arm_dc_feature(s, ARM_FEATURE_VFP)) {
--                    uint32_t rn = (insn >> 16) & 0xf;
--                    TCGv_i32 fptr = load_reg(s, rn);
--
--                    if (extract32(insn, 20, 1)) {
--                        gen_helper_v7m_vlldm(cpu_env, fptr);
--                    } else {
--                        gen_helper_v7m_vlstm(cpu_env, fptr);
--                    }
--                    tcg_temp_free_i32(fptr);
--
--                    /* End the TB, because we have updated FP control bits */
--                    s->base.is_jmp = DISAS_UPDATE;
--                }
--                break;
-             }
--            if (arm_dc_feature(s, ARM_FEATURE_VFP) &&
--                ((insn >> 8) & 0xe) == 10) {
--                /* FP, and the CPU supports it */
--                if (disas_vfp_insn(s, insn)) {
--                    goto illegal_op;
--                }
--                break;
--            }
--
--            /* All other insns: NOCP */
--            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
--                               default_exception_el(s));
-             break;
-         }
-         if ((insn & 0xfe000a00) == 0xfc000800
-diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/vfp.decode
-+++ b/target/arm/vfp.decode
-@@ -XXX,XX +XXX,XX @@ VCVT_sp_int  ---- 1110 1.11 110 s:1 .... 1010 rz:1 1.0 .... \
-              vd=%vd_sp vm=%vm_sp
- VCVT_dp_int  ---- 1110 1.11 110 s:1 .... 1011 rz:1 1.0 .... \
-              vd=%vd_sp vm=%vm_dp
 +
-+VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
++static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
 +{
 +    /* Handle decode of cmode/op here between VORR/VBIC/VMOV */
 +    MVEGenOneOpImmFn *fn;
 +
 +    if ((a->cmode & 1) && a->cmode < 12) {
 +        if (a->op) {
 +            /*
 +             * For op=1, the immediate will be inverted by asimd_imm_const(),
 +             * so the VBIC becomes a logical AND operation.
 +             */
 +            fn = gen_helper_mve_vandi;
 +        } else {
 +            fn = gen_helper_mve_vorri;
 +        }
 +    } else {
 +        /* There is one unallocated cmode/op combination in this space */
 +        if (a->cmode == 15 && a->op == 1) {
 +            return false;
 +        }
 +        /* asimd_imm_const() sorts out VMVNI vs VMOVI for us */
 +        fn = gen_helper_mve_vmovi;
 +    }
 +    return do_1imm(s, a, fn);
 +}
 --
 .20.1

-[PULL 33/33] hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2
+[PULL 13/24] target/arm: Implement MVE vector shift left by immediate insns
-In our KVM GICv2 realize function, we try to cope with old kernels
+Implement the MVE shift-vector-left-by-immediate insns VSHL, VQSHL
-that don't provide the device control API (KVM_CAP_DEVICE_CTRL): we
+and VQSHLU.
-try to use the device control, and if that fails we fall back to
-assuming that the kernel has the old style KVM_CREATE_IRQCHIP and
+The size-and-immediate encoding here is the same as Neon, and we
-that it will provide a GICv2.
+handle it the same way neon-dp.decode does.
 This doesn't cater for the possibility of a kernel and hardware which
 only provide a GICv3, which is very common now.  On that setup we
 will abort() later on in kvm_arm_pmu_set_irq() when we try to wire up
 an interrupt to the GIC we failed to create:
 qemu-system-aarch64: PMU: KVM_SET_DEVICE_ATTR: Invalid argument
 qemu-system-aarch64: failed to set irq for PMU
 Aborted
 If the kernel advertises KVM_CAP_DEVICE_CTRL we should trust it if it
 says it can't create a GICv2, rather than assuming it has one.  We
 can then produce a more helpful error message including a hint about
 the most probable reason for the failure.
 If the kernel doesn't advertise KVM_CAP_DEVICE_CTRL then it is truly
 ancient by this point but we might as well still fall back to a
 KVM_CREATE_IRQCHIP GICv2.
 With this patch then the user misconfiguration which previously
 caused an abort now prints:
 qemu-system-aarch64: Initialization of device kvm-arm-gic failed: error creating in-kernel VGIC: No such device
 Perhaps the host CPU does not support GICv2?
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20210628135835.6690-8-peter.maydell@linaro.org
 Tested-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20200225182435.1131-1-peter.maydell@linaro.org
 ---
- hw/intc/arm_gic_kvm.c | 9 +++++++++
+ target/arm/helper-mve.h    | 16 +++++++++++
-file changed, 9 insertions(+)
+ target/arm/mve.decode      | 23 +++++++++++++++
+ target/arm/mve_helper.c    | 57 ++++++++++++++++++++++++++++++++++++++
-diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
+ target/arm/translate-mve.c | 51 ++++++++++++++++++++++++++++++++++
-index XXXXXXX..XXXXXXX 100644
+files changed, 147 insertions(+)
---- a/hw/intc/arm_gic_kvm.c
-+++ b/hw/intc/arm_gic_kvm.c
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
+index XXXXXXX..XXXXXXX 100644
-                               KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
+--- a/target/arm/helper-mve.h
-                               &error_abort);
++++ b/target/arm/helper-mve.h
-         }
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_vaddvuw, TCG_CALL_NO_WG, i32, env, ptr, i32)
-+    } else if (kvm_check_extension(kvm_state, KVM_CAP_DEVICE_CTRL)) {
+ DEF_HELPER_FLAGS_3(mve_vmovi, TCG_CALL_NO_WG, void, env, ptr, i64)
-+        error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
+ DEF_HELPER_FLAGS_3(mve_vandi, TCG_CALL_NO_WG, void, env, ptr, i64)
-+        error_append_hint(errp,
+ DEF_HELPER_FLAGS_3(mve_vorri, TCG_CALL_NO_WG, void, env, ptr, i64)
-+                          "Perhaps the host CPU does not support GICv2?\n");
++
-     } else if (ret != -ENODEV && ret != -ENOTSUP) {
++DEF_HELPER_FLAGS_4(mve_vshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+        /*
++DEF_HELPER_FLAGS_4(mve_vshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+         * Very ancient kernel without KVM_CAP_DEVICE_CTRL: assume that
++DEF_HELPER_FLAGS_4(mve_vshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+         * ENODEV or ENOTSUP mean "can't create GICv2 with KVM_CREATE_DEVICE",
++
-+         * and that we will get a GICv2 via KVM_CREATE_IRQCHIP.
++DEF_HELPER_FLAGS_4(mve_vqshli_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+         */
++DEF_HELPER_FLAGS_4(mve_vqshli_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
++DEF_HELPER_FLAGS_4(mve_vqshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-         return;
++
 +DEF_HELPER_FLAGS_4(mve_vqshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vqshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vqshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +
 +DEF_HELPER_FLAGS_4(mve_vqshlui_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vqshlui_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vqshlui_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 diff --git a/target/arm/mve.decode b/target/arm/mve.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve.decode
 +++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@
  &2op qd qm qn size
  &2scalar qd qn rm size
  &1imm qd imm cmode op
 +&2shift qd qm shift size
  @vldr_vstr ....... . . . . l:1 rn:4 ... ...... imm:7 &vldr_vstr qd=%qd u=0
  # Note that both Rn and Qd are 3 bits only (no D bit)
@@ -XXX,XX +XXX,XX @@
  @2scalar .... .... .. size:2 .... .... .... .... rm:4 &2scalar qd=%qd qn=%qn
  @2scalar_nosz .... .... .... .... .... .... .... rm:4 &2scalar qd=%qd qn=%qn
 +@2_shl_b .... .... .. 001 shift:3 .... .... .... .... &2shift qd=%qd qm=%qm size=0
 +@2_shl_h .... .... .. 01  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
 +@2_shl_w .... .... .. 1   shift:5 .... .... .... .... &2shift qd=%qd qm=%qm size=2
 +
  # Vector loads and stores
  # Widening loads and narrowing stores:
@@ -XXX,XX +XXX,XX @@ VPST             1111 1110 0 . 11 000 1 ... 0 1111 0100 1101 mask=%mask_22_13
  # So we have a single decode line and check the cmode/op in the
  # trans function.
  Vimm_1r 111 . 1111 1 . 00 0 ... ... 0 .... 0 1 . 1 .... @1imm
 +
 +# Shifts by immediate
 +
 +VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_b
 +VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_h
 +VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_w
 +
 +VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_b
 +VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_h
 +VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_w
 +
 +VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_b
 +VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_h
 +VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_w
 +
 +VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_b
 +VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_h
 +VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_w
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_2OP_SAT(vqsubsw, 4, int32_t, DO_SQSUB_W)
      WRAP_QRSHL_HELPER(do_sqrshl_bhs, N, M, true, satp)
  #define DO_UQRSHL_OP(N, M, satp) \
      WRAP_QRSHL_HELPER(do_uqrshl_bhs, N, M, true, satp)
 +#define DO_SUQSHL_OP(N, M, satp) \
 +    WRAP_QRSHL_HELPER(do_suqrshl_bhs, N, M, false, satp)
  DO_2OP_SAT_S(vqshls, DO_SQSHL_OP)
  DO_2OP_SAT_U(vqshlu, DO_UQSHL_OP)
@@ -XXX,XX +XXX,XX @@ DO_VADDV(vaddvsw, 4, uint32_t)
  DO_VADDV(vaddvub, 1, uint8_t)
  DO_VADDV(vaddvuh, 2, uint16_t)
  DO_VADDV(vaddvuw, 4, uint32_t)
 +
 +/* Shifts by immediate */
 +#define DO_2SHIFT(OP, ESIZE, TYPE, FN)                          \
 +    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
 +                                void *vm, uint32_t shift)       \
 +    {                                                           \
 +        TYPE *d = vd, *m = vm;                                  \
 +        uint16_t mask = mve_element_mask(env);                  \
 +        unsigned e;                                             \
 +        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
 +            mergemask(&d[H##ESIZE(e)],                          \
 +                      FN(m[H##ESIZE(e)], shift), mask);         \
 +        }                                                       \
 +        mve_advance_vpt(env);                                   \
 +    }
 +
 +#define DO_2SHIFT_SAT(OP, ESIZE, TYPE, FN)                      \
 +    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
 +                                void *vm, uint32_t shift)       \
 +    {                                                           \
 +        TYPE *d = vd, *m = vm;                                  \
 +        uint16_t mask = mve_element_mask(env);                  \
 +        unsigned e;                                             \
 +        bool qc = false;                                        \
 +        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
 +            bool sat = false;                                   \
 +            mergemask(&d[H##ESIZE(e)],                          \
 +                      FN(m[H##ESIZE(e)], shift, &sat), mask);   \
 +            qc |= sat & mask & 1;                               \
 +        }                                                       \
 +        if (qc) {                                               \
 +            env->vfp.qc[0] = qc;                                \
 +        }                                                       \
 +        mve_advance_vpt(env);                                   \
 +    }
 +
 +/* provide unsigned 2-op shift helpers for all sizes */
 +#define DO_2SHIFT_U(OP, FN)                     \
 +    DO_2SHIFT(OP##b, 1, uint8_t, FN)            \
 +    DO_2SHIFT(OP##h, 2, uint16_t, FN)           \
 +    DO_2SHIFT(OP##w, 4, uint32_t, FN)
 +
 +#define DO_2SHIFT_SAT_U(OP, FN)                 \
 +    DO_2SHIFT_SAT(OP##b, 1, uint8_t, FN)        \
 +    DO_2SHIFT_SAT(OP##h, 2, uint16_t, FN)       \
 +    DO_2SHIFT_SAT(OP##w, 4, uint32_t, FN)
 +#define DO_2SHIFT_SAT_S(OP, FN)                 \
 +    DO_2SHIFT_SAT(OP##b, 1, int8_t, FN)         \
 +    DO_2SHIFT_SAT(OP##h, 2, int16_t, FN)        \
 +    DO_2SHIFT_SAT(OP##w, 4, int32_t, FN)
 +
 +DO_2SHIFT_U(vshli_u, DO_VSHLU)
 +DO_2SHIFT_SAT_U(vqshli_u, DO_UQSHL_OP)
 +DO_2SHIFT_SAT_S(vqshli_s, DO_SQSHL_OP)
 +DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ typedef void MVEGenLdStFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void MVEGenOneOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void MVEGenTwoOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void MVEGenTwoOpScalarFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32);
 +typedef void MVEGenTwoOpShiftFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void MVEGenDualAccOpFn(TCGv_i64, TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i64);
  typedef void MVEGenVADDVFn(TCGv_i32, TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void MVEGenOneOpImmFn(TCGv_ptr, TCGv_ptr, TCGv_i64);
@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
      }
+     return do_1imm(s, a, fn);
+ }
++
++static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
++                      bool negateshift)
++{
++    TCGv_ptr qd, qm;
++    int shift = a->shift;
++
++    if (!dc_isar_feature(aa32_mve, s) ||
++        !mve_check_qreg_bank(s, a->qd | a->qm) ||
++        !fn) {
++        return false;
++    }
++    if (!mve_eci_check(s) || !vfp_access_check(s)) {
++        return true;
++    }
++
++    /*
++     * When we handle a right shift insn using a left-shift helper
++     * which permits a negative shift count to indicate a right-shift,
++     * we must negate the shift count.
++     */
++    if (negateshift) {
++        shift = -shift;
++    }
++
++    qd = mve_qreg_ptr(a->qd);
++    qm = mve_qreg_ptr(a->qm);
++    fn(cpu_env, qd, qm, tcg_constant_i32(shift));
++    tcg_temp_free_ptr(qd);
++    tcg_temp_free_ptr(qm);
++    mve_update_eci(s);
++    return true;
++}
++
++#define DO_2SHIFT(INSN, FN, NEGATESHIFT)                         \
++    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
++    {                                                           \
++        static MVEGenTwoOpShiftFn * const fns[] = {             \
++            gen_helper_mve_##FN##b,                             \
++            gen_helper_mve_##FN##h,                             \
++            gen_helper_mve_##FN##w,                             \
++            NULL,                                               \
++        };                                                      \
++        return do_2shift(s, a, fns[a->size], NEGATESHIFT);      \
++    }
++
++DO_2SHIFT(VSHLI, vshli_u, false)
++DO_2SHIFT(VQSHLI_S, vqshli_s, false)
++DO_2SHIFT(VQSHLI_U, vqshli_u, false)
++DO_2SHIFT(VQSHLUI, vqshlui_s, false)
 --
 .20.1

-[PULL 21/33] target/arm: Split VFM decode
+[PULL 14/24] target/arm: Implement MVE vector shift right by immediate insns
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE vector shift right by immediate insns VSHRI and
 VRSHRI.  As with Neon, we implement these by using helper functions
 which perform left shifts but allow negative shift counts to indicate
 right shifts.
-Passing the raw o1 and o2 fields from the manual is less
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-instructive than it might be.  Do the full decode and let
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-the trans_* functions pass in booleans to a helper.
+Message-id: 20210628135835.6690-9-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h     | 12 ++++++++++++
  target/arm/translate.h      | 20 ++++++++++++++++++++
  target/arm/mve.decode       | 28 ++++++++++++++++++++++++++++
  target/arm/mve_helper.c     |  7 +++++++
  target/arm/translate-mve.c  |  5 +++++
  target/arm/translate-neon.c | 18 ------------------
 files changed, 72 insertions(+), 18 deletions(-)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 52 ++++++++++++++++++++++++++++++----
  target/arm/vfp.decode          | 17 +++++------
 files changed, 55 insertions(+), 14 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_vmovi, TCG_CALL_NO_WG, void, env, ptr, i64)
-     return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
+ DEF_HELPER_FLAGS_3(mve_vandi, TCG_CALL_NO_WG, void, env, ptr, i64)
  DEF_HELPER_FLAGS_3(mve_vorri, TCG_CALL_NO_WG, void, env, ptr, i64)
 +DEF_HELPER_FLAGS_4(mve_vshli_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vshli_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +
  DEF_HELPER_FLAGS_4(mve_vshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vqshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vqshlui_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vqshlui_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vqshlui_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +
 +DEF_HELPER_FLAGS_4(mve_vrshli_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshli_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +
 +DEF_HELPER_FLAGS_4(mve_vrshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline int times_2_plus_1(DisasContext *s, int x)
      return x * 2 + 1;
  }
--static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
++static inline int rsub_64(DisasContext *s, int x)
 +static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
  {
      /*
       * VFNMA : fd = muladd(-fd,  fn, fm)
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
      neon_load_reg32(vn, a->vn);
      neon_load_reg32(vm, a->vm);
 -    if (a->o2) {
 +    if (neg_n) {
          /* VFNMS, VFMS */
          gen_helper_vfp_negs(vn, vn);
      }
      neon_load_reg32(vd, a->vd);
 -    if (a->o1 & 1) {
 +    if (neg_d) {
          /* VFNMA, VFNMS */
          gen_helper_vfp_negs(vd, vd);
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
      return true;
  }
 -static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 +static bool trans_VFMA_sp(DisasContext *s, arg_VFMA_sp *a)
 +{
-+    return do_vfm_sp(s, a, false, false);
++    return 64 - x;
 +}
 +
-+static bool trans_VFMS_sp(DisasContext *s, arg_VFMS_sp *a)
++static inline int rsub_32(DisasContext *s, int x)
 +{
-+    return do_vfm_sp(s, a, true, false);
++    return 32 - x;
 +}
 +
-+static bool trans_VFNMA_sp(DisasContext *s, arg_VFNMA_sp *a)
++static inline int rsub_16(DisasContext *s, int x)
 +{
-+    return do_vfm_sp(s, a, false, true);
++    return 16 - x;
 +}
 +
-+static bool trans_VFNMS_sp(DisasContext *s, arg_VFNMS_sp *a)
++static inline int rsub_8(DisasContext *s, int x)
 +{
-+    return do_vfm_sp(s, a, true, true);
++    return 8 - x;
 +}
 +
-+static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
+ static inline int arm_dc_feature(DisasContext *dc, int feature)
  {
-     /*
+     return (dc->features & (1ULL << feature)) != 0;
-      * VFNMA : fd = muladd(-fd,  fn, fm)
+diff --git a/target/arm/mve.decode b/target/arm/mve.decode
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/mve.decode
-     neon_load_reg64(vn, a->vn);
++++ b/target/arm/mve.decode
-     neon_load_reg64(vm, a->vm);
+@@ -XXX,XX +XXX,XX @@
--    if (a->o2) {
+ @2_shl_h .... .... .. 01  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
-+    if (neg_n) {
+ @2_shl_w .... .... .. 1   shift:5 .... .... .... .... &2shift qd=%qd qm=%qm size=2
-         /* VFNMS, VFMS */
-         gen_helper_vfp_negd(vn, vn);
++# Right shifts are encoded as N - shift, where N is the element size in bits.
-     }
++%rshift_i5  16:5 !function=rsub_32
-     neon_load_reg64(vd, a->vd);
++%rshift_i4  16:4 !function=rsub_16
--    if (a->o1 & 1) {
++%rshift_i3  16:3 !function=rsub_8
-+    if (neg_d) {
++
-         /* VFNMA, VFNMS */
++@2_shr_b .... .... .. 001 ... .... .... .... .... &2shift qd=%qd qm=%qm \
-         gen_helper_vfp_negd(vd, vd);
++         size=0 shift=%rshift_i3
-     }
++@2_shr_h .... .... .. 01 .... .... .... .... .... &2shift qd=%qd qm=%qm \
-@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
++         size=1 shift=%rshift_i4
-     return true;
++@2_shr_w .... .... .. 1 ..... .... .... .... .... &2shift qd=%qd qm=%qm \
 +         size=2 shift=%rshift_i5
 +
  # Vector loads and stores
  # Widening loads and narrowing stores:
@@ -XXX,XX +XXX,XX @@ VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_w
  VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_b
  VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_h
  VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_w
 +
 +VSHRI_S           111 0 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_b
 +VSHRI_S           111 0 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_h
 +VSHRI_S           111 0 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_w
 +
 +VSHRI_U           111 1 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_b
 +VSHRI_U           111 1 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_h
 +VSHRI_U           111 1 1111 1 . ... ... ... 0 0000 0 1 . 1 ... 0 @2_shr_w
 +
 +VRSHRI_S          111 0 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_b
 +VRSHRI_S          111 0 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_h
 +VRSHRI_S          111 0 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
 +
 +VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_b
 +VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_h
 +VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VADDV(vaddvuw, 4, uint32_t)
      DO_2SHIFT(OP##b, 1, uint8_t, FN)            \
      DO_2SHIFT(OP##h, 2, uint16_t, FN)           \
      DO_2SHIFT(OP##w, 4, uint32_t, FN)
 +#define DO_2SHIFT_S(OP, FN)                     \
 +    DO_2SHIFT(OP##b, 1, int8_t, FN)             \
 +    DO_2SHIFT(OP##h, 2, int16_t, FN)            \
 +    DO_2SHIFT(OP##w, 4, int32_t, FN)
  #define DO_2SHIFT_SAT_U(OP, FN)                 \
      DO_2SHIFT_SAT(OP##b, 1, uint8_t, FN)        \
@@ -XXX,XX +XXX,XX @@ DO_VADDV(vaddvuw, 4, uint32_t)
      DO_2SHIFT_SAT(OP##w, 4, int32_t, FN)
  DO_2SHIFT_U(vshli_u, DO_VSHLU)
 +DO_2SHIFT_S(vshli_s, DO_VSHLS)
  DO_2SHIFT_SAT_U(vqshli_u, DO_UQSHL_OP)
  DO_2SHIFT_SAT_S(vqshli_s, DO_SQSHL_OP)
  DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
 +DO_2SHIFT_U(vrshli_u, DO_VRSHLU)
 +DO_2SHIFT_S(vrshli_s, DO_VRSHLS)
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT(VSHLI, vshli_u, false)
  DO_2SHIFT(VQSHLI_S, vqshli_s, false)
  DO_2SHIFT(VQSHLI_U, vqshli_u, false)
  DO_2SHIFT(VQSHLUI, vqshlui_s, false)
 +/* These right shifts use a left-shift helper with negated shift count */
 +DO_2SHIFT(VSHRI_S, vshli_s, true)
 +DO_2SHIFT(VSHRI_U, vshli_u, true)
 +DO_2SHIFT(VRSHRI_S, vrshli_s, true)
 +DO_2SHIFT(VRSHRI_U, vrshli_u, true)
 diff --git a/target/arm/translate-neon.c b/target/arm/translate-neon.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c
 +++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@ static inline int plus1(DisasContext *s, int x)
      return x + 1;
  }
-+static bool trans_VFMA_dp(DisasContext *s, arg_VFMA_dp *a)
+-static inline int rsub_64(DisasContext *s, int x)
-+{
+-{
-+    return do_vfm_dp(s, a, false, false);
+-    return 64 - x;
-+}
+-}
-+
+-
-+static bool trans_VFMS_dp(DisasContext *s, arg_VFMS_dp *a)
+-static inline int rsub_32(DisasContext *s, int x)
-+{
+-{
-+    return do_vfm_dp(s, a, true, false);
+-    return 32 - x;
-+}
+-}
-+
+-static inline int rsub_16(DisasContext *s, int x)
-+static bool trans_VFNMA_dp(DisasContext *s, arg_VFNMA_dp *a)
+-{
-+{
+-    return 16 - x;
-+    return do_vfm_dp(s, a, false, true);
+-}
-+}
+-static inline int rsub_8(DisasContext *s, int x)
-+
+-{
-+static bool trans_VFNMS_dp(DisasContext *s, arg_VFNMS_dp *a)
+-    return 8 - x;
-+{
+-}
-+    return do_vfm_dp(s, a, true, true);
+-
-+}
+ static inline int neon_3same_fp_size(DisasContext *s, int x)
 +
  static bool trans_VMOV_imm_sp(DisasContext *s, arg_VMOV_imm_sp *a)
  {
-     uint32_t delta_d = 0;
+     /* Convert 0==fp32, 1==fp16 into a MO_* value */
 diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp.decode
 +++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@ VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
  VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
  VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 -VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
 -VFM_dp       ---- 1110 1.01 .... .... 1011 . o2:1 . 0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=1
 -VFM_sp       ---- 1110 1.10 .... .... 1010 . o2:1 . 0 .... \
 -             vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=2
 -VFM_dp       ---- 1110 1.10 .... .... 1011 . o2:1 . 0 .... \
 -             vm=%vm_dp vn=%vn_dp vd=%vd_dp o1=2
 +VFMA_sp      ---- 1110 1.10 .... .... 1010 .0. 0 ....       @vfp_dnm_s
 +VFMS_sp      ---- 1110 1.10 .... .... 1010 .1. 0 ....       @vfp_dnm_s
 +VFNMA_sp     ---- 1110 1.01 .... .... 1010 .0. 0 ....       @vfp_dnm_s
 +VFNMS_sp     ---- 1110 1.01 .... .... 1010 .1. 0 ....       @vfp_dnm_s
 +
 +VFMA_dp      ---- 1110 1.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
 +VFMS_dp      ---- 1110 1.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
 +VFNMA_dp     ---- 1110 1.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
 +VFNMS_dp     ---- 1110 1.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
  VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
               vd=%vd_sp imm=%vmov_imm
 --
 .20.1

-[PULL 32/33] target/arm: Implement ARMv8.3-CCIDX
+[PULL 15/24] target/arm: Implement MVE VSHLL
-The ARMv8.3-CCIDX extension makes the CCSIDR_EL1 system ID registers
+Implement the MVE VHLL (vector shift left long) insn.  This has two
-have a format that uses the full 64 bit width of the register, and
+encodings: the T1 encoding is the usual shift-by-immediate format,
-adds a new CCSIDR2 register so AArch32 can get at the high 32 bits.
+and the T2 encoding is a special case where the shift count is always
+equal to the element size.
 QEMU doesn't implement caches, so we just treat these ID registers as
 opaque values that are set to the correct constant values for each
 CPU.  The only thing we need to do is allow 64-bit values in our
 cssidr[] array and provide the CCSIDR2 accessors.
 We don't set the CCIDX field in our 'max' CPU because the CCSIDR
 constant values we use are the same as the ones used by the
 Cortex-A57 and they are in the old 32-bit format. This means
 that the extra regdef added here is unused currently, but it
 means that whenever in the future we add a CPU that does need
 the new 64-bit format it will just work when we set the cssidr
 values and the ID registers for it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224182626.29252-1-peter.maydell@linaro.org
+Message-id: 20210628135835.6690-10-peter.maydell@linaro.org
 ---
- target/arm/cpu.h    | 17 ++++++++++++++++-
+ target/arm/helper-mve.h    |  9 +++++++
- target/arm/helper.c | 19 +++++++++++++++++++
+ target/arm/mve.decode      | 53 +++++++++++++++++++++++++++++++++++---
-files changed, 35 insertions(+), 1 deletion(-)
+ target/arm/mve_helper.c    | 32 +++++++++++++++++++++++
  target/arm/translate-mve.c | 15 +++++++++++
 files changed, 105 insertions(+), 4 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vrshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     /* The elements of this array are the CCSIDR values for each cache,
+ DEF_HELPER_FLAGS_4(mve_vrshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
+ DEF_HELPER_FLAGS_4(mve_vrshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-      */
+ DEF_HELPER_FLAGS_4(mve_vrshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
--    uint32_t ccsidr[16];
++
-+    uint64_t ccsidr[16];
++DEF_HELPER_FLAGS_4(mve_vshllbsb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     uint64_t reset_cbar;
++DEF_HELPER_FLAGS_4(mve_vshllbsh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     uint32_t reset_auxcr;
++DEF_HELPER_FLAGS_4(mve_vshllbub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     bool reset_hivecs;
++DEF_HELPER_FLAGS_4(mve_vshllbuh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ac2(const ARMISARegisters *id)
++DEF_HELPER_FLAGS_4(mve_vshlltsb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     return FIELD_EX32(id->id_mmfr4, ID_MMFR4, AC2) != 0;
++DEF_HELPER_FLAGS_4(mve_vshlltsh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- }
++DEF_HELPER_FLAGS_4(mve_vshlltub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(mve_vshlltuh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
+diff --git a/target/arm/mve.decode b/target/arm/mve.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve.decode
 +++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@
  @2_shl_h .... .... .. 01  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
  @2_shl_w .... .... .. 1   shift:5 .... .... .... .... &2shift qd=%qd qm=%qm size=2
 +@2_shll_b .... .... ... 01 shift:3 .... .... .... .... &2shift qd=%qd qm=%qm size=0
 +@2_shll_h .... .... ... 1  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
 +# VSHLL encoding T2 where shift == esize
 +@2_shll_esize_b .... .... .... 00 .. .... .... .... .... &2shift \
 +                qd=%qd qm=%qm size=0 shift=8
 +@2_shll_esize_h .... .... .... 01 .. .... .... .... .... &2shift \
 +                qd=%qd qm=%qm size=1 shift=16
 +
  # Right shifts are encoded as N - shift, where N is the element size in bits.
  %rshift_i5  16:5 !function=rsub_32
  %rshift_i4  16:4 !function=rsub_16
@@ -XXX,XX +XXX,XX @@ VADD             1110 1111 0 . .. ... 0 ... 0 1000 . 1 . 0 ... 0 @2op
  VSUB             1111 1111 0 . .. ... 0 ... 0 1000 . 1 . 0 ... 0 @2op
  VMUL             1110 1111 0 . .. ... 0 ... 0 1001 . 1 . 1 ... 0 @2op
 -VMULH_S          111 0 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
 -VMULH_U          111 1 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
 +# The VSHLL T2 encoding is not a @2op pattern, but is here because it
 +# overlaps what would be size=0b11 VMULH/VRMULH
 +{
-+    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
++  VSHLL_BS       111 0 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_b
 +  VSHLL_BS       111 0 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_h
 -VRMULH_S         111 0 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
 -VRMULH_U         111 1 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
 +  VMULH_S        111 0 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
 +}
 +
- /*
-  * 64-bit feature tests via id registers.
-  */
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
-     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
- }
-+static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
 +{
-+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
++  VSHLL_BU       111 1 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_b
 +  VSHLL_BU       111 1 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_h
 +
 +  VMULH_U        111 1 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
 +}
 +
- /*
-  * Feature tests for "does this exist in either 32-bit or 64-bit?"
-  */
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_pmu_8_4(const ARMISARegisters *id)
-     return isar_feature_aa64_pmu_8_4(id) || isar_feature_aa32_pmu_8_4(id);
- }
-+static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
 +{
-+    return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
++  VSHLL_TS       111 0 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_b
 +  VSHLL_TS       111 0 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_h
 +
 +  VRMULH_S       111 0 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
 +}
 +
- /*
++{
-  * Forward to the above feature tests given an ARMCPU pointer.
++  VSHLL_TU       111 1 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_b
-  */
++  VSHLL_TU       111 1 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_h
-diff --git a/target/arm/helper.c b/target/arm/helper.c
++
 +  VRMULH_U       111 1 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
 +}
  VMAX_S           111 0 1111 0 . .. ... 0 ... 0 0110 . 1 . 0 ... 0 @2op
  VMAX_U           111 1 1111 0 . .. ... 0 ... 0 0110 . 1 . 0 ... 0 @2op
@@ -XXX,XX +XXX,XX @@ VRSHRI_S          111 0 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
  VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_b
  VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_h
  VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
 +
 +# VSHLL T1 encoding; the T2 VSHLL encoding is elsewhere in this file
 +VSHLL_BS          111 0 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_b
 +VSHLL_BS          111 0 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_h
 +
 +VSHLL_BU          111 1 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_b
 +VSHLL_BU          111 1 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_h
 +
 +VSHLL_TS          111 0 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_b
 +VSHLL_TS          111 0 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
 +
 +VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_b
 +VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/mve_helper.c
-+++ b/target/arm/helper.c
++++ b/target/arm/mve_helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_SAT_S(vqshli_s, DO_SQSHL_OP)
-     REGINFO_SENTINEL
+ DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
- };
+ DO_2SHIFT_U(vrshli_u, DO_VRSHLU)
+ DO_2SHIFT_S(vrshli_s, DO_VRSHLS)
 +static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
 +{
 +    /* Read the high 32 bits of the current CCSIDR */
 +    return extract64(ccsidr_read(env, ri), 32, 32);
 +}
 +
-+static const ARMCPRegInfo ccsidr2_reginfo[] = {
++/*
-+    { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH,
++ * Long shifts taking half-sized inputs from top or bottom of the input
-+      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2,
++ * vector and producing a double-width result. ESIZE, TYPE are for
-+      .access = PL1_R,
++ * the input, and LESIZE, LTYPE for the output.
-+      .accessfn = access_aa64_tid2,
++ * Unlike the normal shift helpers, we do not handle negative shift counts,
-+      .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
++ * because the long shift is strictly left-only.
-+    REGINFO_SENTINEL
++ */
-+};
++#define DO_VSHLL(OP, TOP, ESIZE, TYPE, LESIZE, LTYPE)                   \
-+
++    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,             \
- static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
++                                void *vm, uint32_t shift)               \
-                                        bool isread)
++    {                                                                   \
- {
++        LTYPE *d = vd;                                                  \
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
++        TYPE *m = vm;                                                   \
-         define_arm_cp_regs(cpu, predinv_reginfo);
++        uint16_t mask = mve_element_mask(env);                          \
-     }
++        unsigned le;                                                    \
++        assert(shift <= 16);                                            \
-+    if (cpu_isar_feature(any_ccidx, cpu)) {
++        for (le = 0; le < 16 / LESIZE; le++, mask >>= LESIZE) {         \
-+        define_arm_cp_regs(cpu, ccsidr2_reginfo);
++            LTYPE r = (LTYPE)m[H##ESIZE(le * 2 + TOP)] << shift;        \
 +            mergemask(&d[H##LESIZE(le)], r, mask);                      \
 +        }                                                               \
 +        mve_advance_vpt(env);                                           \
 +    }
 +
- #ifndef CONFIG_USER_ONLY
++#define DO_VSHLL_ALL(OP, TOP)                                \
-     /*
++    DO_VSHLL(OP##sb, TOP, 1, int8_t, 2, int16_t)             \
-      * Register redirections and aliases must be done last,
++    DO_VSHLL(OP##ub, TOP, 1, uint8_t, 2, uint16_t)           \
 +    DO_VSHLL(OP##sh, TOP, 2, int16_t, 4, int32_t)            \
 +    DO_VSHLL(OP##uh, TOP, 2, uint16_t, 4, uint32_t)          \
 +
 +DO_VSHLL_ALL(vshllb, false)
 +DO_VSHLL_ALL(vshllt, true)
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT(VSHRI_S, vshli_s, true)
  DO_2SHIFT(VSHRI_U, vshli_u, true)
  DO_2SHIFT(VRSHRI_S, vrshli_s, true)
  DO_2SHIFT(VRSHRI_U, vrshli_u, true)
 +
 +#define DO_VSHLL(INSN, FN)                                      \
 +    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
 +    {                                                           \
 +        static MVEGenTwoOpShiftFn * const fns[] = {             \
 +            gen_helper_mve_##FN##b,                             \
 +            gen_helper_mve_##FN##h,                             \
 +        };                                                      \
 +        return do_2shift(s, a, fns[a->size], false);            \
 +    }
 +
 +DO_VSHLL(VSHLL_BS, vshllbs)
 +DO_VSHLL(VSHLL_BU, vshllbu)
 +DO_VSHLL(VSHLL_TS, vshllts)
 +DO_VSHLL(VSHLL_TU, vshlltu)
 --
 .20.1

-[PULL 29/33] target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
+[PULL 16/24] target/arm: Implement MVE VSRI, VSLI
-We missed an instance of using FIELD_EX32 on a 64-bit ID
+Implement the MVE VSRI and VSLI insns, which perform a
-register, in isar_feature_aa64_pmu_8_4(). Fix it.
+shift-and-insert operation.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224172846.13053-2-peter.maydell@linaro.org
+Message-id: 20210628135835.6690-11-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 4 ++--
+ target/arm/helper-mve.h    |  8 ++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/mve.decode      |  9 ++++++++
  target/arm/mve_helper.c    | 42 ++++++++++++++++++++++++++++++++++++++
  target/arm/translate-mve.c |  3 +++
 files changed, 62 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_1(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vshlltsb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(mve_vshlltsh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
+ DEF_HELPER_FLAGS_4(mve_vshlltub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- {
+ DEF_HELPER_FLAGS_4(mve_vshlltuh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
--    return FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
++
--        FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
++DEF_HELPER_FLAGS_4(mve_vsrib, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
++DEF_HELPER_FLAGS_4(mve_vsrih, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
++DEF_HELPER_FLAGS_4(mve_vsriw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- }
++
++DEF_HELPER_FLAGS_4(mve_vslib, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vslih, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vsliw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 diff --git a/target/arm/mve.decode b/target/arm/mve.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve.decode
 +++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@ VSHLL_TS          111 0 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
  VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_b
  VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
 +
 +# Shift-and-insert
 +VSRI              111 1 1111 1 . ... ... ... 0 0100 0 1 . 1 ... 0 @2_shr_b
 +VSRI              111 1 1111 1 . ... ... ... 0 0100 0 1 . 1 ... 0 @2_shr_h
 +VSRI              111 1 1111 1 . ... ... ... 0 0100 0 1 . 1 ... 0 @2_shr_w
 +
 +VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_b
 +VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_h
 +VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_w
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
  DO_2SHIFT_U(vrshli_u, DO_VRSHLU)
  DO_2SHIFT_S(vrshli_s, DO_VRSHLS)
 +/* Shift-and-insert; we always work with 64 bits at a time */
 +#define DO_2SHIFT_INSERT(OP, ESIZE, SHIFTFN, MASKFN)                    \
 +    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,             \
 +                                void *vm, uint32_t shift)               \
 +    {                                                                   \
 +        uint64_t *d = vd, *m = vm;                                      \
 +        uint16_t mask;                                                  \
 +        uint64_t shiftmask;                                             \
 +        unsigned e;                                                     \
 +        if (shift == 0 || shift == ESIZE * 8) {                         \
 +            /*                                                          \
 +             * Only VSLI can shift by 0; only VSRI can shift by <dt>.   \
 +             * The generic logic would give the right answer for 0 but  \
 +             * fails for <dt>.                                          \
 +             */                                                         \
 +            goto done;                                                  \
 +        }                                                               \
 +        assert(shift < ESIZE * 8);                                      \
 +        mask = mve_element_mask(env);                                   \
 +        /* ESIZE / 2 gives the MO_* value if ESIZE is in [1,2,4] */     \
 +        shiftmask = dup_const(ESIZE / 2, MASKFN(ESIZE * 8, shift));     \
 +        for (e = 0; e < 16 / 8; e++, mask >>= 8) {                      \
 +            uint64_t r = (SHIFTFN(m[H8(e)], shift) & shiftmask) |       \
 +                (d[H8(e)] & ~shiftmask);                                \
 +            mergemask(&d[H8(e)], r, mask);                              \
 +        }                                                               \
 +done:                                                                   \
 +        mve_advance_vpt(env);                                           \
 +    }
 +
 +#define DO_SHL(N, SHIFT) ((N) << (SHIFT))
 +#define DO_SHR(N, SHIFT) ((N) >> (SHIFT))
 +#define SHL_MASK(EBITS, SHIFT) MAKE_64BIT_MASK((SHIFT), (EBITS) - (SHIFT))
 +#define SHR_MASK(EBITS, SHIFT) MAKE_64BIT_MASK(0, (EBITS) - (SHIFT))
 +
 +DO_2SHIFT_INSERT(vsrib, 1, DO_SHR, SHR_MASK)
 +DO_2SHIFT_INSERT(vsrih, 2, DO_SHR, SHR_MASK)
 +DO_2SHIFT_INSERT(vsriw, 4, DO_SHR, SHR_MASK)
 +DO_2SHIFT_INSERT(vslib, 1, DO_SHL, SHL_MASK)
 +DO_2SHIFT_INSERT(vslih, 2, DO_SHL, SHL_MASK)
 +DO_2SHIFT_INSERT(vsliw, 4, DO_SHL, SHL_MASK)
 +
  /*
+  * Long shifts taking half-sized inputs from top or bottom of the input
+  * vector and producing a double-width result. ESIZE, TYPE are for
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-mve.c
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ DO_2SHIFT(VSHRI_U, vshli_u, true)
+ DO_2SHIFT(VRSHRI_S, vrshli_s, true)
+ DO_2SHIFT(VRSHRI_U, vrshli_u, true)
++DO_2SHIFT(VSRI, vsri, false)
++DO_2SHIFT(VSLI, vsli, false)
++
+ #define DO_VSHLL(INSN, FN)                                      \
+     static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
+     {                                                           \
 --
 .20.1

-[PULL 04/33] arm_gic: Mask the un-supported priority bits
+[PULL 17/24] target/arm: Implement MVE VSHRN, VRSHRN
-From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Implement the MVE shift-right-and-narrow insn VSHRN and VRSHRN.
-The GICv2 allows the implementation to implement a variable number
+do_urshr() is borrowed from sve_helper.c.
 of priority bits; unimplemented bits in the priority registers
 are read as zeros, writes ignored. We were previously always
 implementing a full 8 bits of priority, which is allowed but not
 what the real hardware typically does (which is usually to have
 or 5 bits of priority).
-Add a new device property to allow the number of implemented
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-property bits to be specified.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210628135835.6690-12-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h    | 10 ++++++++++
  target/arm/mve.decode      | 11 +++++++++++
  target/arm/mve_helper.c    | 40 ++++++++++++++++++++++++++++++++++++++
  target/arm/translate-mve.c | 15 ++++++++++++++
 files changed, 76 insertions(+)
-Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Message-id: 1582537164-764-2-git-send-email-sai.pavan.boddu@xilinx.com
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: improved commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/intc/arm_gic.h        |  2 ++
  include/hw/intc/arm_gic_common.h |  1 +
  hw/intc/arm_gic.c                | 33 ++++++++++++++++++++++++++++++--
  hw/intc/arm_gic_common.c         |  1 +
 files changed, 35 insertions(+), 2 deletions(-)
 diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gic.h
+--- a/target/arm/helper-mve.h
-+++ b/include/hw/intc/arm_gic.h
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vsriw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(mve_vslib, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- /* Number of SGI target-list bits */
+ DEF_HELPER_FLAGS_4(mve_vslih, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- #define GIC_TARGETLIST_BITS 8
+ DEF_HELPER_FLAGS_4(mve_vsliw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+#define GIC_MAX_PRIORITY_BITS 8
++
-+#define GIC_MIN_PRIORITY_BITS 4
++DEF_HELPER_FLAGS_4(mve_vshrnbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(mve_vshrnbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- #define TYPE_ARM_GIC "arm_gic"
++DEF_HELPER_FLAGS_4(mve_vshrntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- #define ARM_GIC(obj) \
++DEF_HELPER_FLAGS_4(mve_vshrnth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-diff --git a/include/hw/intc/arm_gic_common.h b/include/hw/intc/arm_gic_common.h
++
 +DEF_HELPER_FLAGS_4(mve_vrshrnbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshrnbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshrntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 +DEF_HELPER_FLAGS_4(mve_vrshrnth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 diff --git a/target/arm/mve.decode b/target/arm/mve.decode
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gic_common.h
+--- a/target/arm/mve.decode
-+++ b/include/hw/intc/arm_gic_common.h
++++ b/target/arm/mve.decode
-@@ -XXX,XX +XXX,XX @@ typedef struct GICState {
+@@ -XXX,XX +XXX,XX @@ VSRI              111 1 1111 1 . ... ... ... 0 0100 0 1 . 1 ... 0 @2_shr_w
-     uint16_t priority_mask[GIC_NCPU_VCPU];
+ VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_b
-     uint16_t running_priority[GIC_NCPU_VCPU];
+ VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_h
-     uint16_t current_pending[GIC_NCPU_VCPU];
+ VSLI              111 1 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_w
-+    uint32_t n_prio_bits;
++
++# Narrowing shifts (which only support b and h sizes)
-     /* If we present the GICv2 without security extensions to a guest,
++VSHRNB            111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_b
-      * the guest can configure the GICC_CTLR to configure group 1 binary point
++VSHRNB            111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_h
-diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
++VSHRNT            111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_b
 +VSHRNT            111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_h
 +
 +VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_b
 +VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_h
 +VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_b
 +VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_h
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gic.c
+--- a/target/arm/mve_helper.c
-+++ b/hw/intc/arm_gic.c
++++ b/target/arm/mve_helper.c
-@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
+@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_INSERT(vsliw, 4, DO_SHL, SHL_MASK)
-     return ret;
- }
+ DO_VSHLL_ALL(vshllb, false)
+ DO_VSHLL_ALL(vshllt, true)
-+static uint32_t gic_fullprio_mask(GICState *s, int cpu)
++
 +/*
 + * Narrowing right shifts, taking a double sized input, shifting it
 + * and putting the result in either the top or bottom half of the output.
 + * ESIZE, TYPE are the output, and LESIZE, LTYPE the input.
 + */
 +#define DO_VSHRN(OP, TOP, ESIZE, TYPE, LESIZE, LTYPE, FN)       \
 +    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
 +                                void *vm, uint32_t shift)       \
 +    {                                                           \
 +        LTYPE *m = vm;                                          \
 +        TYPE *d = vd;                                           \
 +        uint16_t mask = mve_element_mask(env);                  \
 +        unsigned le;                                            \
 +        for (le = 0; le < 16 / LESIZE; le++, mask >>= LESIZE) { \
 +            TYPE r = FN(m[H##LESIZE(le)], shift);               \
 +            mergemask(&d[H##ESIZE(le * 2 + TOP)], r, mask);     \
 +        }                                                       \
 +        mve_advance_vpt(env);                                   \
 +    }
 +
 +#define DO_VSHRN_ALL(OP, FN)                                    \
 +    DO_VSHRN(OP##bb, false, 1, uint8_t, 2, uint16_t, FN)        \
 +    DO_VSHRN(OP##bh, false, 2, uint16_t, 4, uint32_t, FN)       \
 +    DO_VSHRN(OP##tb, true, 1, uint8_t, 2, uint16_t, FN)         \
 +    DO_VSHRN(OP##th, true, 2, uint16_t, 4, uint32_t, FN)
 +
 +static inline uint64_t do_urshr(uint64_t x, unsigned sh)
 +{
-+    /*
++    if (likely(sh < 64)) {
-+     * Return a mask word which clears the unimplemented priority
++        return (x >> sh) + ((x >> (sh - 1)) & 1);
-+     * bits from a priority value for an interrupt. (Not to be
++    } else if (sh == 64) {
-+     * confused with the group priority, whose mask depends on BPR.)
++        return x >> 63;
 +     */
 +    int priBits;
 +
 +    if (gic_is_vcpu(cpu)) {
 +        priBits = GIC_VIRT_MAX_GROUP_PRIO_BITS;
 +    } else {
-+        priBits = s->n_prio_bits;
++        return 0;
 +    }
-+    return ~0U << (8 - priBits);
 +}
 +
- void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
++DO_VSHRN_ALL(vshrn, DO_SHR)
-                       MemTxAttrs attrs)
++DO_VSHRN_ALL(vrshrn, do_urshr)
- {
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
-@@ -XXX,XX +XXX,XX @@ void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
+index XXXXXXX..XXXXXXX 100644
-         val = 0x80 | (val >> 1); /* Non-secure view */
+--- a/target/arm/translate-mve.c
-     }
++++ b/target/arm/translate-mve.c
+@@ -XXX,XX +XXX,XX @@ DO_VSHLL(VSHLL_BS, vshllbs)
-+    val &= gic_fullprio_mask(s, cpu);
+ DO_VSHLL(VSHLL_BU, vshllbu)
  DO_VSHLL(VSHLL_TS, vshllts)
  DO_VSHLL(VSHLL_TU, vshlltu)
 +
-     if (irq < GIC_INTERNAL) {
++#define DO_2SHIFT_N(INSN, FN)                                   \
-         s->priority1[irq][cpu] = val;
++    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
-     } else {
++    {                                                           \
-@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_get_priority(GICState *s, int cpu, int irq,
++        static MVEGenTwoOpShiftFn * const fns[] = {             \
-         }
++            gen_helper_mve_##FN##b,                             \
-         prio = (prio << 1) & 0xff; /* Non-secure view */
++            gen_helper_mve_##FN##h,                             \
-     }
++        };                                                      \
--    return prio;
++        return do_2shift(s, a, fns[a->size], false);            \
 +    return prio & gic_fullprio_mask(s, cpu);
  }
  static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
@@ -XXX,XX +XXX,XX @@ static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
              return;
          }
      }
 -    s->priority_mask[cpu] = pmask;
 +    s->priority_mask[cpu] = pmask & gic_fullprio_mask(s, cpu);
  }
  static uint32_t gic_get_priority_mask(GICState *s, int cpu, MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
          return;
      }
 +    if (s->n_prio_bits > GIC_MAX_PRIORITY_BITS ||
 +       (s->virt_extn ? s->n_prio_bits < GIC_VIRT_MAX_GROUP_PRIO_BITS :
 +        s->n_prio_bits < GIC_MIN_PRIORITY_BITS)) {
 +        error_setg(errp, "num-priority-bits cannot be greater than %d"
 +                   " or less than %d", GIC_MAX_PRIORITY_BITS,
 +                   s->virt_extn ? GIC_VIRT_MAX_GROUP_PRIO_BITS :
 +                   GIC_MIN_PRIORITY_BITS);
 +        return;
 +    }
 +
-     /* This creates distributor, main CPU interface (s->cpuiomem[0]) and if
++DO_2SHIFT_N(VSHRNB, vshrnb)
-      * enabled, virtualization extensions related interfaces (main virtual
++DO_2SHIFT_N(VSHRNT, vshrnt)
-      * interface (s->vifaceiomem[0]) and virtual CPU interface).
++DO_2SHIFT_N(VRSHRNB, vrshrnb)
-diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
++DO_2SHIFT_N(VRSHRNT, vrshrnt)
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gic_common.c
 +++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
      DEFINE_PROP_BOOL("has-security-extensions", GICState, security_extn, 0),
      /* True if the GIC should implement the virtualization extensions */
      DEFINE_PROP_BOOL("has-virtualization-extensions", GICState, virt_extn, 0),
 +    DEFINE_PROP_UINT32("num-priority-bits", GICState, n_prio_bits, 8),
      DEFINE_PROP_END_OF_LIST(),
  };
 --
 .20.1

-[PULL 06/33] cpu/arm11mpcore: Set number of GIC priority bits to 4
+Deleted patch
-From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-The GIC built into the ARM11MPCore is always implemented with 4
-priority bits; set the GIC property accordingly.
-Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1582537164-764-4-git-send-email-sai.pavan.boddu@xilinx.com
-Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: tweaked commit message]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/cpu/arm11mpcore.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/cpu/arm11mpcore.c
-+++ b/hw/cpu/arm11mpcore.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/irq.h"
- #include "hw/qdev-properties.h"
-+#define ARM11MPCORE_NUM_GIC_PRIORITY_BITS    4
- static void mpcore_priv_set_irq(void *opaque, int irq, int level)
- {
-@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_realize(DeviceState *dev, Error **errp)
-     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
-     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
-+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
-+                         ARM11MPCORE_NUM_GIC_PRIORITY_BITS);
-+
-+
-     object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
-     if (err != NULL) {
-         error_propagate(errp, err);
---
-.20.1

-[PULL 31/33] target/arm: Implement v8.4-RCPC
+[PULL 18/24] target/arm: Implement MVE saturating narrowing shifts
-The v8.4-RCPC extension implements some new instructions:
+Implement the MVE saturating shift-right-and-narrow insns
- * LDAPUR, LDAPURB, LDAPURH, LDAPRSB, LDAPRSH, LDAPRSW
+VQSHRN, VQSHRUN, VQRSHRN and VQRSHRUN.
- * STLUR, STLURB, STLURH
+do_srshr() is borrowed from sve_helper.c.
 These are all in a new subgroup of encodings that sits below the
 top-level "Loads and Stores" group in the Arm ARM.
 The STLUR* instructions have standard store-release semantics; the
 LDAPUR* have Load-AcquirePC semantics, but (as with LDAPR*) we choose
 to implement them as the slightly stronger Load-Acquire.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224172846.13053-4-peter.maydell@linaro.org
+Message-id: 20210628135835.6690-13-peter.maydell@linaro.org
 ---
- target/arm/cpu.h           |  5 +++
+ target/arm/helper-mve.h    |  30 +++++++++++
- linux-user/elfload.c       |  1 +
+ target/arm/mve.decode      |  28 ++++++++++
- target/arm/cpu64.c         |  2 +-
+ target/arm/mve_helper.c    | 104 +++++++++++++++++++++++++++++++++++++
- target/arm/translate-a64.c | 90 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-mve.c |  12 +++++
-files changed, 97 insertions(+), 1 deletion(-)
+files changed, 174 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_3(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vrshrnbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) != 0;
+ DEF_HELPER_FLAGS_4(mve_vrshrnbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- }
+ DEF_HELPER_FLAGS_4(mve_vrshrntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(mve_vrshrnth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
++
-+{
++DEF_HELPER_FLAGS_4(mve_vqshrnb_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
++DEF_HELPER_FLAGS_4(mve_vqshrnb_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+}
++DEF_HELPER_FLAGS_4(mve_vqshrnt_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+
++DEF_HELPER_FLAGS_4(mve_vqshrnt_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- /*
++
-  * Feature tests for "does this exist in either 32-bit or 64-bit?"
++DEF_HELPER_FLAGS_4(mve_vqshrnb_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-  */
++DEF_HELPER_FLAGS_4(mve_vqshrnb_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
++DEF_HELPER_FLAGS_4(mve_vqshrnt_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-index XXXXXXX..XXXXXXX 100644
++DEF_HELPER_FLAGS_4(mve_vqshrnt_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
---- a/linux-user/elfload.c
++
-+++ b/linux-user/elfload.c
++DEF_HELPER_FLAGS_4(mve_vqshrunbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
++DEF_HELPER_FLAGS_4(mve_vqshrunbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
++DEF_HELPER_FLAGS_4(mve_vqshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
++DEF_HELPER_FLAGS_4(mve_vqshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
++
-+    GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
++DEF_HELPER_FLAGS_4(mve_vqrshrnb_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(mve_vqrshrnb_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     return hwcaps;
++DEF_HELPER_FLAGS_4(mve_vqrshrnt_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
- }
++DEF_HELPER_FLAGS_4(mve_vqrshrnt_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
++
-index XXXXXXX..XXXXXXX 100644
++DEF_HELPER_FLAGS_4(mve_vqrshrnb_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
---- a/target/arm/cpu64.c
++DEF_HELPER_FLAGS_4(mve_vqrshrnb_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+++ b/target/arm/cpu64.c
++DEF_HELPER_FLAGS_4(mve_vqrshrnt_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
++DEF_HELPER_FLAGS_4(mve_vqrshrnt_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-         t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
++
-         t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
++DEF_HELPER_FLAGS_4(mve_vqrshrunbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
++DEF_HELPER_FLAGS_4(mve_vqrshrunbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
--        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 1); /* ARMv8.3-RCPC */
++DEF_HELPER_FLAGS_4(mve_vqrshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+        t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2); /* ARMv8.4-RCPC */
++DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-         cpu->isar.id_aa64isar1 = t;
+diff --git a/target/arm/mve.decode b/target/arm/mve.decode
+index XXXXXXX..XXXXXXX 100644
-         t = cpu->isar.id_aa64pfr0;
+--- a/target/arm/mve.decode
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
++++ b/target/arm/mve.decode
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_b
---- a/target/arm/translate-a64.c
+ VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_h
-+++ b/target/arm/translate-a64.c
+ VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_b
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst_pac(DisasContext *s, uint32_t insn,
+ VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_h
 +
 +VQSHRNB_S         111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_b
 +VQSHRNB_S         111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_h
 +VQSHRNT_S         111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_b
 +VQSHRNT_S         111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_h
 +VQSHRNB_U         111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_b
 +VQSHRNB_U         111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_h
 +VQSHRNT_U         111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_b
 +VQSHRNT_U         111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_h
 +
 +VQSHRUNB          111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_b
 +VQSHRUNB          111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_h
 +VQSHRUNT          111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_b
 +VQSHRUNT          111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_h
 +
 +VQRSHRNB_S        111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_b
 +VQRSHRNB_S        111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_h
 +VQRSHRNT_S        111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_b
 +VQRSHRNT_S        111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_h
 +VQRSHRNB_U        111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_b
 +VQRSHRNB_U        111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_h
 +VQRSHRNT_U        111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_b
 +VQRSHRNT_U        111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_h
 +
 +VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_b
 +VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_h
 +VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_b
 +VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_h
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint64_t do_urshr(uint64_t x, unsigned sh)
      }
  }
-+/*
++static inline int64_t do_srshr(int64_t x, unsigned sh)
 + * LDAPR/STLR (unscaled immediate)
 + *
 + *  31  30            24    22  21       12    10    5     0
 + * +------+-------------+-----+---+--------+-----+----+-----+
 + * | size | 0 1 1 0 0 1 | opc | 0 |  imm9  | 0 0 | Rn |  Rt |
 + * +------+-------------+-----+---+--------+-----+----+-----+
 + *
 + * Rt: source or destination register
 + * Rn: base register
 + * imm9: unscaled immediate offset
 + * opc: 00: STLUR*, 01/10/11: various LDAPUR*
 + * size: size of load/store
 + */
 +static void disas_ldst_ldapr_stlr(DisasContext *s, uint32_t insn)
 +{
-+    int rt = extract32(insn, 0, 5);
++    if (likely(sh < 64)) {
-+    int rn = extract32(insn, 5, 5);
++        return (x >> sh) + ((x >> (sh - 1)) & 1);
 +    int offset = sextract32(insn, 12, 9);
 +    int opc = extract32(insn, 22, 2);
 +    int size = extract32(insn, 30, 2);
 +    TCGv_i64 clean_addr, dirty_addr;
 +    bool is_store = false;
 +    bool is_signed = false;
 +    bool extend = false;
 +    bool iss_sf;
 +
 +    if (!dc_isar_feature(aa64_rcpc_8_4, s)) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (opc) {
 +    case 0: /* STLURB */
 +        is_store = true;
 +        break;
 +    case 1: /* LDAPUR* */
 +        break;
 +    case 2: /* LDAPURS* 64-bit variant */
 +        if (size == 3) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        is_signed = true;
 +        break;
 +    case 3: /* LDAPURS* 32-bit variant */
 +        if (size > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        is_signed = true;
 +        extend = true; /* zero-extend 32->64 after signed load */
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    iss_sf = disas_ldst_compute_iss_sf(size, is_signed, opc);
 +
 +    if (rn == 31) {
 +        gen_check_sp_alignment(s);
 +    }
 +
 +    dirty_addr = read_cpu_reg_sp(s, rn, 1);
 +    tcg_gen_addi_i64(dirty_addr, dirty_addr, offset);
 +    clean_addr = clean_data_tbi(s, dirty_addr);
 +
 +    if (is_store) {
 +        /* Store-Release semantics */
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_STRL);
 +        do_gpr_st(s, cpu_reg(s, rt), clean_addr, size, true, rt, iss_sf, true);
 +    } else {
-+        /*
++        /* Rounding the sign bit always produces 0. */
-+         * Load-AcquirePC semantics; we implement as the slightly more
++        return 0;
 +         * restrictive Load-Acquire.
 +         */
 +        do_gpr_ld(s, cpu_reg(s, rt), clean_addr, size, is_signed, extend,
 +                  true, rt, iss_sf, true);
 +        tcg_gen_mb(TCG_MO_ALL | TCG_BAR_LDAQ);
 +    }
 +}
 +
- /* Load/store register (all forms) */
+ DO_VSHRN_ALL(vshrn, DO_SHR)
- static void disas_ldst_reg(DisasContext *s, uint32_t insn)
+ DO_VSHRN_ALL(vrshrn, do_urshr)
- {
++
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst(DisasContext *s, uint32_t insn)
++static inline int32_t do_sat_bhs(int64_t val, int64_t min, int64_t max,
-     case 0x0d: /* AdvSIMD load/store single structure */
++                                 bool *satp)
-         disas_ldst_single_struct(s, insn);
++{
-         break;
++    if (val > max) {
-+    case 0x19: /* LDAPR/STLR (unscaled immediate) */
++        *satp = true;
-+        if (extract32(insn, 10, 2) != 0 ||
++        return max;
-+            extract32(insn, 21, 1) != 0) {
++    } else if (val < min) {
-+            unallocated_encoding(s);
++        *satp = true;
-+            break;
++        return min;
-+        }
++    } else {
-+        disas_ldst_ldapr_stlr(s, insn);
++        return val;
-+        break;
++    }
-     default:
++}
-         unallocated_encoding(s);
++
-         break;
++/* Saturating narrowing right shifts */
 +#define DO_VSHRN_SAT(OP, TOP, ESIZE, TYPE, LESIZE, LTYPE, FN)   \
 +    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
 +                                void *vm, uint32_t shift)       \
 +    {                                                           \
 +        LTYPE *m = vm;                                          \
 +        TYPE *d = vd;                                           \
 +        uint16_t mask = mve_element_mask(env);                  \
 +        bool qc = false;                                        \
 +        unsigned le;                                            \
 +        for (le = 0; le < 16 / LESIZE; le++, mask >>= LESIZE) { \
 +            bool sat = false;                                   \
 +            TYPE r = FN(m[H##LESIZE(le)], shift, &sat);         \
 +            mergemask(&d[H##ESIZE(le * 2 + TOP)], r, mask);     \
 +            qc |= sat && (mask & 1 << (TOP * ESIZE));           \
 +        }                                                       \
 +        if (qc) {                                               \
 +            env->vfp.qc[0] = qc;                                \
 +        }                                                       \
 +        mve_advance_vpt(env);                                   \
 +    }
 +
 +#define DO_VSHRN_SAT_UB(BOP, TOP, FN)                           \
 +    DO_VSHRN_SAT(BOP, false, 1, uint8_t, 2, uint16_t, FN)       \
 +    DO_VSHRN_SAT(TOP, true, 1, uint8_t, 2, uint16_t, FN)
 +
 +#define DO_VSHRN_SAT_UH(BOP, TOP, FN)                           \
 +    DO_VSHRN_SAT(BOP, false, 2, uint16_t, 4, uint32_t, FN)      \
 +    DO_VSHRN_SAT(TOP, true, 2, uint16_t, 4, uint32_t, FN)
 +
 +#define DO_VSHRN_SAT_SB(BOP, TOP, FN)                           \
 +    DO_VSHRN_SAT(BOP, false, 1, int8_t, 2, int16_t, FN)         \
 +    DO_VSHRN_SAT(TOP, true, 1, int8_t, 2, int16_t, FN)
 +
 +#define DO_VSHRN_SAT_SH(BOP, TOP, FN)                           \
 +    DO_VSHRN_SAT(BOP, false, 2, int16_t, 4, int32_t, FN)        \
 +    DO_VSHRN_SAT(TOP, true, 2, int16_t, 4, int32_t, FN)
 +
 +#define DO_SHRN_SB(N, M, SATP)                                  \
 +    do_sat_bhs((int64_t)(N) >> (M), INT8_MIN, INT8_MAX, SATP)
 +#define DO_SHRN_UB(N, M, SATP)                                  \
 +    do_sat_bhs((uint64_t)(N) >> (M), 0, UINT8_MAX, SATP)
 +#define DO_SHRUN_B(N, M, SATP)                                  \
 +    do_sat_bhs((int64_t)(N) >> (M), 0, UINT8_MAX, SATP)
 +
 +#define DO_SHRN_SH(N, M, SATP)                                  \
 +    do_sat_bhs((int64_t)(N) >> (M), INT16_MIN, INT16_MAX, SATP)
 +#define DO_SHRN_UH(N, M, SATP)                                  \
 +    do_sat_bhs((uint64_t)(N) >> (M), 0, UINT16_MAX, SATP)
 +#define DO_SHRUN_H(N, M, SATP)                                  \
 +    do_sat_bhs((int64_t)(N) >> (M), 0, UINT16_MAX, SATP)
 +
 +#define DO_RSHRN_SB(N, M, SATP)                                 \
 +    do_sat_bhs(do_srshr(N, M), INT8_MIN, INT8_MAX, SATP)
 +#define DO_RSHRN_UB(N, M, SATP)                                 \
 +    do_sat_bhs(do_urshr(N, M), 0, UINT8_MAX, SATP)
 +#define DO_RSHRUN_B(N, M, SATP)                                 \
 +    do_sat_bhs(do_srshr(N, M), 0, UINT8_MAX, SATP)
 +
 +#define DO_RSHRN_SH(N, M, SATP)                                 \
 +    do_sat_bhs(do_srshr(N, M), INT16_MIN, INT16_MAX, SATP)
 +#define DO_RSHRN_UH(N, M, SATP)                                 \
 +    do_sat_bhs(do_urshr(N, M), 0, UINT16_MAX, SATP)
 +#define DO_RSHRUN_H(N, M, SATP)                                 \
 +    do_sat_bhs(do_srshr(N, M), 0, UINT16_MAX, SATP)
 +
 +DO_VSHRN_SAT_SB(vqshrnb_sb, vqshrnt_sb, DO_SHRN_SB)
 +DO_VSHRN_SAT_SH(vqshrnb_sh, vqshrnt_sh, DO_SHRN_SH)
 +DO_VSHRN_SAT_UB(vqshrnb_ub, vqshrnt_ub, DO_SHRN_UB)
 +DO_VSHRN_SAT_UH(vqshrnb_uh, vqshrnt_uh, DO_SHRN_UH)
 +DO_VSHRN_SAT_SB(vqshrunbb, vqshruntb, DO_SHRUN_B)
 +DO_VSHRN_SAT_SH(vqshrunbh, vqshrunth, DO_SHRUN_H)
 +
 +DO_VSHRN_SAT_SB(vqrshrnb_sb, vqrshrnt_sb, DO_RSHRN_SB)
 +DO_VSHRN_SAT_SH(vqrshrnb_sh, vqrshrnt_sh, DO_RSHRN_SH)
 +DO_VSHRN_SAT_UB(vqrshrnb_ub, vqrshrnt_ub, DO_RSHRN_UB)
 +DO_VSHRN_SAT_UH(vqrshrnb_uh, vqrshrnt_uh, DO_RSHRN_UH)
 +DO_VSHRN_SAT_SB(vqrshrunbb, vqrshruntb, DO_RSHRUN_B)
 +DO_VSHRN_SAT_SH(vqrshrunbh, vqrshrunth, DO_RSHRUN_H)
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_N(VSHRNB, vshrnb)
  DO_2SHIFT_N(VSHRNT, vshrnt)
  DO_2SHIFT_N(VRSHRNB, vrshrnb)
  DO_2SHIFT_N(VRSHRNT, vrshrnt)
 +DO_2SHIFT_N(VQSHRNB_S, vqshrnb_s)
 +DO_2SHIFT_N(VQSHRNT_S, vqshrnt_s)
 +DO_2SHIFT_N(VQSHRNB_U, vqshrnb_u)
 +DO_2SHIFT_N(VQSHRNT_U, vqshrnt_u)
 +DO_2SHIFT_N(VQSHRUNB, vqshrunb)
 +DO_2SHIFT_N(VQSHRUNT, vqshrunt)
 +DO_2SHIFT_N(VQRSHRNB_S, vqrshrnb_s)
 +DO_2SHIFT_N(VQRSHRNT_S, vqrshrnt_s)
 +DO_2SHIFT_N(VQRSHRNB_U, vqrshrnb_u)
 +DO_2SHIFT_N(VQRSHRNT_U, vqrshrnt_u)
 +DO_2SHIFT_N(VQRSHRUNB, vqrshrunb)
 +DO_2SHIFT_N(VQRSHRUNT, vqrshrunt)
 --
 .20.1

-[PULL 13/33] target/arm: Add missing checks for fpsp_v2
+[PULL 19/24] target/arm: Implement MVE VSHLC
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE VSHLC insn, which performs a shift left of the
 entire vector with carry in bits provided from a general purpose
 register and carry out bits written back to that register.
-We will eventually remove the early ARM_FEATURE_VFP test,
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-so add a proper test for each trans_* that does not already
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-have another ISA test.
+Message-id: 20210628135835.6690-14-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h    |  2 ++
  target/arm/mve.decode      |  2 ++
  target/arm/mve_helper.c    | 38 ++++++++++++++++++++++++++++++++++++++
  target/arm/translate-mve.c | 30 ++++++++++++++++++++++++++++++
 files changed, 72 insertions(+)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 78 ++++++++++++++++++++++++++++++----
 file changed, 69 insertions(+), 9 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_to_gp(DisasContext *s, arg_VMOV_to_gp *a)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vqrshrunbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     int pass;
+ DEF_HELPER_FLAGS_4(mve_vqrshrunbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-     uint32_t offset;
+ DEF_HELPER_FLAGS_4(mve_vqrshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+    /* SIZE == 2 is a VFP instruction; otherwise NEON.  */
++
-+    if (a->size == 2
++DEF_HELPER_FLAGS_4(mve_vshlc, TCG_CALL_NO_WG, i32, env, ptr, i32, i32)
-+        ? !dc_isar_feature(aa32_fpsp_v2, s)
+diff --git a/target/arm/mve.decode b/target/arm/mve.decode
-+        : !arm_dc_feature(s, ARM_FEATURE_NEON)) {
+index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve.decode
 +++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@ VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_b
  VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_h
  VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_b
  VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_h
 +
 +VSHLC             111 0 1110 1 . 1 imm:5 ... 0 1111 1100 rdm:4 qd=%qd
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VSHRN_SAT_UB(vqrshrnb_ub, vqrshrnt_ub, DO_RSHRN_UB)
  DO_VSHRN_SAT_UH(vqrshrnb_uh, vqrshrnt_uh, DO_RSHRN_UH)
  DO_VSHRN_SAT_SB(vqrshrunbb, vqrshruntb, DO_RSHRUN_B)
  DO_VSHRN_SAT_SH(vqrshrunbh, vqrshrunth, DO_RSHRUN_H)
 +
 +uint32_t HELPER(mve_vshlc)(CPUARMState *env, void *vd, uint32_t rdm,
 +                           uint32_t shift)
 +{
 +    uint32_t *d = vd;
 +    uint16_t mask = mve_element_mask(env);
 +    unsigned e;
 +    uint32_t r;
 +
 +    /*
 +     * For each 32-bit element, we shift it left, bringing in the
 +     * low 'shift' bits of rdm at the bottom. Bits shifted out at
 +     * the top become the new rdm, if the predicate mask permits.
 +     * The final rdm value is returned to update the register.
 +     * shift == 0 here means "shift by 32 bits".
 +     */
 +    if (shift == 0) {
 +        for (e = 0; e < 16 / 4; e++, mask >>= 4) {
 +            r = rdm;
 +            if (mask & 1) {
 +                rdm = d[H4(e)];
 +            }
 +            mergemask(&d[H4(e)], r, mask);
 +        }
 +    } else {
 +        uint32_t shiftmask = MAKE_64BIT_MASK(0, shift);
 +
 +        for (e = 0; e < 16 / 4; e++, mask >>= 4) {
 +            r = (d[H4(e)] << shift) | (rdm & shiftmask);
 +            if (mask & 1) {
 +                rdm = d[H4(e)] >> (32 - shift);
 +            }
 +            mergemask(&d[H4(e)], r, mask);
 +        }
 +    }
 +    mve_advance_vpt(env);
 +    return rdm;
 +}
 diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-mve.c
 +++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_N(VQRSHRNB_U, vqrshrnb_u)
  DO_2SHIFT_N(VQRSHRNT_U, vqrshrnt_u)
  DO_2SHIFT_N(VQRSHRUNB, vqrshrunb)
  DO_2SHIFT_N(VQRSHRUNT, vqrshrunt)
 +
 +static bool trans_VSHLC(DisasContext *s, arg_VSHLC *a)
 +{
 +    /*
 +     * Whole Vector Left Shift with Carry. The carry is taken
 +     * from a general purpose register and written back there.
 +     * An imm of 0 means "shift by 32".
 +     */
 +    TCGv_ptr qd;
 +    TCGv_i32 rdm;
 +
 +    if (!dc_isar_feature(aa32_mve, s) || !mve_check_qreg_bank(s, a->qd)) {
 +        return false;
 +    }
-+
++    if (a->rdm == 13 || a->rdm == 15) {
-     /* UNDEF accesses to D16-D31 if they don't exist */
++        /* CONSTRAINED UNPREDICTABLE: we UNDEF */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vn & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_to_gp(DisasContext *s, arg_VMOV_to_gp *a)
      pass = extract32(offset, 2, 1);
      offset = extract32(offset, 0, 2) * 8;
 -    if (a->size != 2 && !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_from_gp(DisasContext *s, arg_VMOV_from_gp *a)
      int pass;
      uint32_t offset;
 +    /* SIZE == 2 is a VFP instruction; otherwise NEON.  */
 +    if (a->size == 2
 +        ? !dc_isar_feature(aa32_fpsp_v2, s)
 +        : !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 +        return false;
 +    }
-+
++    if (!mve_eci_check(s) || !vfp_access_check(s)) {
-     /* UNDEF accesses to D16-D31 if they don't exist */
++        return true;
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vn & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_from_gp(DisasContext *s, arg_VMOV_from_gp *a)
      pass = extract32(offset, 2, 1);
      offset = extract32(offset, 0, 2) * 8;
 -    if (a->size != 2 && !arm_dc_feature(s, ARM_FEATURE_NEON)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
      TCGv_i32 tmp;
      bool ignore_vfp_enabled = false;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
-     if (arm_dc_feature(s, ARM_FEATURE_M)) {
++    qd = mve_qreg_ptr(a->qd);
-         /*
++    rdm = load_reg(s, a->rdm);
-          * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
++    gen_helper_mve_vshlc(rdm, cpu_env, qd, rdm, tcg_constant_i32(a->imm));
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_single(DisasContext *s, arg_VMOV_single *a)
++    store_reg(s, a->rdm, rdm);
- {
++    tcg_temp_free_ptr(qd);
-     TCGv_i32 tmp;
++    mve_update_eci(s);
++    return true;
-+    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
++}
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_sp(DisasContext *s, arg_VMOV_64_sp *a)
  {
      TCGv_i32 tmp;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /*
       * VMOV between two general-purpose registers and two single precision
       * floating point registers
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_64_dp(DisasContext *s, arg_VMOV_64_dp *a)
      /*
       * VMOV between two general-purpose registers and one double precision
 -     * floating point register
 +     * floating point register.  Note that this does not require support
 +     * for double precision arithmetic.
       */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_sp(DisasContext *s, arg_VLDR_VSTR_sp *a)
      uint32_t offset;
      TCGv_i32 addr, tmp;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR_dp(DisasContext *s, arg_VLDR_VSTR_dp *a)
      TCGv_i32 addr;
      TCGv_i64 tmp;
 +    /* Note that this does not require support for double arithmetic.  */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /* UNDEF accesses to D16-D31 if they don't exist */
      if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_sp(DisasContext *s, arg_VLDM_VSTM_sp *a)
      TCGv_i32 addr, tmp;
      int i, n;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      n = a->imm;
      if (n == 0 || (a->vd + n) > 32) {
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDM_VSTM_dp(DisasContext *s, arg_VLDM_VSTM_dp *a)
      TCGv_i64 tmp;
      int i, n;
 +    /* Note that this does not require support for double arithmetic.  */
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      n = a->imm >> 1;
      if (n == 0 || (a->vd + n) > 32 || n > 16) {
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
      TCGv_i32 f0, f1, fd;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_sp(DisasContext *s, VFPGen2OpSPFn *fn, int vd, int vm)
      int veclen = s->vec_len;
      TCGv_i32 f0, fd;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_fpshvec, s) &&
          (veclen != 0 || s->vec_stride != 0)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_sp(DisasContext *s, arg_VCMP_sp *a)
  {
      TCGv_i32 vd, vm;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      /* Vm/M bits must be zero for the Z variant */
      if (a->z && a->vm != 0) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
      TCGv_i32 vm;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
      TCGv_i32 vm;
      TCGv_ptr fpst;
 +    if (!dc_isar_feature(aa32_fpsp_v2, s)) {
 +        return false;
 +    }
 +
      if (!vfp_access_check(s)) {
          return true;
      }
 --
 .20.1

-[PULL 11/33] target/arm: Perform fpdp_v2 check first
+[PULL 20/24] target/arm: Implement MVE VADDLV
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE VADDLV insn; this is similar to VADDV, except
 that it accumulates 32-bit elements into a 64-bit accumulator
 stored in a pair of general-purpose registers.
-Shuffle the order of the checks so that we test the ISA
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-before we test anything else, such as the register arguments.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210628135835.6690-15-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h    |  3 ++
  target/arm/mve.decode      |  6 +++-
  target/arm/mve_helper.c    | 19 ++++++++++++
  target/arm/translate-mve.c | 63 ++++++++++++++++++++++++++++++++++++++
 files changed, 90 insertions(+), 1 deletion(-)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 140 +++++++++++++++++----------------
 file changed, 71 insertions(+), 69 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_vaddvuh, TCG_CALL_NO_WG, i32, env, ptr, i32)
-         return false;
+ DEF_HELPER_FLAGS_3(mve_vaddvsw, TCG_CALL_NO_WG, i32, env, ptr, i32)
-     }
+ DEF_HELPER_FLAGS_3(mve_vaddvuw, TCG_CALL_NO_WG, i32, env, ptr, i32)
--    /* UNDEF accesses to D16-D31 if they don't exist */
++DEF_HELPER_FLAGS_3(mve_vaddlv_s, TCG_CALL_NO_WG, i64, env, ptr, i64)
--    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
++DEF_HELPER_FLAGS_3(mve_vaddlv_u, TCG_CALL_NO_WG, i64, env, ptr, i64)
--        ((a->vm | a->vn | a->vd) & 0x10)) {
++
-+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+ DEF_HELPER_FLAGS_3(mve_vmovi, TCG_CALL_NO_WG, void, env, ptr, i64)
-         return false;
+ DEF_HELPER_FLAGS_3(mve_vandi, TCG_CALL_NO_WG, void, env, ptr, i64)
-     }
+ DEF_HELPER_FLAGS_3(mve_vorri, TCG_CALL_NO_WG, void, env, ptr, i64)
+diff --git a/target/arm/mve.decode b/target/arm/mve.decode
--    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+index XXXXXXX..XXXXXXX 100644
-+    /* UNDEF accesses to D16-D31 if they don't exist */
+--- a/target/arm/mve.decode
-+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
++++ b/target/arm/mve.decode
-+        ((a->vm | a->vn | a->vd) & 0x10)) {
+@@ -XXX,XX +XXX,XX @@ VQDMULH_scalar   1110 1110 0 . .. ... 1 ... 0 1110 . 110 .... @2scalar
-         return false;
+ VQRDMULH_scalar  1111 1110 0 . .. ... 1 ... 0 1110 . 110 .... @2scalar
-     }
+ # Vector add across vector
-@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
+-VADDV            111 u:1 1110 1111 size:2 01 ... 0 1111 0 0 a:1 0 qm:3 0 rda=%rdalo
-         return false;
++{
-     }
++  VADDV          111 u:1 1110 1111 size:2 01 ... 0 1111 0 0 a:1 0 qm:3 0 rda=%rdalo
++  VADDLV         111 u:1 1110 1 ... 1001 ... 0 1111 00 a:1 0 qm:3 0 \
--    /* UNDEF accesses to D16-D31 if they don't exist */
++                 rdahi=%rdahi rdalo=%rdalo
--    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
++}
--        ((a->vm | a->vn | a->vd) & 0x10)) {
-+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+ # Predicate operations
-         return false;
+ %mask_22_13      22:1 13:3
-     }
+diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
+index XXXXXXX..XXXXXXX 100644
--    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+--- a/target/arm/mve_helper.c
-+    /* UNDEF accesses to D16-D31 if they don't exist */
++++ b/target/arm/mve_helper.c
-+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+@@ -XXX,XX +XXX,XX @@ DO_VADDV(vaddvub, 1, uint8_t)
-+        ((a->vm | a->vn | a->vd) & 0x10)) {
+ DO_VADDV(vaddvuh, 2, uint16_t)
-         return false;
+ DO_VADDV(vaddvuw, 4, uint32_t)
-     }
++#define DO_VADDLV(OP, TYPE, LTYPE)                              \
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
++    uint64_t HELPER(glue(mve_, OP))(CPUARMState *env, void *vm, \
-         return false;
++                                    uint64_t ra)                \
-     }
++    {                                                           \
++        uint16_t mask = mve_element_mask(env);                  \
--    /* UNDEF accesses to D16-D31 if they don't exist */
++        unsigned e;                                             \
--    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
++        TYPE *m = vm;                                           \
--        ((a->vm | a->vd) & 0x10)) {
++        for (e = 0; e < 16 / 4; e++, mask >>= 4) {              \
-+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
++            if (mask & 1) {                                     \
-         return false;
++                ra += (LTYPE)m[H4(e)];                          \
-     }
++            }                                                   \
++        }                                                       \
--    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
++        mve_advance_vpt(env);                                   \
-+    /* UNDEF accesses to D16-D31 if they don't exist */
++        return ra;                                              \
-+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
++    }                                                           \
-+        ((a->vm | a->vd) & 0x10)) {
++
-         return false;
++DO_VADDLV(vaddlv_s, int32_t, int64_t)
-     }
++DO_VADDLV(vaddlv_u, uint32_t, uint64_t)
++
-@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+ /* Shifts by immediate */
-         return false;
+ #define DO_2SHIFT(OP, ESIZE, TYPE, FN)                          \
-     }
+     void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
+diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
--    /* UNDEF accesses to D16-D31 if they don't exist */
+index XXXXXXX..XXXXXXX 100644
--    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+--- a/target/arm/translate-mve.c
-+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
++++ b/target/arm/translate-mve.c
-         return false;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VADDV(DisasContext *s, arg_VADDV *a)
-     }
+     return true;
+ }
--    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
-+    /* UNDEF accesses to D16-D31 if they don't exist */
++static bool trans_VADDLV(DisasContext *s, arg_VADDLV *a)
-+    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
++{
-         return false;
++    /*
-     }
++     * Vector Add Long Across Vector: accumulate the 32-bit
++     * elements of the vector into a 64-bit result stored in
-@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
++     * a pair of general-purpose registers.
-     TCGv_i64 f0, f1, fd;
++     * No need to check Qm's bank: it is only 3 bits in decode.
-     TCGv_ptr fpst;
++     */
++    TCGv_ptr qm;
--    /* UNDEF accesses to D16-D31 if they don't exist */
++    TCGv_i64 rda;
--    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
++    TCGv_i32 rdalo, rdahi;
-+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
++
-         return false;
++    if (!dc_isar_feature(aa32_mve, s)) {
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
      int veclen = s->vec_len;
      TCGv_i64 f0, fd;
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) &&
 +        ((a->vd | a->vn | a->vm) & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
      vd = a->vd;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
  {
      TCGv_i64 vd, vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
-+
++    /*
-     /* Vm/M bits must be zero for the Z variant */
++     * rdahi == 13 is UNPREDICTABLE; rdahi == 15 is a related
-     if (a->z && a->vm != 0) {
++     * encoding; rdalo always has bit 0 clear so cannot be 13 or 15.
-         return false;
++     */
-@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
++    if (a->rdahi == 13 || a->rdahi == 15) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
      TCGv_i32 tmp;
      TCGv_i64 vd;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
-+
++    if (!mve_eci_check(s) || !vfp_access_check(s)) {
-     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
++        return true;
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
      TCGv_i32 tmp;
      TCGv_i64 vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
-     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
++    /*
-         return false;
++     * This insn is subject to beat-wise execution. Partial execution
-     }
++     * of an A=0 (no-accumulate) insn which does not execute the first
-@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
++     * beat must start with the current value of RdaHi:RdaLo, not zero.
-         return false;
++     */
-     }
++    if (a->a || mve_skip_first_beat(s)) {
++        /* Accumulate input from RdaHi:RdaLo */
--    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
++        rda = tcg_temp_new_i64();
--        return false;
++        rdalo = load_reg(s, a->rdalo);
--    }
++        rdahi = load_reg(s, a->rdahi);
--
++        tcg_gen_concat_i32_i64(rda, rdalo, rdahi);
-     if (!vfp_access_check(s)) {
++        tcg_temp_free_i32(rdalo);
-         return true;
++        tcg_temp_free_i32(rdahi);
-     }
++    } else {
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
++        /* Accumulate starting at zero */
-     TCGv_ptr fpst;
++        rda = tcg_const_i64(0);
      TCGv_i64 tmp;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
-     if (!dc_isar_feature(aa32_vrint, s)) {
++    qm = mve_qreg_ptr(a->qm);
-         return false;
++    if (a->u) {
-     }
++        gen_helper_mve_vaddlv_u(rda, cpu_env, qm, rda);
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
++    } else {
-         return false;
++        gen_helper_mve_vaddlv_s(rda, cpu_env, qm, rda);
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
      TCGv_i64 tmp;
      TCGv_i32 tcg_rmode;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
++    tcg_temp_free_ptr(qm);
 +
-     if (!dc_isar_feature(aa32_vrint, s)) {
++    rdalo = tcg_temp_new_i32();
-         return false;
++    rdahi = tcg_temp_new_i32();
-     }
++    tcg_gen_extrl_i64_i32(rdalo, rda);
-@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
++    tcg_gen_extrh_i64_i32(rdahi, rda);
-         return false;
++    store_reg(s, a->rdalo, rdalo);
-     }
++    store_reg(s, a->rdahi, rdahi);
++    tcg_temp_free_i64(rda);
--    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
++    mve_update_eci(s);
--        return false;
++    return true;
--    }
++}
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
      TCGv_ptr fpst;
      TCGv_i64 tmp;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
-     if (!dc_isar_feature(aa32_vrint, s)) {
+ static bool do_1imm(DisasContext *s, arg_1imm *a, MVEGenOneOpImmFn *fn)
-         return false;
+ {
-     }
+     TCGv_ptr qd;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
      TCGv_i64 vd;
      TCGv_i32 vm;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
      TCGv_i64 vm;
      TCGv_i32 vd;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
      TCGv_i64 vd;
      TCGv_ptr fpst;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
      TCGv_i32 vd;
      TCGv_i64 vm;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!dc_isar_feature(aa32_jscvt, s)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
      TCGv_ptr fpst;
      int frac_bits;
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +        return false;
 +    }
 +
      if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 -        return false;
 -    }
 -
      if (!vfp_access_check(s)) {
          return true;
      }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
      TCGv_i64 vm;
      TCGv_ptr fpst;
 -    /* UNDEF accesses to D16-D31 if they don't exist. */
 -    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
 +    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
          return false;
      }
 -    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
 +    /* UNDEF accesses to D16-D31 if they don't exist. */
 +    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
          return false;
      }
 --
 .20.1

-[PULL 10/33] target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
+[PULL 21/24] target/arm: Implement MVE long shifts by immediate
-From: Richard Henderson <richard.henderson@linaro.org>
+The MVE extension to v8.1M includes some new shift instructions which
+sit entirely within the non-coprocessor part of the encoding space
-We cannot easily create "any" functions for these, because the
+and which operate only on general-purpose registers.  They take up
-ID_AA64PFR0 fields for FP and SIMD signal "enabled" with zero.
+the space which was previously UNPREDICTABLE MOVS and ORRS encodings
-Which means that an aarch32-only cpu will return incorrect results
+with Rm == 13 or 15.
-when testing the aarch64 registers.
+Implement the long shifts by immediate, which perform shifts on a
-To use these, we must either have context or additionally test
+pair of general-purpose registers treated as a 64-bit quantity, with
-vs ARM_FEATURE_AARCH64.
+an immediate shift count between 1 and 32.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Awkwardly, because the MOVS and ORRS trans functions do not UNDEF for
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+the Rm==13,15 case, we need to explicitly emit code to UNDEF for the
-Message-id: 20200224222232.13807-5-richard.henderson@linaro.org
+cases where v8.1M now requires that.  (Trying to change MOVS and ORRS
 is too difficult, because the functions that generate the code are
 shared between a dozen different kinds of arithmetic or logical
 instruction for all A32, T16 and T32 encodings, and for some insns
 and some encodings Rm==13,15 are valid.)
 We make the helper functions we need for UQSHLL and SQSHLL take
 a 32-bit value which the helper casts to int8_t because we'll need
 these helpers also for the shift-by-register insns, where the shift
 count might be < 0 or > 32.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210628135835.6690-16-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     | 11 +++++++++++
+ target/arm/helper-mve.h |  3 ++
- target/arm/cpu.c     |  9 ++++++---
+ target/arm/translate.h  |  1 +
- target/arm/machine.c |  5 +++--
+ target/arm/t32.decode   | 28 +++++++++++++
-files changed, 20 insertions(+), 5 deletions(-)
+ target/arm/mve_helper.c | 10 +++++
+ target/arm/translate.c  | 90 +++++++++++++++++++++++++++++++++++++++++
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+files changed, 132 insertions(+)
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
-+++ b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpdp_v3(const ARMISARegisters *id)
+--- a/target/arm/helper-mve.h
-     return FIELD_EX32(id->mvfr0, MVFR0, FPDP) >= 2;
++++ b/target/arm/helper-mve.h
- }
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vqrshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
-+static inline bool isar_feature_aa32_vfp(const ARMISARegisters *id)
-+{
+ DEF_HELPER_FLAGS_4(mve_vshlc, TCG_CALL_NO_WG, i32, env, ptr, i32, i32)
-+    return isar_feature_aa32_fpsp_v2(id) || isar_feature_aa32_fpdp_v2(id);
++
 +DEF_HELPER_FLAGS_3(mve_sqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_uqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void CryptoTwoOpFn(TCGv_ptr, TCGv_ptr);
  typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
 +typedef void WideShiftImmFn(TCGv_i64, TCGv_i64, int64_t shift);
  /**
   * arm_tbflags_from_tb:
 diff --git a/target/arm/t32.decode b/target/arm/t32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/t32.decode
 +++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@
  &mcr             !extern cp opc1 crn crm opc2 rt
  &mcrr            !extern cp opc1 crm rt rt2
 +&mve_shl_ri      rdalo rdahi shim
 +
 +# rdahi: bits [3:1] from insn, bit 0 is 1
 +# rdalo: bits [3:1] from insn, bit 0 is 0
 +%rdahi_9 9:3 !function=times_2_plus_1
 +%rdalo_17 17:3 !function=times_2
 +
  # Data-processing (register)
  %imm5_12_6       12:3 6:2
@@ -XXX,XX +XXX,XX @@
  @S_xrr_shi       ....... .... .   rn:4 .... .... .. shty:2 rm:4 \
                   &s_rrr_shi shim=%imm5_12_6 s=1 rd=0
 +@mve_shl_ri      ....... .... . ... . . ... ... . .. .. .... \
 +                 &mve_shl_ri shim=%imm5_12_6 rdalo=%rdalo_17 rdahi=%rdahi_9
 +
  {
    TST_xrri       1110101 0000 1 .... 0 ... 1111 .... ....     @S_xrr_shi
    AND_rrri       1110101 0000 . .... 0 ... .... .... ....     @s_rrr_shi
  }
  BIC_rrri         1110101 0001 . .... 0 ... .... .... ....     @s_rrr_shi
  {
 +  # The v8.1M MVE shift insns overlap in encoding with MOVS/ORRS
 +  # and are distinguished by having Rm==13 or 15. Those are UNPREDICTABLE
 +  # cases for MOVS/ORRS. We decode the MVE cases first, ensuring that
 +  # they explicitly call unallocated_encoding() for cases that must UNDEF
 +  # (eg "using a new shift insn on a v8.1M CPU without MVE"), and letting
 +  # the rest fall through (where ORR_rrri and MOV_rxri will end up
 +  # handling them as r13 and r15 accesses with the same semantics as A32).
 +  [
 +    LSLL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 00 1111  @mve_shl_ri
 +    LSRL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 01 1111  @mve_shl_ri
 +    ASRL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 10 1111  @mve_shl_ri
 +
 +    UQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 00 1111  @mve_shl_ri
 +    URSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 01 1111  @mve_shl_ri
 +    SRSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 10 1111  @mve_shl_ri
 +    SQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
 +  ]
 +
    MOV_rxri       1110101 0010 . 1111 0 ... .... .... ....     @s_rxr_shi
    ORR_rrri       1110101 0010 . .... 0 ... .... .... ....     @s_rrr_shi
  }
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mve_vshlc)(CPUARMState *env, void *vd, uint32_t rdm,
      mve_advance_vpt(env);
      return rdm;
  }
 +
 +uint64_t HELPER(mve_sqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_sqrshl_d(n, (int8_t)shift, false, &env->QF);
 +}
 +
 +uint64_t HELPER(mve_uqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_uqrshl_d(n, (int8_t)shift, false, &env->QF);
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_MOVT(DisasContext *s, arg_MOVW *a)
      return true;
  }
 +/*
 + * v8.1M MVE wide-shifts
 + */
 +static bool do_mve_shl_ri(DisasContext *s, arg_mve_shl_ri *a,
 +                          WideShiftImmFn *fn)
 +{
 +    TCGv_i64 rda;
 +    TCGv_i32 rdalo, rdahi;
 +
 +    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
 +        /* Decode falls through to ORR/MOV UNPREDICTABLE handling */
 +        return false;
 +    }
 +    if (a->rdahi == 15) {
 +        /* These are a different encoding (SQSHL/SRSHR/UQSHL/URSHR) */
 +        return false;
 +    }
 +    if (!dc_isar_feature(aa32_mve, s) ||
 +        !arm_dc_feature(s, ARM_FEATURE_M_MAIN) ||
 +        a->rdahi == 13) {
 +        /* RdaHi == 13 is UNPREDICTABLE; we choose to UNDEF */
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    if (a->shim == 0) {
 +        a->shim = 32;
 +    }
 +
 +    rda = tcg_temp_new_i64();
 +    rdalo = load_reg(s, a->rdalo);
 +    rdahi = load_reg(s, a->rdahi);
 +    tcg_gen_concat_i32_i64(rda, rdalo, rdahi);
 +
 +    fn(rda, rda, a->shim);
 +
 +    tcg_gen_extrl_i64_i32(rdalo, rda);
 +    tcg_gen_extrh_i64_i32(rdahi, rda);
 +    store_reg(s, a->rdalo, rdalo);
 +    store_reg(s, a->rdahi, rdahi);
 +    tcg_temp_free_i64(rda);
 +
 +    return true;
 +}
 +
 +static bool trans_ASRL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, tcg_gen_sari_i64);
 +}
 +
 +static bool trans_LSLL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, tcg_gen_shli_i64);
 +}
 +
 +static bool trans_LSRL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, tcg_gen_shri_i64);
 +}
 +
 +static void gen_mve_sqshll(TCGv_i64 r, TCGv_i64 n, int64_t shift)
 +{
 +    gen_helper_mve_sqshll(r, cpu_env, n, tcg_constant_i32(shift));
 +}
 +
 +static bool trans_SQSHLL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, gen_mve_sqshll);
 +}
 +
 +static void gen_mve_uqshll(TCGv_i64 r, TCGv_i64 n, int64_t shift)
 +{
 +    gen_helper_mve_uqshll(r, cpu_env, n, tcg_constant_i32(shift));
 +}
 +
 +static bool trans_UQSHLL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, gen_mve_uqshll);
 +}
 +
 +static bool trans_SRSHRL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, gen_srshr64_i64);
 +}
 +
 +static bool trans_URSHRL_ri(DisasContext *s, arg_mve_shl_ri *a)
 +{
 +    return do_mve_shl_ri(s, a, gen_urshr64_i64);
 +}
 +
  /*
-  * We always set the FP and SIMD FP16 fields to indicate identical
+  * Multiply and multiply accumulate
-  * levels of support (assuming SIMD is implemented at all), so
+  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_dcpodp(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, DPB) >= 2;
  }
 +static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
 +{
 +    /* We always set the AdvSIMD and FP fields identically.  */
 +    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) != 0xf;
 +}
 +
  static inline bool isar_feature_aa64_fp16(const ARMISARegisters *id)
  {
      /* We always set the AdvSIMD and FP fields identically wrt FP16.  */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
       * KVM does not currently allow us to lie to the guest about its
       * ID/feature registers, so the guest always sees what the host has.
       */
 -    if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
 +        ? cpu_isar_feature(aa64_fp_simd, cpu)
 +        : cpu_isar_feature(aa32_vfp, cpu)) {
          cpu->has_vfp = true;
          if (!kvm_enabled()) {
              qdev_property_add_static(DEVICE(obj), &arm_cpu_has_vfp_property);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
       * We rely on no XScale CPU having VFP so we can use the same bits in the
       * TB flags field for VECSTRIDE and XSCALE_CPAR.
       */
 -    assert(!(arm_feature(env, ARM_FEATURE_VFP) &&
 -             arm_feature(env, ARM_FEATURE_XSCALE)));
 +    assert(arm_feature(&cpu->env, ARM_FEATURE_AARCH64) ||
 +           !cpu_isar_feature(aa32_vfp_simd, cpu) ||
 +           !arm_feature(env, ARM_FEATURE_XSCALE));
      if (arm_feature(env, ARM_FEATURE_V7) &&
          !arm_feature(env, ARM_FEATURE_M) &&
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@
  static bool vfp_needed(void *opaque)
  {
      ARMCPU *cpu = opaque;
 -    CPUARMState *env = &cpu->env;
 -    return arm_feature(env, ARM_FEATURE_VFP);
 +    return (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)
 +            ? cpu_isar_feature(aa64_fp_simd, cpu)
 +            : cpu_isar_feature(aa32_vfp_simd, cpu));
  }
  static int get_fpscr(QEMUFile *f, void *opaque, size_t size,
 --
 .20.1

-[PULL 15/33] target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
+[PULL 22/24] target/arm: Implement MVE long shifts by register
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE long shifts by register, which perform shifts on a
+pair of general-purpose registers treated as a 64-bit quantity, with
-We now have proper ISA checks within each trans_* function.
+the shift count in another general-purpose register, which might be
+either positive or negative.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Like the long-shifts-by-immediate, these encodings sit in the space
-Message-id: 20200224222232.13807-11-richard.henderson@linaro.org
+that was previously the UNPREDICTABLE MOVS/ORRS with Rm==13,15.
 Because LSLL_rr and ASRL_rr overlap with both MOV_rxri/ORR_rrri and
 also with CSEL (as one of the previously-UNPREDICTABLE Rm==13 cases),
 we have to move the CSEL pattern into the same decodetree group.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210628135835.6690-17-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 4 ----
+ target/arm/helper-mve.h |  6 +++
-file changed, 4 deletions(-)
+ target/arm/translate.h  |  1 +
+ target/arm/t32.decode   | 16 +++++--
  target/arm/mve_helper.c | 93 +++++++++++++++++++++++++++++++++++++++++
  target/arm/translate.c  | 69 ++++++++++++++++++++++++++++++
 files changed, 182 insertions(+), 3 deletions(-)
 diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-mve.h
 +++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
  DEF_HELPER_FLAGS_4(mve_vshlc, TCG_CALL_NO_WG, i32, env, ptr, i32, i32)
 +DEF_HELPER_FLAGS_3(mve_sshrl, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_ushll, TCG_CALL_NO_RWG, i64, env, i64, i32)
  DEF_HELPER_FLAGS_3(mve_sqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
  DEF_HELPER_FLAGS_3(mve_uqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_sqrshrl, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_uqrshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_sqrshrl48, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +DEF_HELPER_FLAGS_3(mve_uqrshll48, TCG_CALL_NO_RWG, i64, env, i64, i32)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
  typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
  typedef void WideShiftImmFn(TCGv_i64, TCGv_i64, int64_t shift);
 +typedef void WideShiftFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i32);
  /**
   * arm_tbflags_from_tb:
 diff --git a/target/arm/t32.decode b/target/arm/t32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/t32.decode
 +++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@
  &mcrr            !extern cp opc1 crm rt rt2
  &mve_shl_ri      rdalo rdahi shim
 +&mve_shl_rr      rdalo rdahi rm
  # rdahi: bits [3:1] from insn, bit 0 is 1
  # rdalo: bits [3:1] from insn, bit 0 is 0
@@ -XXX,XX +XXX,XX @@
  @mve_shl_ri      ....... .... . ... . . ... ... . .. .. .... \
                   &mve_shl_ri shim=%imm5_12_6 rdalo=%rdalo_17 rdahi=%rdahi_9
 +@mve_shl_rr      ....... .... . ... . rm:4  ... . .. .. .... \
 +                 &mve_shl_rr rdalo=%rdalo_17 rdahi=%rdahi_9
  {
    TST_xrri       1110101 0000 1 .... 0 ... 1111 .... ....     @S_xrr_shi
@@ -XXX,XX +XXX,XX @@ BIC_rrri         1110101 0001 . .... 0 ... .... .... ....     @s_rrr_shi
      URSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 01 1111  @mve_shl_ri
      SRSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 10 1111  @mve_shl_ri
      SQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
 +
 +    LSLL_rr      1110101 0010 1 ... 0 ....  ... 1  0000 1101  @mve_shl_rr
 +    ASRL_rr      1110101 0010 1 ... 0 ....  ... 1  0010 1101  @mve_shl_rr
 +    UQRSHLL64_rr 1110101 0010 1 ... 1 ....  ... 1  0000 1101  @mve_shl_rr
 +    SQRSHRL64_rr 1110101 0010 1 ... 1 ....  ... 1  0010 1101  @mve_shl_rr
 +    UQRSHLL48_rr 1110101 0010 1 ... 1 ....  ... 1  1000 1101  @mve_shl_rr
 +    SQRSHRL48_rr 1110101 0010 1 ... 1 ....  ... 1  1010 1101  @mve_shl_rr
    ]
    MOV_rxri       1110101 0010 . 1111 0 ... .... .... ....     @s_rxr_shi
    ORR_rrri       1110101 0010 . .... 0 ... .... .... ....     @s_rrr_shi
 +
 +  # v8.1M CSEL and friends
 +  CSEL           1110101 0010 1 rn:4 10 op:2 rd:4 fcond:4 rm:4
  }
  {
    MVN_rxri       1110101 0011 . 1111 0 ... .... .... ....     @s_rxr_shi
@@ -XXX,XX +XXX,XX @@ SBC_rrri         1110101 1011 . .... 0 ... .... .... ....     @s_rrr_shi
  }
  RSB_rrri         1110101 1110 . .... 0 ... .... .... ....     @s_rrr_shi
 -# v8.1M CSEL and friends
 -CSEL             1110101 0010 1 rn:4 10 op:2 rd:4 fcond:4 rm:4
 -
  # Data-processing (register-shifted register)
  MOV_rxrr         1111 1010 0 shty:2 s:1 rm:4 1111 rd:4 0000 rs:4 \
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mve_vshlc)(CPUARMState *env, void *vd, uint32_t rdm,
      return rdm;
  }
 +uint64_t HELPER(mve_sshrl)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_sqrshl_d(n, -(int8_t)shift, false, NULL);
 +}
 +
 +uint64_t HELPER(mve_ushll)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_uqrshl_d(n, (int8_t)shift, false, NULL);
 +}
 +
  uint64_t HELPER(mve_sqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
  {
      return do_sqrshl_d(n, (int8_t)shift, false, &env->QF);
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(mve_uqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
  {
      return do_uqrshl_d(n, (int8_t)shift, false, &env->QF);
  }
 +
 +uint64_t HELPER(mve_sqrshrl)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_sqrshl_d(n, -(int8_t)shift, true, &env->QF);
 +}
 +
 +uint64_t HELPER(mve_uqrshll)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_uqrshl_d(n, (int8_t)shift, true, &env->QF);
 +}
 +
 +/* Operate on 64-bit values, but saturate at 48 bits */
 +static inline int64_t do_sqrshl48_d(int64_t src, int64_t shift,
 +                                    bool round, uint32_t *sat)
 +{
 +    if (shift <= -48) {
 +        /* Rounding the sign bit always produces 0. */
 +        if (round) {
 +            return 0;
 +        }
 +        return src >> 63;
 +    } else if (shift < 0) {
 +        if (round) {
 +            src >>= -shift - 1;
 +            return (src >> 1) + (src & 1);
 +        }
 +        return src >> -shift;
 +    } else if (shift < 48) {
 +        int64_t val = src << shift;
 +        int64_t extval = sextract64(val, 0, 48);
 +        if (!sat || val == extval) {
 +            return extval;
 +        }
 +    } else if (!sat || src == 0) {
 +        return 0;
 +    }
 +
 +    *sat = 1;
 +    return (1ULL << 47) - (src >= 0);
 +}
 +
 +/* Operate on 64-bit values, but saturate at 48 bits */
 +static inline uint64_t do_uqrshl48_d(uint64_t src, int64_t shift,
 +                                     bool round, uint32_t *sat)
 +{
 +    uint64_t val, extval;
 +
 +    if (shift <= -(48 + round)) {
 +        return 0;
 +    } else if (shift < 0) {
 +        if (round) {
 +            val = src >> (-shift - 1);
 +            val = (val >> 1) + (val & 1);
 +        } else {
 +            val = src >> -shift;
 +        }
 +        extval = extract64(val, 0, 48);
 +        if (!sat || val == extval) {
 +            return extval;
 +        }
 +    } else if (shift < 48) {
 +        uint64_t val = src << shift;
 +        uint64_t extval = extract64(val, 0, 48);
 +        if (!sat || val == extval) {
 +            return extval;
 +        }
 +    } else if (!sat || src == 0) {
 +        return 0;
 +    }
 +
 +    *sat = 1;
 +    return MAKE_64BIT_MASK(0, 48);
 +}
 +
 +uint64_t HELPER(mve_sqrshrl48)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_sqrshl48_d(n, -(int8_t)shift, true, &env->QF);
 +}
 +
 +uint64_t HELPER(mve_uqrshll48)(CPUARMState *env, uint64_t n, uint32_t shift)
 +{
 +    return do_uqrshl48_d(n, (int8_t)shift, true, &env->QF);
 +}
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
+@@ -XXX,XX +XXX,XX @@ static bool trans_URSHRL_ri(DisasContext *s, arg_mve_shl_ri *a)
      return do_mve_shl_ri(s, a, gen_urshr64_i64);
  }
 +static bool do_mve_shl_rr(DisasContext *s, arg_mve_shl_rr *a, WideShiftFn *fn)
 +{
 +    TCGv_i64 rda;
 +    TCGv_i32 rdalo, rdahi;
 +
 +    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
 +        /* Decode falls through to ORR/MOV UNPREDICTABLE handling */
 +        return false;
 +    }
 +    if (a->rdahi == 15) {
 +        /* These are a different encoding (SQSHL/SRSHR/UQSHL/URSHR) */
 +        return false;
 +    }
 +    if (!dc_isar_feature(aa32_mve, s) ||
 +        !arm_dc_feature(s, ARM_FEATURE_M_MAIN) ||
 +        a->rdahi == 13 || a->rm == 13 || a->rm == 15 ||
 +        a->rm == a->rdahi || a->rm == a->rdalo) {
 +        /* These rdahi/rdalo/rm cases are UNPREDICTABLE; we choose to UNDEF */
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    rda = tcg_temp_new_i64();
 +    rdalo = load_reg(s, a->rdalo);
 +    rdahi = load_reg(s, a->rdahi);
 +    tcg_gen_concat_i32_i64(rda, rdalo, rdahi);
 +
 +    /* The helper takes care of the sign-extension of the low 8 bits of Rm */
 +    fn(rda, cpu_env, rda, cpu_R[a->rm]);
 +
 +    tcg_gen_extrl_i64_i32(rdalo, rda);
 +    tcg_gen_extrh_i64_i32(rdahi, rda);
 +    store_reg(s, a->rdalo, rdalo);
 +    store_reg(s, a->rdahi, rdahi);
 +    tcg_temp_free_i64(rda);
 +
 +    return true;
 +}
 +
 +static bool trans_LSLL_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_ushll);
 +}
 +
 +static bool trans_ASRL_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_sshrl);
 +}
 +
 +static bool trans_UQRSHLL64_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_uqrshll);
 +}
 +
 +static bool trans_SQRSHRL64_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_sqrshrl);
 +}
 +
 +static bool trans_UQRSHLL48_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_uqrshll48);
 +}
 +
 +static bool trans_SQRSHRL48_rr(DisasContext *s, arg_mve_shl_rr *a)
 +{
 +    return do_mve_shl_rr(s, a, gen_helper_mve_sqrshrl48);
 +}
 +
  /*
   * Multiply and multiply accumulate
   */
- static int disas_vfp_insn(DisasContext *s, uint32_t insn)
- {
--    if (!arm_dc_feature(s, ARM_FEATURE_VFP)) {
--        return 1;
--    }
--
-     /*
-      * If the decodetree decoder handles this insn it will always
-      * emit code to either execute the insn or generate an appropriate
 --
 .20.1

-[PULL 09/33] target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
+[PULL 23/24] target/arm: Implement MVE shifts by immediate
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE shifts by immediate, which perform shifts
+on a single general-purpose register.
-We will shortly use these to test for VFPv2 and VFPv3
-in different situations.
+These patterns overlap with the long-shift-by-immediates,
+so we have to rearrange the grouping a little here.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210628135835.6690-18-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 18 ++++++++++++++++++
+ target/arm/helper-mve.h |  3 ++
-file changed, 18 insertions(+)
+ target/arm/translate.h  |  1 +
+ target/arm/t32.decode   | 31 ++++++++++++++-----
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+ target/arm/mve_helper.c | 10 ++++++
-index XXXXXXX..XXXXXXX 100644
+ target/arm/translate.c  | 68 +++++++++++++++++++++++++++++++++++++++--
---- a/target/arm/cpu.h
+files changed, 104 insertions(+), 9 deletions(-)
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fpshvec(const ARMISARegisters *id)
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
-     return FIELD_EX32(id->mvfr0, MVFR0, FPSHVEC) > 0;
+index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-mve.h
 +++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_sqrshrl, TCG_CALL_NO_RWG, i64, env, i64, i32)
  DEF_HELPER_FLAGS_3(mve_uqrshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
  DEF_HELPER_FLAGS_3(mve_sqrshrl48, TCG_CALL_NO_RWG, i64, env, i64, i32)
  DEF_HELPER_FLAGS_3(mve_uqrshll48, TCG_CALL_NO_RWG, i64, env, i64, i32)
 +
 +DEF_HELPER_FLAGS_3(mve_uqshl, TCG_CALL_NO_RWG, i32, env, i32, i32)
 +DEF_HELPER_FLAGS_3(mve_sqshl, TCG_CALL_NO_RWG, i32, env, i32, i32)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
  typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
  typedef void WideShiftImmFn(TCGv_i64, TCGv_i64, int64_t shift);
  typedef void WideShiftFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i32);
 +typedef void ShiftImmFn(TCGv_i32, TCGv_i32, int32_t shift);
  /**
   * arm_tbflags_from_tb:
 diff --git a/target/arm/t32.decode b/target/arm/t32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/t32.decode
 +++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@
  &mve_shl_ri      rdalo rdahi shim
  &mve_shl_rr      rdalo rdahi rm
 +&mve_sh_ri       rda shim
  # rdahi: bits [3:1] from insn, bit 0 is 1
  # rdalo: bits [3:1] from insn, bit 0 is 0
@@ -XXX,XX +XXX,XX @@
                   &mve_shl_ri shim=%imm5_12_6 rdalo=%rdalo_17 rdahi=%rdahi_9
  @mve_shl_rr      ....... .... . ... . rm:4  ... . .. .. .... \
                   &mve_shl_rr rdalo=%rdalo_17 rdahi=%rdahi_9
 +@mve_sh_ri       ....... .... . rda:4 . ... ... . .. .. .... \
 +                 &mve_sh_ri shim=%imm5_12_6
  {
    TST_xrri       1110101 0000 1 .... 0 ... 1111 .... ....     @S_xrr_shi
@@ -XXX,XX +XXX,XX @@ BIC_rrri         1110101 0001 . .... 0 ... .... .... ....     @s_rrr_shi
    # the rest fall through (where ORR_rrri and MOV_rxri will end up
    # handling them as r13 and r15 accesses with the same semantics as A32).
    [
 -    LSLL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 00 1111  @mve_shl_ri
 -    LSRL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 01 1111  @mve_shl_ri
 -    ASRL_ri      1110101 0010 1 ... 0 0 ... ... 1 .. 10 1111  @mve_shl_ri
 +    {
 +      UQSHL_ri   1110101 0010 1 ....  0 ...  1111 .. 00 1111  @mve_sh_ri
 +      LSLL_ri    1110101 0010 1 ... 0 0 ... ... 1 .. 00 1111  @mve_shl_ri
 +      UQSHLL_ri  1110101 0010 1 ... 1 0 ... ... 1 .. 00 1111  @mve_shl_ri
 +    }
 -    UQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 00 1111  @mve_shl_ri
 -    URSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 01 1111  @mve_shl_ri
 -    SRSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 10 1111  @mve_shl_ri
 -    SQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
 +    {
 +      URSHR_ri   1110101 0010 1 ....  0 ...  1111 .. 01 1111  @mve_sh_ri
 +      LSRL_ri    1110101 0010 1 ... 0 0 ... ... 1 .. 01 1111  @mve_shl_ri
 +      URSHRL_ri  1110101 0010 1 ... 1 0 ... ... 1 .. 01 1111  @mve_shl_ri
 +    }
 +
 +    {
 +      SRSHR_ri   1110101 0010 1 ....  0 ...  1111 .. 10 1111  @mve_sh_ri
 +      ASRL_ri    1110101 0010 1 ... 0 0 ... ... 1 .. 10 1111  @mve_shl_ri
 +      SRSHRL_ri  1110101 0010 1 ... 1 0 ... ... 1 .. 10 1111  @mve_shl_ri
 +    }
 +
 +    {
 +      SQSHL_ri   1110101 0010 1 ....  0 ...  1111 .. 11 1111  @mve_sh_ri
 +      SQSHLL_ri  1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
 +    }
      LSLL_rr      1110101 0010 1 ... 0 ....  ... 1  0000 1101  @mve_shl_rr
      ASRL_rr      1110101 0010 1 ... 0 ....  ... 1  0010 1101  @mve_shl_rr
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(mve_uqrshll48)(CPUARMState *env, uint64_t n, uint32_t shift)
  {
      return do_uqrshl48_d(n, (int8_t)shift, true, &env->QF);
  }
++
-+static inline bool isar_feature_aa32_fpsp_v2(const ARMISARegisters *id)
++uint32_t HELPER(mve_uqshl)(CPUARMState *env, uint32_t n, uint32_t shift)
 +{
-+    /* Return true if CPU supports single precision floating point, VFPv2 */
++    return do_uqrshl_bhs(n, (int8_t)shift, 32, false, &env->QF);
-+    return FIELD_EX32(id->mvfr0, MVFR0, FPSP) > 0;
++}
-+}
++
-+
++uint32_t HELPER(mve_sqshl)(CPUARMState *env, uint32_t n, uint32_t shift)
-+static inline bool isar_feature_aa32_fpsp_v3(const ARMISARegisters *id)
++{
-+{
++    return do_sqrshl_bhs(n, (int8_t)shift, 32, false, &env->QF);
-+    /* Return true if CPU supports single precision floating point, VFPv3 */
++}
-+    return FIELD_EX32(id->mvfr0, MVFR0, FPSP) >= 2;
+diff --git a/target/arm/translate.c b/target/arm/translate.c
-+}
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/target/arm/translate.c
- static inline bool isar_feature_aa32_fpdp_v2(const ARMISARegisters *id)
++++ b/target/arm/translate.c
- {
+@@ -XXX,XX +XXX,XX @@ static void gen_srshr16_i64(TCGv_i64 d, TCGv_i64 a, int64_t sh)
-     /* Return true if CPU supports double precision floating point, VFPv2 */
-     return FIELD_EX32(id->mvfr0, MVFR0, FPDP) > 0;
+ static void gen_srshr32_i32(TCGv_i32 d, TCGv_i32 a, int32_t sh)
  {
 -    TCGv_i32 t = tcg_temp_new_i32();
 +    TCGv_i32 t;
 +    /* Handle shift by the input size for the benefit of trans_SRSHR_ri */
 +    if (sh == 32) {
 +        tcg_gen_movi_i32(d, 0);
 +        return;
 +    }
 +    t = tcg_temp_new_i32();
      tcg_gen_extract_i32(t, a, sh - 1, 1);
      tcg_gen_sari_i32(d, a, sh);
      tcg_gen_add_i32(d, d, t);
@@ -XXX,XX +XXX,XX @@ static void gen_urshr16_i64(TCGv_i64 d, TCGv_i64 a, int64_t sh)
  static void gen_urshr32_i32(TCGv_i32 d, TCGv_i32 a, int32_t sh)
  {
 -    TCGv_i32 t = tcg_temp_new_i32();
 +    TCGv_i32 t;
 +    /* Handle shift by the input size for the benefit of trans_URSHR_ri */
 +    if (sh == 32) {
 +        tcg_gen_extract_i32(d, a, sh - 1, 1);
 +        return;
 +    }
 +    t = tcg_temp_new_i32();
      tcg_gen_extract_i32(t, a, sh - 1, 1);
      tcg_gen_shri_i32(d, a, sh);
      tcg_gen_add_i32(d, d, t);
@@ -XXX,XX +XXX,XX @@ static bool trans_SQRSHRL48_rr(DisasContext *s, arg_mve_shl_rr *a)
      return do_mve_shl_rr(s, a, gen_helper_mve_sqrshrl48);
  }
-+static inline bool isar_feature_aa32_fpdp_v3(const ARMISARegisters *id)
++static bool do_mve_sh_ri(DisasContext *s, arg_mve_sh_ri *a, ShiftImmFn *fn)
 +{
-+    /* Return true if CPU supports double precision floating point, VFPv3 */
++    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
-+    return FIELD_EX32(id->mvfr0, MVFR0, FPDP) >= 2;
++        /* Decode falls through to ORR/MOV UNPREDICTABLE handling */
 +        return false;
 +    }
 +    if (!dc_isar_feature(aa32_mve, s) ||
 +        !arm_dc_feature(s, ARM_FEATURE_M_MAIN) ||
 +        a->rda == 13 || a->rda == 15) {
 +        /* These rda cases are UNPREDICTABLE; we choose to UNDEF */
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    if (a->shim == 0) {
 +        a->shim = 32;
 +    }
 +    fn(cpu_R[a->rda], cpu_R[a->rda], a->shim);
 +
 +    return true;
 +}
 +
 +static bool trans_URSHR_ri(DisasContext *s, arg_mve_sh_ri *a)
 +{
 +    return do_mve_sh_ri(s, a, gen_urshr32_i32);
 +}
 +
 +static bool trans_SRSHR_ri(DisasContext *s, arg_mve_sh_ri *a)
 +{
 +    return do_mve_sh_ri(s, a, gen_srshr32_i32);
 +}
 +
 +static void gen_mve_sqshl(TCGv_i32 r, TCGv_i32 n, int32_t shift)
 +{
 +    gen_helper_mve_sqshl(r, cpu_env, n, tcg_constant_i32(shift));
 +}
 +
 +static bool trans_SQSHL_ri(DisasContext *s, arg_mve_sh_ri *a)
 +{
 +    return do_mve_sh_ri(s, a, gen_mve_sqshl);
 +}
 +
 +static void gen_mve_uqshl(TCGv_i32 r, TCGv_i32 n, int32_t shift)
 +{
 +    gen_helper_mve_uqshl(r, cpu_env, n, tcg_constant_i32(shift));
 +}
 +
 +static bool trans_UQSHL_ri(DisasContext *s, arg_mve_sh_ri *a)
 +{
 +    return do_mve_sh_ri(s, a, gen_mve_uqshl);
 +}
 +
  /*
-  * We always set the FP and SIMD FP16 fields to indicate identical
+  * Multiply and multiply accumulate
-  * levels of support (assuming SIMD is implemented at all), so
+  */
 --
 .20.1

-[PULL 18/33] linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Use isar feature tests instead of feature bit tests.
-Although none of QEMUs current cpus have VFPv3 without D32,
-replace the large comment explaining why with one line that
-sets ARM_HWCAP_ARM_VFPv3D16 under the correct conditions.
-Mirror the test sequence used in the linux kernel.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20200224222232.13807-14-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/elfload.c | 23 +++++++++++++----------
-file changed, 13 insertions(+), 10 deletions(-)
-diff --git a/linux-user/elfload.c b/linux-user/elfload.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/elfload.c
-+++ b/linux-user/elfload.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
-     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
-     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
--    GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
-     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
-     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
-     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
--    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
-     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
--    GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);
-+    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
-     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
-     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
--    /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.
--     * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of
--     * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated
--     * to our VFP_FP16 feature bit.
--     */
--    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPD32);
--    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
-+    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
-+
-+    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
-+        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
-+        hwcaps |= ARM_HWCAP_ARM_VFPv3;
-+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
-+            hwcaps |= ARM_HWCAP_ARM_VFPD32;
-+        } else {
-+            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
-+        }
-+    }
-+    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
-     return hwcaps;
- }
---
-.20.1

-[PULL 19/33] target/arm: Remove ARM_FEATURE_VFP*
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-We have converted all tests against these features
-to ISAR tests.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224222232.13807-15-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h   |  3 ---
- target/arm/cpu.c   | 25 -------------------------
- target/arm/cpu64.c |  3 ---
- target/arm/kvm32.c |  5 -----
- target/arm/kvm64.c |  1 -
-files changed, 37 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
-  * mapping in linux-user/elfload.c:get_elf_hwcap().
-  */
- enum arm_features {
--    ARM_FEATURE_VFP,
-     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
-     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
-     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
-     ARM_FEATURE_V7,
-     ARM_FEATURE_THUMB2,
-     ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
--    ARM_FEATURE_VFP3,
-     ARM_FEATURE_NEON,
-     ARM_FEATURE_M, /* Microcontroller profile.  */
-     ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
-@@ -XXX,XX +XXX,XX @@ enum arm_features {
-     ARM_FEATURE_V5,
-     ARM_FEATURE_STRONGARM,
-     ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
--    ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
-     ARM_FEATURE_GENERIC_TIMER,
-     ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
-     ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
-     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
-         set_feature(&cpu->env, ARM_FEATURE_PMSA);
-     }
--    /* Similarly for the VFP feature bits */
--    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
--        set_feature(&cpu->env, ARM_FEATURE_VFP3);
--    }
--    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
--        set_feature(&cpu->env, ARM_FEATURE_VFP);
--    }
-     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
-         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-         uint64_t t;
-         uint32_t u;
--        unset_feature(env, ARM_FEATURE_VFP);
--        unset_feature(env, ARM_FEATURE_VFP3);
--        unset_feature(env, ARM_FEATURE_VFP4);
--
-         t = cpu->isar.id_aa64isar1;
-         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
-         cpu->isar.id_aa64isar1 = t;
-@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm926";
-     set_feature(&cpu->env, ARM_FEATURE_V5);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
-     cpu->midr = 0x41069265;
-@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm1026";
-     set_feature(&cpu->env, ARM_FEATURE_V5);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_AUXCR);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
-@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm1136";
-     set_feature(&cpu->env, ARM_FEATURE_V6);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
-@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm1136";
-     set_feature(&cpu->env, ARM_FEATURE_V6K);
-     set_feature(&cpu->env, ARM_FEATURE_V6);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
-@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm1176";
-     set_feature(&cpu->env, ARM_FEATURE_V6K);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_VAPA);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
-@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,arm11mpcore";
-     set_feature(&cpu->env, ARM_FEATURE_V6K);
--    set_feature(&cpu->env, ARM_FEATURE_VFP);
-     set_feature(&cpu->env, ARM_FEATURE_VAPA);
-     set_feature(&cpu->env, ARM_FEATURE_MPIDR);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
-     set_feature(&cpu->env, ARM_FEATURE_M);
-     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     cpu->midr = 0x410fc240; /* r0p0 */
-     cpu->pmsav7_dregion = 8;
-     cpu->isar.mvfr0 = 0x10110021;
-@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
-     set_feature(&cpu->env, ARM_FEATURE_M);
-     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     cpu->midr = 0x411fc272; /* r1p2 */
-     cpu->pmsav7_dregion = 8;
-     cpu->isar.mvfr0 = 0x10110221;
-@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
-     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
-     set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     cpu->midr = 0x410fd213; /* r0p3 */
-     cpu->pmsav7_dregion = 16;
-     cpu->sau_sregion = 8;
-@@ -XXX,XX +XXX,XX @@ static void cortex_r5f_initfn(Object *obj)
-     ARMCPU *cpu = ARM_CPU(obj);
-     cortex_r5_initfn(obj);
--    set_feature(&cpu->env, ARM_FEATURE_VFP3);
-     cpu->isar.mvfr0 = 0x10110221;
-     cpu->isar.mvfr1 = 0x00000011;
- }
-@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a8";
-     set_feature(&cpu->env, ARM_FEATURE_V7);
--    set_feature(&cpu->env, ARM_FEATURE_VFP3);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
-@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a9";
-     set_feature(&cpu->env, ARM_FEATURE_V7);
--    set_feature(&cpu->env, ARM_FEATURE_VFP3);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
-     set_feature(&cpu->env, ARM_FEATURE_EL3);
-@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a7";
-     set_feature(&cpu->env, ARM_FEATURE_V7VE);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
-@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a15";
-     set_feature(&cpu->env, ARM_FEATURE_V7VE);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a57";
-     set_feature(&cpu->env, ARM_FEATURE_V8);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
-     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a53";
-     set_feature(&cpu->env, ARM_FEATURE_V8);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
-     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
-     cpu->dtb_compatible = "arm,cortex-a72";
-     set_feature(&cpu->env, ARM_FEATURE_V8);
--    set_feature(&cpu->env, ARM_FEATURE_VFP4);
-     set_feature(&cpu->env, ARM_FEATURE_NEON);
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
-     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
-diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm32.c
-+++ b/target/arm/kvm32.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-      * bits, but a few must be tested.
-      */
-     set_feature(&features, ARM_FEATURE_V7VE);
--    set_feature(&features, ARM_FEATURE_VFP3);
-     set_feature(&features, ARM_FEATURE_GENERIC_TIMER);
-     if (extract32(id_pfr0, 12, 4) == 1) {
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
-         set_feature(&features, ARM_FEATURE_NEON);
-     }
--    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
--        /* FMAC support implies VFPv4 */
--        set_feature(&features, ARM_FEATURE_VFP4);
--    }
-     ahcf->features = features;
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-      * feature bits.
-      */
-     set_feature(&features, ARM_FEATURE_V8);
--    set_feature(&features, ARM_FEATURE_VFP4);
-     set_feature(&features, ARM_FEATURE_NEON);
-     set_feature(&features, ARM_FEATURE_AARCH64);
-     set_feature(&features, ARM_FEATURE_PMU);
---
-.20.1

-[PULL 20/33] target/arm: Add formats for some vfp 2 and 3-register insns
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Those vfp instructions without extra opcode fields can
-share a common @format for brevity.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200224222232.13807-16-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/vfp.decode | 134 ++++++++++++++++--------------------------
-file changed, 52 insertions(+), 82 deletions(-)
-diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/vfp.decode
-+++ b/target/arm/vfp.decode
-@@ -XXX,XX +XXX,XX @@
- %vmov_imm 16:4 0:4
-+@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
-+@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+
-+@vfp_dm_ss   ................................ vm=%vm_sp vd=%vd_sp
-+@vfp_dm_dd   ................................ vm=%vm_dp vd=%vd_dp
-+@vfp_dm_ds   ................................ vm=%vm_sp vd=%vd_dp
-+@vfp_dm_sd   ................................ vm=%vm_dp vd=%vd_sp
-+
- # VMOV scalar to general-purpose register; note that this does
- # include some Neon cases.
- VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
-@@ -XXX,XX +XXX,XX @@ VDUP         ---- 1110 1 b:1 q:1 0 .... rt:4 1011 . 0 e:1 1 0000 \
-              vn=%vn_dp
- VMSR_VMRS    ---- 1110 111 l:1 reg:4 rt:4 1010 0001 0000
--VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000 \
--             vn=%vn_sp
-+VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000    vn=%vn_sp
--VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 .... \
--             vm=%vm_sp
--VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 .... \
--             vm=%vm_dp
-+VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 ....   vm=%vm_sp
-+VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 ....   vm=%vm_dp
- # Note that the half-precision variants of VLDR and VSTR are
- # not part of this decodetree at all because they have bits [9:8] == 0b01
--VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8 \
--             vd=%vd_sp
--VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8 \
--             vd=%vd_dp
-+VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
-+VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
- # We split the load/store multiple up into two patterns to avoid
- # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
-@@ -XXX,XX +XXX,XX @@ VLDM_VSTM_dp ---- 1101 0.1 l:1 rn:4 .... 1011 imm:8 \
-              vd=%vd_dp p=1 u=0 w=1
- # 3-register VFP data-processing; bits [23,21:20,6] identify the operation.
--VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
-+VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
--VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 ....        @vfp_dnm_s
-+VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 ....        @vfp_dnm_d
--VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 ....        @vfp_dnm_s
-+VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
--VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 ....        @vfp_dnm_s
-+VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
--VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 ....        @vfp_dnm_s
-+VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
--VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 ....        @vfp_dnm_s
-+VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
--VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 ....        @vfp_dnm_s
-+VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 ....        @vfp_dnm_d
--VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 ....        @vfp_dnm_s
-+VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
--VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 .... \
--             vm=%vm_sp vn=%vn_sp vd=%vd_sp
--VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 .... \
--             vm=%vm_dp vn=%vn_dp vd=%vd_dp
-+VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
-+VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
- VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
-              vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
-@@ -XXX,XX +XXX,XX @@ VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
- VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
-              vd=%vd_dp imm=%vmov_imm
--VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 ....        @vfp_dm_ss
-+VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 ....        @vfp_dm_dd
--VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 ....        @vfp_dm_ss
-+VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 ....        @vfp_dm_dd
--VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 ....        @vfp_dm_ss
-+VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 ....        @vfp_dm_dd
--VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 ....        @vfp_dm_ss
-+VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 ....        @vfp_dm_dd
- VCMP_sp      ---- 1110 1.11 010 z:1 .... 1010 e:1 1.0 .... \
-              vd=%vd_sp vm=%vm_sp
-@@ -XXX,XX +XXX,XX @@ VCVT_f32_f16 ---- 1110 1.11 0010 .... 1010 t:1 1.0 .... \
- VCVT_f64_f16 ---- 1110 1.11 0010 .... 1011 t:1 1.0 .... \
-              vd=%vd_dp vm=%vm_sp
--# VCVTB and VCVTT to f16: Vd format is always vd_sp; Vm format depends on size bit
-+# VCVTB and VCVTT to f16: Vd format is always vd_sp;
-+# Vm format depends on size bit
- VCVT_f16_f32 ---- 1110 1.11 0011 .... 1010 t:1 1.0 .... \
-              vd=%vd_sp vm=%vm_sp
- VCVT_f16_f64 ---- 1110 1.11 0011 .... 1011 t:1 1.0 .... \
-              vd=%vd_sp vm=%vm_dp
--VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 ....        @vfp_dm_ss
-+VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 ....        @vfp_dm_dd
--VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 ....        @vfp_dm_ss
-+VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 ....        @vfp_dm_dd
--VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 .... \
--             vd=%vd_sp vm=%vm_sp
--VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 .... \
--             vd=%vd_dp vm=%vm_dp
-+VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 ....        @vfp_dm_ss
-+VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 ....        @vfp_dm_dd
--# VCVT between single and double: Vm precision depends on size; Vd is its reverse
--VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 .... \
--             vd=%vd_dp vm=%vm_sp
--VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 .... \
--             vd=%vd_sp vm=%vm_dp
-+# VCVT between single and double:
-+# Vm precision depends on size; Vd is its reverse
-+VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 ....        @vfp_dm_ds
-+VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 ....        @vfp_dm_sd
- # VCVT from integer to floating point: Vm always single; Vd depends on size
- VCVT_int_sp  ---- 1110 1.11 1000 .... 1010 s:1 1.0 .... \
-@@ -XXX,XX +XXX,XX @@ VCVT_int_dp  ---- 1110 1.11 1000 .... 1011 s:1 1.0 .... \
-              vd=%vd_dp vm=%vm_sp
- # VJCVT is always dp to sp
--VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 .... \
--             vd=%vd_sp vm=%vm_dp
-+VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 ....        @vfp_dm_sd
- # VCVT between floating-point and fixed-point. The immediate value
- # is in the same format as a Vm single-precision register number.
---
-.20.1

-[PULL 22/33] target/arm: Split VMINMAXNM decode
+[PULL 24/24] target/arm: Implement MVE shifts by register
-From: Richard Henderson <richard.henderson@linaro.org>
+Implement the MVE shifts by register, which perform
 shifts on a single general-purpose register.
-Passing the raw op field from the manual is less instructive
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-than it might be.  Do the full decode and use the existing
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-helpers to perform the expansion.
+Message-id: 20210628135835.6690-19-peter.maydell@linaro.org
 ---
  target/arm/helper-mve.h |  2 ++
  target/arm/translate.h  |  1 +
  target/arm/t32.decode   | 18 ++++++++++++++----
  target/arm/mve_helper.c | 10 ++++++++++
  target/arm/translate.c  | 30 ++++++++++++++++++++++++++++++
 files changed, 57 insertions(+), 4 deletions(-)
-Since these are v8 insns, VECLEN+VECSTRIDE are already RES0.
+diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20200224222232.13807-18-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-vfp.inc.c | 109 +++++++++++----------------------
  target/arm/vfp-uncond.decode   |  12 ++--
 files changed, 44 insertions(+), 77 deletions(-)
 diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-vfp.inc.c
+--- a/target/arm/helper-mve.h
-+++ b/target/arm/translate-vfp.inc.c
++++ b/target/arm/helper-mve.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_uqrshll48, TCG_CALL_NO_RWG, i64, env, i64, i32)
-     return true;
  DEF_HELPER_FLAGS_3(mve_uqshl, TCG_CALL_NO_RWG, i32, env, i32, i32)
  DEF_HELPER_FLAGS_3(mve_sqshl, TCG_CALL_NO_RWG, i32, env, i32, i32)
 +DEF_HELPER_FLAGS_3(mve_uqrshl, TCG_CALL_NO_RWG, i32, env, i32, i32)
 +DEF_HELPER_FLAGS_3(mve_sqrshr, TCG_CALL_NO_RWG, i32, env, i32, i32)
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
  typedef void WideShiftImmFn(TCGv_i64, TCGv_i64, int64_t shift);
  typedef void WideShiftFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i32);
  typedef void ShiftImmFn(TCGv_i32, TCGv_i32, int32_t shift);
 +typedef void ShiftFn(TCGv_i32, TCGv_ptr, TCGv_i32, TCGv_i32);
  /**
   * arm_tbflags_from_tb:
 diff --git a/target/arm/t32.decode b/target/arm/t32.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/t32.decode
 +++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@
  &mve_shl_ri      rdalo rdahi shim
  &mve_shl_rr      rdalo rdahi rm
  &mve_sh_ri       rda shim
 +&mve_sh_rr       rda rm
  # rdahi: bits [3:1] from insn, bit 0 is 1
  # rdalo: bits [3:1] from insn, bit 0 is 0
@@ -XXX,XX +XXX,XX @@
                   &mve_shl_rr rdalo=%rdalo_17 rdahi=%rdahi_9
  @mve_sh_ri       ....... .... . rda:4 . ... ... . .. .. .... \
                   &mve_sh_ri shim=%imm5_12_6
 +@mve_sh_rr       ....... .... . rda:4 rm:4 .... .... .... &mve_sh_rr
  {
    TST_xrri       1110101 0000 1 .... 0 ... 1111 .... ....     @S_xrr_shi
@@ -XXX,XX +XXX,XX @@ BIC_rrri         1110101 0001 . .... 0 ... .... .... ....     @s_rrr_shi
        SQSHLL_ri  1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
      }
 -    LSLL_rr      1110101 0010 1 ... 0 ....  ... 1  0000 1101  @mve_shl_rr
 -    ASRL_rr      1110101 0010 1 ... 0 ....  ... 1  0010 1101  @mve_shl_rr
 -    UQRSHLL64_rr 1110101 0010 1 ... 1 ....  ... 1  0000 1101  @mve_shl_rr
 -    SQRSHRL64_rr 1110101 0010 1 ... 1 ....  ... 1  0010 1101  @mve_shl_rr
 +    {
 +      UQRSHL_rr    1110101 0010 1 ....  ....  1111 0000 1101  @mve_sh_rr
 +      LSLL_rr      1110101 0010 1 ... 0 .... ... 1 0000 1101  @mve_shl_rr
 +      UQRSHLL64_rr 1110101 0010 1 ... 1 .... ... 1 0000 1101  @mve_shl_rr
 +    }
 +
 +    {
 +      SQRSHR_rr    1110101 0010 1 ....  ....  1111 0010 1101  @mve_sh_rr
 +      ASRL_rr      1110101 0010 1 ... 0 .... ... 1 0010 1101  @mve_shl_rr
 +      SQRSHRL64_rr 1110101 0010 1 ... 1 .... ... 1 0010 1101  @mve_shl_rr
 +    }
 +
      UQRSHLL48_rr 1110101 0010 1 ... 1 ....  ... 1  1000 1101  @mve_shl_rr
      SQRSHRL48_rr 1110101 0010 1 ... 1 ....  ... 1  1010 1101  @mve_shl_rr
    ]
 diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/mve_helper.c
 +++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mve_sqshl)(CPUARMState *env, uint32_t n, uint32_t shift)
  {
      return do_sqrshl_bhs(n, (int8_t)shift, 32, false, &env->QF);
  }
++
--static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
++uint32_t HELPER(mve_uqrshl)(CPUARMState *env, uint32_t n, uint32_t shift)
--{
++{
--    uint32_t rd, rn, rm;
++    return do_uqrshl_bhs(n, (int8_t)shift, 32, true, &env->QF);
--    bool dp = a->dp;
++}
--    bool vmin = a->op;
++
--    TCGv_ptr fpst;
++uint32_t HELPER(mve_sqrshr)(CPUARMState *env, uint32_t n, uint32_t shift)
--
++{
--    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
++    return do_sqrshl_bhs(n, -(int8_t)shift, 32, true, &env->QF);
--        return false;
++}
--    }
+diff --git a/target/arm/translate.c b/target/arm/translate.c
--
+index XXXXXXX..XXXXXXX 100644
--    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+--- a/target/arm/translate.c
--        return false;
++++ b/target/arm/translate.c
--    }
+@@ -XXX,XX +XXX,XX @@ static bool trans_UQSHL_ri(DisasContext *s, arg_mve_sh_ri *a)
--
+     return do_mve_sh_ri(s, a, gen_mve_uqshl);
 -    /* UNDEF accesses to D16-D31 if they don't exist */
 -    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
 -        ((a->vm | a->vn | a->vd) & 0x10)) {
 -        return false;
 -    }
 -
 -    rd = a->vd;
 -    rn = a->vn;
 -    rm = a->vm;
 -
 -    if (!vfp_access_check(s)) {
 -        return true;
 -    }
 -
 -    fpst = get_fpstatus_ptr(0);
 -
 -    if (dp) {
 -        TCGv_i64 frn, frm, dest;
 -
 -        frn = tcg_temp_new_i64();
 -        frm = tcg_temp_new_i64();
 -        dest = tcg_temp_new_i64();
 -
 -        neon_load_reg64(frn, rn);
 -        neon_load_reg64(frm, rm);
 -        if (vmin) {
 -            gen_helper_vfp_minnumd(dest, frn, frm, fpst);
 -        } else {
 -            gen_helper_vfp_maxnumd(dest, frn, frm, fpst);
 -        }
 -        neon_store_reg64(dest, rd);
 -        tcg_temp_free_i64(frn);
 -        tcg_temp_free_i64(frm);
 -        tcg_temp_free_i64(dest);
 -    } else {
 -        TCGv_i32 frn, frm, dest;
 -
 -        frn = tcg_temp_new_i32();
 -        frm = tcg_temp_new_i32();
 -        dest = tcg_temp_new_i32();
 -
 -        neon_load_reg32(frn, rn);
 -        neon_load_reg32(frm, rm);
 -        if (vmin) {
 -            gen_helper_vfp_minnums(dest, frn, frm, fpst);
 -        } else {
 -            gen_helper_vfp_maxnums(dest, frn, frm, fpst);
 -        }
 -        neon_store_reg32(dest, rd);
 -        tcg_temp_free_i32(frn);
 -        tcg_temp_free_i32(frm);
 -        tcg_temp_free_i32(dest);
 -    }
 -
 -    tcg_temp_free_ptr(fpst);
 -    return true;
 -}
 -
  /*
   * Table for converting the most common AArch32 encoding of
   * rounding mode to arm_fprounding order (which matches the
@@ -XXX,XX +XXX,XX @@ static bool trans_VDIV_dp(DisasContext *s, arg_VDIV_dp *a)
      return do_vfp_3op_dp(s, gen_helper_vfp_divd, a->vd, a->vn, a->vm, false);
  }
-+static bool trans_VMINNM_sp(DisasContext *s, arg_VMINNM_sp *a)
++static bool do_mve_sh_rr(DisasContext *s, arg_mve_sh_rr *a, ShiftFn *fn)
 +{
-+    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
++    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
 +        /* Decode falls through to ORR/MOV UNPREDICTABLE handling */
 +        return false;
 +    }
-+    return do_vfp_3op_sp(s, gen_helper_vfp_minnums,
++    if (!dc_isar_feature(aa32_mve, s) ||
-+                         a->vd, a->vn, a->vm, false);
++        !arm_dc_feature(s, ARM_FEATURE_M_MAIN) ||
 +        a->rda == 13 || a->rda == 15 || a->rm == 13 || a->rm == 15 ||
 +        a->rm == a->rda) {
 +        /* These rda/rm cases are UNPREDICTABLE; we choose to UNDEF */
 +        unallocated_encoding(s);
 +        return true;
 +    }
 +
 +    /* The helper takes care of the sign-extension of the low 8 bits of Rm */
 +    fn(cpu_R[a->rda], cpu_env, cpu_R[a->rda], cpu_R[a->rm]);
 +    return true;
 +}
 +
-+static bool trans_VMAXNM_sp(DisasContext *s, arg_VMAXNM_sp *a)
++static bool trans_SQRSHR_rr(DisasContext *s, arg_mve_sh_rr *a)
 +{
-+    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
++    return do_mve_sh_rr(s, a, gen_helper_mve_sqrshr);
 +        return false;
 +    }
 +    return do_vfp_3op_sp(s, gen_helper_vfp_maxnums,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
-+static bool trans_VMINNM_dp(DisasContext *s, arg_VMINNM_dp *a)
++static bool trans_UQRSHL_rr(DisasContext *s, arg_mve_sh_rr *a)
 +{
-+    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
++    return do_mve_sh_rr(s, a, gen_helper_mve_uqrshl);
 +        return false;
 +    }
 +    return do_vfp_3op_dp(s, gen_helper_vfp_minnumd,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
-+static bool trans_VMAXNM_dp(DisasContext *s, arg_VMAXNM_dp *a)
+ /*
-+{
+  * Multiply and multiply accumulate
-+    if (!dc_isar_feature(aa32_vminmaxnm, s)) {
+  */
 +        return false;
 +    }
 +    return do_vfp_3op_dp(s, gen_helper_vfp_maxnumd,
 +                         a->vd, a->vn, a->vm, false);
 +}
 +
  static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
  {
      /*
 diff --git a/target/arm/vfp-uncond.decode b/target/arm/vfp-uncond.decode
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp-uncond.decode
 +++ b/target/arm/vfp-uncond.decode
@@ -XXX,XX +XXX,XX @@
  %vd_dp  22:1 12:4
  %vd_sp  12:4 22:1
 +@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
 +@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
 +
  VSEL        1111 1110 0. cc:2 .... .... 1010 .0.0 .... \
              vm=%vm_sp vn=%vn_sp vd=%vd_sp dp=0
  VSEL        1111 1110 0. cc:2 .... .... 1011 .0.0 .... \
              vm=%vm_dp vn=%vn_dp vd=%vd_dp dp=1
 -VMINMAXNM   1111 1110 1.00 .... .... 1010 . op:1 .0 .... \
 -            vm=%vm_sp vn=%vn_sp vd=%vd_sp dp=0
 -VMINMAXNM   1111 1110 1.00 .... .... 1011 . op:1 .0 .... \
 -            vm=%vm_dp vn=%vn_dp vd=%vd_dp dp=1
 +VMAXNM_sp   1111 1110 1.00 .... .... 1010 .0.0 ....         @vfp_dnm_s
 +VMINNM_sp   1111 1110 1.00 .... .... 1010 .1.0 ....         @vfp_dnm_s
 +
 +VMAXNM_dp   1111 1110 1.00 .... .... 1011 .0.0 ....         @vfp_dnm_d
 +VMINNM_dp   1111 1110 1.00 .... .... 1011 .1.0 ....         @vfp_dnm_d
  VRINT       1111 1110 1.11 10 rm:2 .... 1010 01.0 .... \
              vm=%vm_sp vd=%vd_sp dp=0
 --
 .20.1

-[PULL 24/33] hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class
+Deleted patch
-From: Guenter Roeck <linux@roeck-us.net>
-Xilinx USB devices are now instantiated through TYPE_CHIPIDEA,
-and xlnx support in the EHCI code is no longer needed.
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Message-id: 20200215122354.13706-3-linux@roeck-us.net
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/usb/hcd-ehci-sysbus.c | 17 -----------------
-file changed, 17 deletions(-)
-diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/usb/hcd-ehci-sysbus.c
-+++ b/hw/usb/hcd-ehci-sysbus.c
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_platform_type_info = {
-     .class_init    = ehci_platform_class_init,
- };
--static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
--{
--    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
--    DeviceClass *dc = DEVICE_CLASS(oc);
--
--    set_bit(DEVICE_CATEGORY_USB, dc->categories);
--    sec->capsbase = 0x100;
--    sec->opregbase = 0x140;
--}
--
--static const TypeInfo ehci_xlnx_type_info = {
--    .name          = "xlnx,ps7-usb",
--    .parent        = TYPE_SYS_BUS_EHCI,
--    .class_init    = ehci_xlnx_class_init,
--};
--
- static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
- {
-     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
- {
-     type_register_static(&ehci_type_info);
-     type_register_static(&ehci_platform_type_info);
--    type_register_static(&ehci_xlnx_type_info);
-     type_register_static(&ehci_exynos4210_type_info);
-     type_register_static(&ehci_tegra2_type_info);
-     type_register_static(&ehci_ppc4xx_type_info);
---
-.20.1

-[PULL 26/33] tests/acceptance: Add a test for the integratorcp arm machine
+Deleted patch
-From: Thomas Huth <thuth@redhat.com>
-There is a kernel and initrd available on github which we can use
-for testing this machine.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200225172501.29609-3-philmd@redhat.com
-Message-Id: <20200131170233.14584-1-thuth@redhat.com>
-[PMD: Renamed test method, moved description from class to method]
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS                                  |  1 +
- tests/acceptance/machine_arm_integratorcp.py | 43 ++++++++++++++++++++
-files changed, 44 insertions(+)
- create mode 100644 tests/acceptance/machine_arm_integratorcp.py
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ S: Maintained
- F: hw/arm/integratorcp.c
- F: hw/misc/arm_integrator_debug.c
- F: include/hw/misc/arm_integrator_debug.h
-+F: tests/acceptance/machine_arm_integratorcp.py
- MCIMX6UL EVK / i.MX6ul
- M: Peter Maydell <peter.maydell@linaro.org>
-diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/acceptance/machine_arm_integratorcp.py
-@@ -XXX,XX +XXX,XX @@
-+# Functional test that boots a Linux kernel and checks the console
-+#
-+# Copyright (c) 2020 Red Hat, Inc.
-+#
-+# Author:
-+#  Thomas Huth <thuth@redhat.com>
-+#
-+# This work is licensed under the terms of the GNU GPL, version 2 or
-+# later.  See the COPYING file in the top-level directory.
-+
-+import os
-+
-+from avocado import skipUnless
-+from avocado_qemu import Test
-+from avocado_qemu import wait_for_console_pattern
-+
-+class IntegratorMachine(Test):
-+
-+    timeout = 90
-+
-+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
-+    def test_integratorcp_console(self):
-+        """
-+        Boots the Linux kernel and checks that the console is operational
-+        :avocado: tags=arch:arm
-+        :avocado: tags=machine:integratorcp
-+        """
-+        kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
-+                      'arm-test/kernel/zImage.integrator')
-+        kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
-+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-+
-+        initrd_url = ('https://github.com/zayac/qemu-arm/raw/master/'
-+                      'arm-test/kernel/arm_root.img')
-+        initrd_hash = 'b51e4154285bf784e017a37586428332d8c7bd8b'
-+        initrd_path = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
-+
-+        self.vm.set_console()
-+        self.vm.add_args('-kernel', kernel_path,
-+                         '-initrd', initrd_path,
-+                         '-append', 'printk.time=0 console=ttyAMA0')
-+        self.vm.launch()
-+        wait_for_console_pattern(self, 'Log in as root')
---
-.20.1

-[PULL 27/33] tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-As we want to re-use this code, extract it as a new function.
-Since we are using the PL011 serial console, add a Avocado tag
-to ease filtering of tests.
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20200225172501.29609-4-philmd@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/acceptance/machine_arm_integratorcp.py | 18 +++++++++++-------
-file changed, 11 insertions(+), 7 deletions(-)
-diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/acceptance/machine_arm_integratorcp.py
-+++ b/tests/acceptance/machine_arm_integratorcp.py
-@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
-     timeout = 90
--    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
--    def test_integratorcp_console(self):
--        """
--        Boots the Linux kernel and checks that the console is operational
--        :avocado: tags=arch:arm
--        :avocado: tags=machine:integratorcp
--        """
-+    def boot_integratorcp(self):
-         kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
-                       'arm-test/kernel/zImage.integrator')
-         kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
-@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
-                          '-initrd', initrd_path,
-                          '-append', 'printk.time=0 console=ttyAMA0')
-         self.vm.launch()
-+
-+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
-+    def test_integratorcp_console(self):
-+        """
-+        Boots the Linux kernel and checks that the console is operational
-+        :avocado: tags=arch:arm
-+        :avocado: tags=machine:integratorcp
-+        :avocado: tags=device:pl011
-+        """
-+        self.boot_integratorcp()
-         wait_for_console_pattern(self, 'Log in as root')
---
-.20.1

Another arm pullreq; nothing particularly exciting here.

-- PMM

The following changes since commit e27d5b488ef08408691bfed61f34ee2858136287:

Merge remote-tracking branch 'remotes/juanquintela/tags/pull-migration-pull-request' into staging (2020-02-28 14:02:31 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200228

for you to fetch changes up to 1904f9b5f1d94fe12fe021db6b504c87d684f6db:

hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2 (2020-02-28 16:14:57 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Use TYPE_PL011 to create serial port
 * target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
 * hw/arm/integratorcp: Map the audio codec controller
 * GICv2: Correctly implement the limited number of priority bits
 * target/arm: refactoring of VFP related feature checks and decode
 * xilinx_zynq: Fix USB port instantiation
 * acceptance tests for n800, n810, integratorcp
 * Implement v8.3-RCPC, v8.4-RCPC, v8.3-CCIDX
 * arm_gic_kvm: Don't assume kernel can provide a GICv2
   (provide better error message for user error)

----------------------------------------------------------------
Gavin Shan (1):
      hw/arm: Use TYPE_PL011 to create serial port

Guenter Roeck (2):
      hw/arm/xilinx_zynq: Fix USB port instantiation
      hw/usb/hcd-ehci-sysbus: Remove obsolete xlnx, ps7-usb class

Peter Maydell (5):
      target/arm: Fix wrong use of FIELD_EX32 on ID_AA64DFR0
      target/arm: Implement v8.3-RCPC
      target/arm: Implement v8.4-RCPC
      target/arm: Implement ARMv8.3-CCIDX
      hw/intc/arm_gic_kvm: Don't assume kernel can provide a GICv2

Philippe Mathieu-Daudé (3):
      hw/arm/integratorcp: Map the audio codec controller
      tests/acceptance: Extract boot_integratorcp() from test_integratorcp()
      tests/acceptance/integratorcp: Verify Tux is displayed on framebuffer

Richard Henderson (17):
      target/arm: Set ID_MMFR4.HPDS for aarch64_max_initfn
      target/arm: Add isar_feature_aa32_vfp_simd
      target/arm: Rename isar_feature_aa32_fpdp_v2
      target/arm: Add isar_feature_aa32_{fpsp_v2, fpsp_v3, fpdp_v3}
      target/arm: Add isar_feature_aa64_fp_simd, isar_feature_aa32_vfp
      target/arm: Perform fpdp_v2 check first
      target/arm: Replace ARM_FEATURE_VFP3 checks with fp{sp, dp}_v3
      target/arm: Add missing checks for fpsp_v2
      target/arm: Replace ARM_FEATURE_VFP4 with isar_feature_aa32_simdfmac
      target/arm: Remove ARM_FEATURE_VFP check from disas_vfp_insn
      target/arm: Move VLLDM and VLSTM to vfp.decode
      target/arm: Move the vfp decodetree calls next to the base isa
      linux-user/arm: Replace ARM_FEATURE_VFP* tests for HWCAP
      target/arm: Remove ARM_FEATURE_VFP*
      target/arm: Add formats for some vfp 2 and 3-register insns
      target/arm: Split VFM decode
      target/arm: Split VMINMAXNM decode

Sai Pavan Boddu (3):
      arm_gic: Mask the un-supported priority bits
      cpu/a9mpcore: Set number of GIC priority bits to 5
      cpu/arm11mpcore: Set number of GIC priority bits to 4

Thomas Huth (2):
      tests/acceptance: Add a test for the N800 and N810 arm machines
      tests/acceptance: Add a test for the integratorcp arm machine

From: Gavin Shan <gshan@redhat.com>

This uses TYPE_PL011 when creating the serial port so that the code
looks cleaner.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20200224222223.4128-1-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c    | 3 ++-
 hw/arm/virt.c        | 3 ++-
 hw/arm/xlnx-versal.c | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci-host/gpex.h"
 #include "hw/qdev-properties.h"
 #include "hw/usb.h"
+#include "hw/char/pl011.h"
 #include "net/net.h"
 
 #define RAMLIMIT_GB 8192
@@ -XXX,XX +XXX,XX @@ static void create_uart(const SBSAMachineState *sms, int uart,
 {
     hwaddr base = sbsa_ref_memmap[uart].base;
     int irq = sbsa_ref_irqmap[uart];
-    DeviceState *dev = qdev_create(NULL, "pl011");
+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
 
     qdev_prop_set_chr(dev, "chardev", chr);
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/mem/nvdimm.h"
 #include "hw/acpi/generic_event_device.h"
 #include "hw/virtio/virtio-iommu.h"
+#include "hw/char/pl011.h"
 
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static void create_uart(const VirtMachineState *vms, int uart,
     int irq = vms->irqmap[uart];
     const char compat[] = "arm,pl011\0arm,primecell";
     const char clocknames[] = "uartclk\0apb_pclk";
-    DeviceState *dev = qdev_create(NULL, "pl011");
+    DeviceState *dev = qdev_create(NULL, TYPE_PL011);
     SysBusDevice *s = SYS_BUS_DEVICE(dev);
 
     qdev_prop_set_chr(dev, "chardev", chr);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/unimp.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "hw/arm/xlnx-versal.h"
+#include "hw/char/pl011.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define GEM_REVISION        0x40070106
@@ -XXX,XX +XXX,XX @@ static void versal_create_uarts(Versal *s, qemu_irq *pic)
         DeviceState *dev;
         MemoryRegion *mr;
 
-        dev = qdev_create(NULL, "pl011");
+        dev = qdev_create(NULL, TYPE_PL011);
         s->lpd.iou.uart[i] = SYS_BUS_DEVICE(dev);
         qdev_prop_set_chr(dev, "chardev", serial_hd(i));
         object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The Linux kernel displays errors why trying to detect the PL041
audio interface:

Linux version 4.16.0 (linus@genomnajs) (gcc version 7.2.1 20171011 (Linaro GCC 7.2-2017.11)) #142 PREEMPT Wed May 9 13:24:55 CEST 2018
  CPU: ARM926EJ-S [41069265] revision 5 (ARMv5TEJ), cr=00093177
  CPU: VIVT data cache, VIVT instruction cache
  OF: fdt: Machine model: ARM Integrator/CP
  ...
  OF: amba_device_add() failed (-19) for /fpga/aaci@1d000000

Since we have it already modelled, simply plug it.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200223233033.15371-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/integratorcp.c | 1 +
 hw/arm/Kconfig        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -XXX,XX +XXX,XX @@ static void integratorcp_init(MachineState *machine)
                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_WPROT, 0));
     qdev_connect_gpio_out(dev, 1,
                           qdev_get_gpio_in_named(icp, ICP_GPIO_MMC_CARDIN, 0));
+    sysbus_create_varargs("pl041", 0x1d000000, pic[25], NULL);
 
     if (nd_table[0].used)
         smc91c111_init(&nd_table[0], 0xc8000000, pic[27]);
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
     select INTEGRATOR_DEBUG
     select PL011 # UART
     select PL031 # RTC
+    select PL041 # audio
     select PL050 # keyboard/mouse
     select PL110 # pl111 LCD controller
     select PL181 # display
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

The GICv2 allows the implementation to implement a variable number
of priority bits; unimplemented bits in the priority registers
are read as zeros, writes ignored. We were previously always
implementing a full 8 bits of priority, which is allowed but not
what the real hardware typically does (which is usually to have
4 or 5 bits of priority).

Add a new device property to allow the number of implemented
property bits to be specified.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Message-id: 1582537164-764-2-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: improved commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/arm_gic.h        |  2 ++
 include/hw/intc/arm_gic_common.h |  1 +
 hw/intc/arm_gic.c                | 33 ++++++++++++++++++++++++++++++--
 hw/intc/arm_gic_common.c         |  1 +
 4 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/arm_gic.h b/include/hw/intc/arm_gic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gic.h
+++ b/include/hw/intc/arm_gic.h
@@ -XXX,XX +XXX,XX @@
 
 /* Number of SGI target-list bits */
 #define GIC_TARGETLIST_BITS 8
+#define GIC_MAX_PRIORITY_BITS 8
+#define GIC_MIN_PRIORITY_BITS 4
 
 #define TYPE_ARM_GIC "arm_gic"
 #define ARM_GIC(obj) \
diff --git a/include/hw/intc/arm_gic_common.h b/include/hw/intc/arm_gic_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gic_common.h
+++ b/include/hw/intc/arm_gic_common.h
@@ -XXX,XX +XXX,XX @@ typedef struct GICState {
     uint16_t priority_mask[GIC_NCPU_VCPU];
     uint16_t running_priority[GIC_NCPU_VCPU];
     uint16_t current_pending[GIC_NCPU_VCPU];
+    uint32_t n_prio_bits;
 
     /* If we present the GICv2 without security extensions to a guest,
      * the guest can configure the GICC_CTLR to configure group 1 binary point
diff --git a/hw/intc/arm_gic.c b/hw/intc/arm_gic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic.c
+++ b/hw/intc/arm_gic.c
@@ -XXX,XX +XXX,XX @@ uint32_t gic_acknowledge_irq(GICState *s, int cpu, MemTxAttrs attrs)
     return ret;
 }
 
+static uint32_t gic_fullprio_mask(GICState *s, int cpu)
+{
+    /*
+     * Return a mask word which clears the unimplemented priority
+     * bits from a priority value for an interrupt. (Not to be
+     * confused with the group priority, whose mask depends on BPR.)
+     */
+    int priBits;
+
+    if (gic_is_vcpu(cpu)) {
+        priBits = GIC_VIRT_MAX_GROUP_PRIO_BITS;
+    } else {
+        priBits = s->n_prio_bits;
+    }
+    return ~0U << (8 - priBits);
+}
+
 void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
                       MemTxAttrs attrs)
 {
@@ -XXX,XX +XXX,XX @@ void gic_dist_set_priority(GICState *s, int cpu, int irq, uint8_t val,
         val = 0x80 | (val >> 1); /* Non-secure view */
     }
 
+    val &= gic_fullprio_mask(s, cpu);
+
     if (irq < GIC_INTERNAL) {
         s->priority1[irq][cpu] = val;
     } else {
@@ -XXX,XX +XXX,XX @@ static uint32_t gic_dist_get_priority(GICState *s, int cpu, int irq,
         }
         prio = (prio << 1) & 0xff; /* Non-secure view */
     }
-    return prio;
+    return prio & gic_fullprio_mask(s, cpu);
 }
 
 static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
@@ -XXX,XX +XXX,XX @@ static void gic_set_priority_mask(GICState *s, int cpu, uint8_t pmask,
             return;
         }
     }
-    s->priority_mask[cpu] = pmask;
+    s->priority_mask[cpu] = pmask & gic_fullprio_mask(s, cpu);
 }
 
 static uint32_t gic_get_priority_mask(GICState *s, int cpu, MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static void arm_gic_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->n_prio_bits > GIC_MAX_PRIORITY_BITS ||
+       (s->virt_extn ? s->n_prio_bits < GIC_VIRT_MAX_GROUP_PRIO_BITS :
+        s->n_prio_bits < GIC_MIN_PRIORITY_BITS)) {
+        error_setg(errp, "num-priority-bits cannot be greater than %d"
+                   " or less than %d", GIC_MAX_PRIORITY_BITS,
+                   s->virt_extn ? GIC_VIRT_MAX_GROUP_PRIO_BITS :
+                   GIC_MIN_PRIORITY_BITS);
+        return;
+    }
+
     /* This creates distributor, main CPU interface (s->cpuiomem[0]) and if
      * enabled, virtualization extensions related interfaces (main virtual
      * interface (s->vifaceiomem[0]) and virtual CPU interface).
diff --git a/hw/intc/arm_gic_common.c b/hw/intc/arm_gic_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_common.c
+++ b/hw/intc/arm_gic_common.c
@@ -XXX,XX +XXX,XX @@ static Property arm_gic_common_properties[] = {
     DEFINE_PROP_BOOL("has-security-extensions", GICState, security_extn, 0),
     /* True if the GIC should implement the virtualization extensions */
     DEFINE_PROP_BOOL("has-virtualization-extensions", GICState, virt_extn, 0),
+    DEFINE_PROP_UINT32("num-priority-bits", GICState, n_prio_bits, 8),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

All A9 CPUs have a GIC with 5 bits of priority.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1582537164-764-3-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/a9mpcore.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/cpu/a9mpcore.c b/hw/cpu/a9mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/a9mpcore.c
+++ b/hw/cpu/a9mpcore.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/core/cpu.h"
 
+#define A9_GIC_NUM_PRIORITY_BITS    5
+
 static void a9mp_priv_set_irq(void *opaque, int irq, int level)
 {
     A9MPPrivState *s = (A9MPPrivState *)opaque;
@@ -XXX,XX +XXX,XX @@ static void a9mp_priv_realize(DeviceState *dev, Error **errp)
     gicdev = DEVICE(&s->gic);
     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
+                         A9_GIC_NUM_PRIORITY_BITS);
 
     /* Make the GIC's TZ support match the CPUs. We assume that
      * either all the CPUs have TZ, or none do.
-- 
2.20.1

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

The GIC built into the ARM11MPCore is always implemented with 4
priority bits; set the GIC property accordingly.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1582537164-764-4-git-send-email-sai.pavan.boddu@xilinx.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/cpu/arm11mpcore.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/cpu/arm11mpcore.c b/hw/cpu/arm11mpcore.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/cpu/arm11mpcore.c
+++ b/hw/cpu/arm11mpcore.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 
+#define ARM11MPCORE_NUM_GIC_PRIORITY_BITS    4
 
 static void mpcore_priv_set_irq(void *opaque, int irq, int level)
 {
@@ -XXX,XX +XXX,XX @@ static void mpcore_priv_realize(DeviceState *dev, Error **errp)
 
     qdev_prop_set_uint32(gicdev, "num-cpu", s->num_cpu);
     qdev_prop_set_uint32(gicdev, "num-irq", s->num_irq);
+    qdev_prop_set_uint32(gicdev, "num-priority-bits",
+                         ARM11MPCORE_NUM_GIC_PRIORITY_BITS);
+
+
     object_property_set_bool(OBJECT(&s->gic), true, "realized", &err);
     if (err != NULL) {
         error_propagate(errp, err);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Use this in the places that were checking ARM_FEATURE_VFP, and
are obviously testing for the existance of the register set
as opposed to testing for some particular instruction extension.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        |  9 +++++++++
 hw/intc/armv7m_nvic.c   | 20 ++++++++++----------
 linux-user/arm/signal.c |  4 ++--
 target/arm/arch_dump.c  | 11 ++++++-----
 target/arm/cpu.c        |  4 ++--
 target/arm/helper.c     |  4 ++--
 target/arm/m_helper.c   | 11 ++++++-----
 7 files changed, 37 insertions(+), 26 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_arith(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, FP) == 1;
 }
 
+static inline bool isar_feature_aa32_vfp_simd(const ARMISARegisters *id)
+{
+    /*
+     * Return true if either VFP or SIMD is implemented.
+     * In this case, a minimum of VFP w/ D0-D15.
+     */
+    return FIELD_EX32(id->mvfr0, MVFR0, SIMDREG) > 0;
+}
+
 static inline bool isar_feature_aa32_simd_r32(const ARMISARegisters *id)
 {
     /* Return true if D16-D31 are implemented */
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
     case 0xd84: /* CSSELR */
         return cpu->env.v7m.csselr[attrs.secure];
     case 0xd88: /* CPACR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.cpacr[attrs.secure];
     case 0xd8c: /* NSACR */
-        if (!attrs.secure || !arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!attrs.secure || !cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.nsacr;
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         }
         return cpu->env.v7m.sfar;
     case 0xf34: /* FPCCR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         if (attrs.secure) {
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             return value;
         }
     case 0xf38: /* FPCAR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.fpcar[attrs.secure];
     case 0xf3c: /* FPDSCR */
-        if (!arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             return 0;
         }
         return cpu->env.v7m.fpdscr[attrs.secure];
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     case 0xd88: /* CPACR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* We implement only the Floating Point extension's CP10/CP11 */
             cpu->env.v7m.cpacr[attrs.secure] = value & (0xf << 20);
         }
         break;
     case 0xd8c: /* NSACR */
-        if (attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (attrs.secure && cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* We implement only the Floating Point extension's CP10/CP11 */
             cpu->env.v7m.nsacr = value & (3 << 10);
         }
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         break;
     }
     case 0xf34: /* FPCCR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             /* Not all bits here are banked. */
             uint32_t fpccr_s;
 
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
         }
         break;
     case 0xf38: /* FPCAR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             value &= ~7;
             cpu->env.v7m.fpcar[attrs.secure] = value;
         }
         break;
     case 0xf3c: /* FPDSCR */
-        if (arm_feature(&cpu->env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             value &= 0x07c00000;
             cpu->env.v7m.fpdscr[attrs.secure] = value;
         }
diff --git a/linux-user/arm/signal.c b/linux-user/arm/signal.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/signal.c
+++ b/linux-user/arm/signal.c
@@ -XXX,XX +XXX,XX @@ static void setup_sigframe_v2(struct target_ucontext_v2 *uc,
     setup_sigcontext(&uc->tuc_mcontext, env, set->sig[0]);
     /* Save coprocessor signal frame.  */
     regspace = uc->tuc_regspace;
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
         regspace = setup_sigframe_v2_vfp(regspace, env);
     }
     if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
@@ -XXX,XX +XXX,XX @@ static int do_sigframe_return_v2(CPUARMState *env,
 
     /* Restore coprocessor signal frame */
     regspace = uc->tuc_regspace;
-    if (arm_feature(env, ARM_FEATURE_VFP)) {
+    if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
         regspace = restore_sigframe_v2_vfp(env, regspace);
         if (!regspace) {
             return 1;
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cs,
                              int cpuid, void *opaque)
 {
     struct arm_note note;
-    CPUARMState *env = &ARM_CPU(cs)->env;
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
     DumpState *s = opaque;
-    int ret, i, fpvalid = !!arm_feature(env, ARM_FEATURE_VFP);
+    int ret, i;
+    bool fpvalid = cpu_isar_feature(aa32_vfp_simd, cpu);
 
     arm_note_init(&note, s, "CORE", 5, NT_PRSTATUS, sizeof(note.prstatus));
 
@@ -XXX,XX +XXX,XX @@ int cpu_get_dump_info(ArchDumpInfo *info,
 ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
 {
     ARMCPU *cpu = ARM_CPU(first_cpu);
-    CPUARMState *env = &cpu->env;
     size_t note_size;
 
     if (class == ELFCLASS64) {
@@ -XXX,XX +XXX,XX @@ ssize_t cpu_get_note_size(int class, int machine, int nr_cpus)
         note_size += AARCH64_PRFPREG_NOTE_SIZE;
 #ifdef TARGET_AARCH64
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            note_size += AARCH64_SVE_NOTE_SIZE(env);
+            note_size += AARCH64_SVE_NOTE_SIZE(&cpu->env);
         }
 #endif
     } else {
         note_size = ARM_PRSTATUS_NOTE_SIZE;
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             note_size += ARM_VFP_NOTE_SIZE;
         }
     }
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
             env->v7m.ccr[M_REG_S] |= R_V7M_CCR_UNALIGN_TRP_MASK;
         }
 
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             env->v7m.fpccr[M_REG_NS] = R_V7M_FPCCR_ASPEN_MASK;
             env->v7m.fpccr[M_REG_S] = R_V7M_FPCCR_ASPEN_MASK |
                 R_V7M_FPCCR_LSPEN_MASK | R_V7M_FPCCR_S_MASK;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_dump_state(CPUState *cs, FILE *f, int flags)
         int numvfpregs = 0;
         if (cpu_isar_feature(aa32_simd_r32, cpu)) {
             numvfpregs = 32;
-        } else if (arm_feature(env, ARM_FEATURE_VFP)) {
+        } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
             numvfpregs = 16;
         }
         for (i = 0; i < numvfpregs; i++) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void cpacr_write(CPUARMState *env, const ARMCPRegInfo *ri,
          * ASEDIS [31] and D32DIS [30] are both UNK/SBZP without VFP.
          * TRCDIS [28] is RAZ/WI since we do not implement a trace macrocell.
          */
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
             /* VFP coprocessor: cp10 & cp11 [23:20] */
             mask |= (1 << 31) | (1 << 30) | (0xf << 20);
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
     } else if (cpu_isar_feature(aa32_simd_r32, cpu)) {
         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  35, "arm-vfp3.xml", 0);
-    } else if (arm_feature(env, ARM_FEATURE_VFP)) {
+    } else if (cpu_isar_feature(aa32_vfp_simd, cpu)) {
         gdb_register_coprocessor(cs, vfp_gdb_get_reg, vfp_gdb_set_reg,
                                  19, "arm-vfp.xml", 0);
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_integrity_sig(CPUARMState *env, uint32_t lr)
      */
     uint32_t sig = 0xfefa125a;
 
-    if (!arm_feature(env, ARM_FEATURE_VFP) || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
+    if (!cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))
+        || (lr & R_V7M_EXCRET_FTYPE_MASK)) {
         sig |= 1;
     }
     return sig;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain,
 
     if (dotailchain) {
         /* Sanitize LR FType and PREFIX bits */
-        if (!arm_feature(env, ARM_FEATURE_VFP)) {
+        if (!cpu_isar_feature(aa32_vfp_simd, cpu)) {
             lr |= R_V7M_EXCRET_FTYPE_MASK;
         }
         lr = deposit32(lr, 24, 8, 0xff);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
 
     ftype = excret & R_V7M_EXCRET_FTYPE_MASK;
 
-    if (!arm_feature(env, ARM_FEATURE_VFP) && !ftype) {
+    if (!ftype && !cpu_isar_feature(aa32_vfp_simd, cpu)) {
         qemu_log_mask(LOG_GUEST_ERROR, "M profile: zero FTYPE in exception "
                       "exit PC value 0x%" PRIx32 " is UNPREDICTABLE "
                       "if FPU not present\n",
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
              * SFPA is RAZ/WI from NS. FPCA is RO if NSACR.CP10 == 0,
              * RES0 if the FPU is not present, and is stored in the S bank
              */
-            if (arm_feature(env, ARM_FEATURE_VFP) &&
+            if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env)) &&
                 extract32(env->v7m.nsacr, 10, 1)) {
                 env->v7m.control[M_REG_S] &= ~R_V7M_CONTROL_FPCA_MASK;
                 env->v7m.control[M_REG_S] |= val & R_V7M_CONTROL_FPCA_MASK;
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
             env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
         }
-        if (arm_feature(env, ARM_FEATURE_VFP)) {
+        if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
             /*
              * SFPA is RAZ/WI from NS or if no FPU.
              * FPCA is RO if NSACR.CP10 == 0, RES0 if the FPU is not present.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The old name, isar_feature_aa32_fpdp, does not reflect
that the test includes VFPv2.  We will introduce another
feature tests for VFPv3.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               |  4 ++--
 target/arm/translate-vfp.inc.c | 40 +++++++++++++++++-----------------
 2 files changed, 22 insertions(+), 22 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

We will shortly use these to test for VFPv2 and VFPv3
in different situations.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

We cannot easily create "any" functions for these, because the
ID_AA64PFR0 fields for FP and SIMD signal "enabled" with zero.
Which means that an aarch32-only cpu will return incorrect results
when testing the aarch64 registers.

To use these, we must either have context or additionally test
vs ARM_FEATURE_AARCH64.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 11 +++++++++++
 target/arm/cpu.c     |  9 ++++++---
 target/arm/machine.c |  5 +++--
 3 files changed, 20 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Shuffle the order of the checks so that we test the ISA
before we test anything else, such as the register arguments.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 140 +++++++++++++++++----------------
 1 file changed, 71 insertions(+), 69 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VSEL(DisasContext *s, arg_VSEL *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vn | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VMINMAXNM(DisasContext *s, arg_VMINMAXNM *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vn | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vn | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
-        ((a->vm | a->vd) & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vm | a->vd) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
         return false;
     }
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (dp && !dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (dp && !dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
     TCGv_i64 f0, f1, fd;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vn | vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_2op_dp(DisasContext *s, VFPGen2OpDPFn *fn, int vd, int vm)
     int veclen = s->vec_len;
     TCGv_i64 f0, fd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist */
-    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist */
+    if (!dc_isar_feature(aa32_simd_r32, s) && ((vd | vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) &&
+        ((a->vd | a->vn | a->vm) & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VMOV_imm_dp(DisasContext *s, arg_VMOV_imm_dp *a)
 
     vd = a->vd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
 {
     TCGv_i64 vd, vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     /* Vm/M bits must be zero for the Z variant */
     if (a->z && a->vm != 0) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCMP_dp(DisasContext *s, arg_VCMP_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
     TCGv_i32 tmp;
     TCGv_i64 vd;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
     TCGv_i32 tmp;
     TCGv_i64 vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_fp16_dpconv, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
     TCGv_ptr fpst;
     TCGv_i64 tmp;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
     TCGv_i64 tmp;
     TCGv_i32 tcg_rmode;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
     TCGv_ptr fpst;
     TCGv_i64 tmp;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_vrint, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
     TCGv_i64 vd;
     TCGv_i32 vm;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
     TCGv_i64 vm;
     TCGv_i32 vd;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
     TCGv_i64 vd;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vd & 0x10)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
     TCGv_i32 vd;
     TCGv_i64 vm;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!dc_isar_feature(aa32_jscvt, s)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VJCVT(DisasContext *s, arg_VJCVT *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
     TCGv_ptr fpst;
     int frac_bits;
 
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+
     if (!arm_dc_feature(s, ARM_FEATURE_VFP3)) {
         return false;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
-        return false;
-    }
-
     if (!vfp_access_check(s)) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     TCGv_i64 vm;
     TCGv_ptr fpst;
 
-    /* UNDEF accesses to D16-D31 if they don't exist. */
-    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
+    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
         return false;
     }
 
-    if (!dc_isar_feature(aa32_fpdp_v2, s)) {
+    /* UNDEF accesses to D16-D31 if they don't exist. */
+    if (!dc_isar_feature(aa32_simd_r32, s) && (a->vm & 0x10)) {
         return false;
     }
 
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Sort this check to the start of a trans_* function.
Merge this with any existing test for fpdp_v2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 24 ++++++++----------------
 1 file changed, 8 insertions(+), 16 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

We will eventually remove the early ARM_FEATURE_VFP test,
so add a proper test for each trans_* that does not already
have another ISA test.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 78 ++++++++++++++++++++++++++++++----
 1 file changed, 69 insertions(+), 9 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

All remaining tests for VFP4 are for fused multiply-add insns.

Since the MVFR1 field is used for both VFP and NEON, move its adjustment
from the !has_neon block to the (!has_vfp && !has_neon) block.

Test for vfp of the appropraite width alongside the test for simdfmac
within translate-vfp.inc.c.  Within disas_neon_data_insn, we have
already tested for ARM_FEATURE_NEON.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               | 12 ++++++++++++
 target/arm/cpu.c               |  6 +++++-
 target/arm/translate-vfp.inc.c | 22 ++++++++++++++++++----
 target/arm/translate.c         |  2 +-
 4 files changed, 36 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_fp16_dpconv(const ARMISARegisters *id)
     return FIELD_EX32(id->mvfr1, MVFR1, FPHP) > 1;
 }
 
+/*
+ * Note that this ID register field covers both VFP and Neon FMAC,
+ * so should usually be tested in combination with some other
+ * check that confirms the presence of whichever of VFP or Neon is
+ * relevant, to avoid accidentally enabling a Neon feature on
+ * a VFP-no-Neon core or vice-versa.
+ */
+static inline bool isar_feature_aa32_simdfmac(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->mvfr1, MVFR1, SIMDFMAC) != 0;
+}
+
 static inline bool isar_feature_aa32_vsel(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->mvfr2, MVFR2, FPMISC) >= 1;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         u = FIELD_DP32(u, MVFR1, SIMDINT, 0);
         u = FIELD_DP32(u, MVFR1, SIMDSP, 0);
         u = FIELD_DP32(u, MVFR1, SIMDHP, 0);
-        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
         cpu->isar.mvfr1 = u;
 
         u = cpu->isar.mvfr2;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         u = cpu->isar.mvfr0;
         u = FIELD_DP32(u, MVFR0, SIMDREG, 0);
         cpu->isar.mvfr0 = u;
+
+        /* Despite the name, this field covers both VFP and Neon */
+        u = cpu->isar.mvfr1;
+        u = FIELD_DP32(u, MVFR1, SIMDFMAC, 0);
+        cpu->isar.mvfr1 = u;
     }
 
     if (arm_feature(env, ARM_FEATURE_M) && !cpu->has_dsp) {
diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_sp(DisasContext *s, arg_VFM_sp *a)
 
     /*
      * Present in VFPv4 only.
+     * Note that we can't rely on the SIMDFMAC check alone, because
+     * in a Neon-no-VFP core that ID register field will be non-zero.
+     */
+    if (!dc_isar_feature(aa32_simdfmac, s) ||
+        !dc_isar_feature(aa32_fpsp_v2, s)) {
+        return false;
+    }
+    /*
      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
      */
-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
-        (s->vec_len != 0 || s->vec_stride != 0)) {
+    if (s->vec_len != 0 || s->vec_stride != 0) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VFM_dp(DisasContext *s, arg_VFM_dp *a)
 
     /*
      * Present in VFPv4 only.
+     * Note that we can't rely on the SIMDFMAC check alone, because
+     * in a Neon-no-VFP core that ID register field will be non-zero.
+     */
+    if (!dc_isar_feature(aa32_simdfmac, s) ||
+        !dc_isar_feature(aa32_fpdp_v2, s)) {
+        return false;
+    }
+    /*
      * In v7A, UNPREDICTABLE with non-zero vector length/stride; from
      * v8A, must UNDEF. We choose to UNDEF for both v7A and v8A.
      */
-    if (!arm_dc_feature(s, ARM_FEATURE_VFP4) ||
-        (s->vec_len != 0 || s->vec_stride != 0)) {
+    if (s->vec_len != 0 || s->vec_stride != 0) {
         return false;
     }
 
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static int disas_neon_data_insn(DisasContext *s, uint32_t insn)
             }
             break;
         case NEON_3R_VFM_VQRDMLSH:
-            if (!arm_dc_feature(s, ARM_FEATURE_VFP4)) {
+            if (!dc_isar_feature(aa32_simdfmac, s)) {
                 return 1;
             }
             break;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Now that we no longer have an early check for ARM_FEATURE_VFP,
we can use the proper ISA check in trans_VLLDM_VLSTM.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 39 +++++++++++++++++++++++++
 target/arm/translate.c         | 53 ++++++----------------------------
 target/arm/vfp.decode          |  2 ++
 3 files changed, 50 insertions(+), 44 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
     tcg_temp_free_ptr(fpst);
     return true;
 }
+
+/*
+ * Decode VLLDM and VLSTM are nonstandard because:
+ *  * if there is no FPU then these insns must NOP in
+ *    Secure state and UNDEF in Nonsecure state
+ *  * if there is an FPU then these insns do not have
+ *    the usual behaviour that vfp_access_check() provides of
+ *    being controlled by CPACR/NSACR enable bits or the
+ *    lazy-stacking logic.
+ */
+static bool trans_VLLDM_VLSTM(DisasContext *s, arg_VLLDM_VLSTM *a)
+{
+    TCGv_i32 fptr;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_M) ||
+        !arm_dc_feature(s, ARM_FEATURE_V8)) {
+        return false;
+    }
+    /* If not secure, UNDEF. */
+    if (!s->v8m_secure) {
+        return false;
+    }
+    /* If no fpu, NOP. */
+    if (!dc_isar_feature(aa32_vfp, s)) {
+        return true;
+    }
+
+    fptr = load_reg(s, a->rn);
+    if (a->l) {
+        gen_helper_v7m_vlldm(cpu_env, fptr);
+    } else {
+        gen_helper_v7m_vlstm(cpu_env, fptr);
+    }
+    tcg_temp_free_i32(fptr);
+
+    /* End the TB, because we have updated FP control bits */
+    s->base.is_jmp = DISAS_UPDATE;
+    return true;
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op; /* op0 = 0b11 : unallocated */
             }
 
-            /*
-             * Decode VLLDM and VLSTM first: these are nonstandard because:
-             *  * if there is no FPU then these insns must NOP in
-             *    Secure state and UNDEF in Nonsecure state
-             *  * if there is an FPU then these insns do not have
-             *    the usual behaviour that disas_vfp_insn() provides of
-             *    being controlled by CPACR/NSACR enable bits or the
-             *    lazy-stacking logic.
-             */
-            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
-                (insn & 0xffa00f00) == 0xec200a00) {
-                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
-                 *  - VLLDM, VLSTM
-                 * We choose to UNDEF if the RAZ bits are non-zero.
-                 */
-                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+            if (disas_vfp_insn(s, insn)) {
+                if (((insn >> 8) & 0xe) == 10 &&
+                    dc_isar_feature(aa32_fpsp_v2, s)) {
+                    /* FP, and the CPU supports it */
                     goto illegal_op;
+                } else {
+                    /* All other insns: NOCP */
+                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                                       syn_uncategorized(),
+                                       default_exception_el(s));
                 }
-
-                if (arm_dc_feature(s, ARM_FEATURE_VFP)) {
-                    uint32_t rn = (insn >> 16) & 0xf;
-                    TCGv_i32 fptr = load_reg(s, rn);
-
-                    if (extract32(insn, 20, 1)) {
-                        gen_helper_v7m_vlldm(cpu_env, fptr);
-                    } else {
-                        gen_helper_v7m_vlstm(cpu_env, fptr);
-                    }
-                    tcg_temp_free_i32(fptr);
-
-                    /* End the TB, because we have updated FP control bits */
-                    s->base.is_jmp = DISAS_UPDATE;
-                }
-                break;
             }
-            if (arm_dc_feature(s, ARM_FEATURE_VFP) &&
-                ((insn >> 8) & 0xe) == 10) {
-                /* FP, and the CPU supports it */
-                if (disas_vfp_insn(s, insn)) {
-                    goto illegal_op;
-                }
-                break;
-            }
-
-            /* All other insns: NOCP */
-            gen_exception_insn(s, s->pc_curr, EXCP_NOCP, syn_uncategorized(),
-                               default_exception_el(s));
             break;
         }
         if ((insn & 0xfe000a00) == 0xfc000800
diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp.decode
+++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@ VCVT_sp_int  ---- 1110 1.11 110 s:1 .... 1010 rz:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
 VCVT_dp_int  ---- 1110 1.11 110 s:1 .... 1011 rz:1 1.0 .... \
              vd=%vd_sp vm=%vm_dp
+
+VLLDM_VLSTM  1110 1100 001 l:1 rn:4 0000 1010 0000 0000
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Have the calls adjacent as an intermediate step toward
actually merging the decodes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 83 +++++++++++++++---------------------------
 1 file changed, 29 insertions(+), 54 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_neon_dup_high16(TCGv_i32 var)
     tcg_temp_free_i32(tmp);
 }
 
-/*
- * Disassemble a VFP instruction.  Returns nonzero if an error occurred
- * (ie. an undefined instruction).
- */
-static int disas_vfp_insn(DisasContext *s, uint32_t insn)
-{
-    /*
-     * If the decodetree decoder handles this insn it will always
-     * emit code to either execute the insn or generate an appropriate
-     * exception; so we don't need to ever return non-zero to tell
-     * the calling code to emit an UNDEF exception.
-     */
-    if (extract32(insn, 28, 4) == 0xf) {
-        if (disas_vfp_uncond(s, insn)) {
-            return 0;
-        }
-    } else {
-        if (disas_vfp(s, insn)) {
-            return 0;
-        }
-    }
-    /* If the decodetree decoder didn't handle this insn, it must be UNDEF */
-    return 1;
-}
-
 static inline bool use_goto_tb(DisasContext *s, target_ulong dest)
 {
 #ifndef CONFIG_USER_ONLY
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         ARCH(5);
 
         /* Unconditional instructions.  */
-        if (disas_a32_uncond(s, insn)) {
+        /* TODO: Perhaps merge these into one decodetree output file.  */
+        if (disas_a32_uncond(s, insn) ||
+            disas_vfp_uncond(s, insn)) {
             return;
         }
         /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             }
             return;
         }
-        if ((insn & 0x0f000e10) == 0x0e000a00) {
-            /* VFP.  */
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
-            return;
-        }
         if ((insn & 0x0e000f00) == 0x0c000100) {
             if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
                 /* iWMMXt register transfer.  */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         arm_skip_unless(s, cond);
     }
 
-    if (disas_a32(s, insn)) {
+    /* TODO: Perhaps merge these into one decodetree output file.  */
+    if (disas_a32(s, insn) ||
+        disas_vfp(s, insn)) {
         return;
     }
     /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
     case 0xd:
     case 0xe:
         if (((insn >> 8) & 0xe) == 10) {
-            /* VFP.  */
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
-        } else if (disas_coproc_insn(s, insn)) {
+            /* VFP, but failed disas_vfp.  */
+            goto illegal_op;
+        }
+        if (disas_coproc_insn(s, insn)) {
             /* Coprocessor.  */
             goto illegal_op;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         ARCH(6T2);
     }
 
-    if (disas_t32(s, insn)) {
+    /*
+     * TODO: Perhaps merge these into one decodetree output file.
+     * Note disas_vfp is written for a32 with cond field in the
+     * top nibble.  The t32 encoding requires 0xe in the top nibble.
+     */
+    if (disas_t32(s, insn) ||
+        disas_vfp_uncond(s, insn) ||
+        ((insn >> 28) == 0xe && disas_vfp(s, insn))) {
         return;
     }
     /* fall back to legacy decoder */
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op; /* op0 = 0b11 : unallocated */
             }
 
-            if (disas_vfp_insn(s, insn)) {
-                if (((insn >> 8) & 0xe) == 10 &&
-                    dc_isar_feature(aa32_fpsp_v2, s)) {
-                    /* FP, and the CPU supports it */
-                    goto illegal_op;
-                } else {
-                    /* All other insns: NOCP */
-                    gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
-                                       syn_uncategorized(),
-                                       default_exception_el(s));
-                }
+            if (((insn >> 8) & 0xe) == 10 &&
+                dc_isar_feature(aa32_fpsp_v2, s)) {
+                /* FP, and the CPU supports it */
+                goto illegal_op;
+            } else {
+                /* All other insns: NOCP */
+                gen_exception_insn(s, s->pc_curr, EXCP_NOCP,
+                                   syn_uncategorized(),
+                                   default_exception_el(s));
             }
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
                 goto illegal_op;
             }
         } else if (((insn >> 8) & 0xe) == 10) {
-            if (disas_vfp_insn(s, insn)) {
-                goto illegal_op;
-            }
+            /* VFP, but failed disas_vfp.  */
+            goto illegal_op;
         } else {
             if (insn & (1 << 28))
                 goto illegal_op;
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Use isar feature tests instead of feature bit tests.

Although none of QEMUs current cpus have VFPv3 without D32,
replace the large comment explaining why with one line that
sets ARM_HWCAP_ARM_VFPv3D16 under the correct conditions.
Mirror the test sequence used in the linux kernel.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20200224222232.13807-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/elfload.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -XXX,XX +XXX,XX @@ static uint32_t get_elf_hwcap(void)
 
     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
-    GET_FEATURE(ARM_FEATURE_VFP, ARM_HWCAP_ARM_VFP);
     GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPv3);
     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
-    GET_FEATURE(ARM_FEATURE_VFP4, ARM_HWCAP_ARM_VFPv4);
+    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
     GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
     GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
-    /* All QEMU's VFPv3 CPUs have 32 registers, see VFP_DREG in translate.c.
-     * Note that the ARM_HWCAP_ARM_VFPv3D16 bit is always the inverse of
-     * ARM_HWCAP_ARM_VFPD32 (and so always clear for QEMU); it is unrelated
-     * to our VFP_FP16 feature bit.
-     */
-    GET_FEATURE(ARM_FEATURE_VFP3, ARM_HWCAP_ARM_VFPD32);
-    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
+    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
+
+    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
+        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
+        hwcaps |= ARM_HWCAP_ARM_VFPv3;
+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
+            hwcaps |= ARM_HWCAP_ARM_VFPD32;
+        } else {
+            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
+        }
+    }
+    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
 
     return hwcaps;
 }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We have converted all tests against these features
to ISAR tests.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   |  3 ---
 target/arm/cpu.c   | 25 -------------------------
 target/arm/cpu64.c |  3 ---
 target/arm/kvm32.c |  5 -----
 target/arm/kvm64.c |  1 -
 5 files changed, 37 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
  * mapping in linux-user/elfload.c:get_elf_hwcap().
  */
 enum arm_features {
-    ARM_FEATURE_VFP,
     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
     ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V7,
     ARM_FEATURE_THUMB2,
     ARM_FEATURE_PMSA,   /* no MMU; may have Memory Protection Unit */
-    ARM_FEATURE_VFP3,
     ARM_FEATURE_NEON,
     ARM_FEATURE_M, /* Microcontroller profile.  */
     ARM_FEATURE_OMAPCP, /* OMAP specific CP15 ops handling.  */
@@ -XXX,XX +XXX,XX @@ enum arm_features {
     ARM_FEATURE_V5,
     ARM_FEATURE_STRONGARM,
     ARM_FEATURE_VAPA, /* cp15 VA to PA lookups */
-    ARM_FEATURE_VFP4, /* VFPv4 (implies that NEON is v2) */
     ARM_FEATURE_GENERIC_TIMER,
     ARM_FEATURE_MVFR, /* Media and VFP Feature Registers 0 and 1 */
     ARM_FEATURE_DUMMY_C15_REGS, /* RAZ/WI all of cp15 crn=15 */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
         set_feature(&cpu->env, ARM_FEATURE_PMSA);
     }
-    /* Similarly for the VFP feature bits */
-    if (arm_feature(&cpu->env, ARM_FEATURE_VFP4)) {
-        set_feature(&cpu->env, ARM_FEATURE_VFP3);
-    }
-    if (arm_feature(&cpu->env, ARM_FEATURE_VFP3)) {
-        set_feature(&cpu->env, ARM_FEATURE_VFP);
-    }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_CBAR) ||
         arm_feature(&cpu->env, ARM_FEATURE_CBAR_RO)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         uint64_t t;
         uint32_t u;
 
-        unset_feature(env, ARM_FEATURE_VFP);
-        unset_feature(env, ARM_FEATURE_VFP3);
-        unset_feature(env, ARM_FEATURE_VFP4);
-
         t = cpu->isar.id_aa64isar1;
         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 0);
         cpu->isar.id_aa64isar1 = t;
@@ -XXX,XX +XXX,XX @@ static void arm926_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm926";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
     cpu->midr = 0x41069265;
@@ -XXX,XX +XXX,XX @@ static void arm1026_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1026";
     set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_AUXCR);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_TEST_CLEAN);
@@ -XXX,XX +XXX,XX @@ static void arm1136_r2_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1136";
     set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1136_initfn(Object *obj)
     cpu->dtb_compatible = "arm,arm1136";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
     set_feature(&cpu->env, ARM_FEATURE_V6);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_BLOCK_OPS);
@@ -XXX,XX +XXX,XX @@ static void arm1176_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm1176";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_VAPA);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CACHE_DIRTY_REG);
@@ -XXX,XX +XXX,XX @@ static void arm11mpcore_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,arm11mpcore";
     set_feature(&cpu->env, ARM_FEATURE_V6K);
-    set_feature(&cpu->env, ARM_FEATURE_VFP);
     set_feature(&cpu->env, ARM_FEATURE_VAPA);
     set_feature(&cpu->env, ARM_FEATURE_MPIDR);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x410fc240; /* r0p0 */
     cpu->pmsav7_dregion = 8;
     cpu->isar.mvfr0 = 0x10110021;
@@ -XXX,XX +XXX,XX @@ static void cortex_m7_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M);
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x411fc272; /* r1p2 */
     cpu->pmsav7_dregion = 8;
     cpu->isar.mvfr0 = 0x10110221;
@@ -XXX,XX +XXX,XX @@ static void cortex_m33_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_M_MAIN);
     set_feature(&cpu->env, ARM_FEATURE_M_SECURITY);
     set_feature(&cpu->env, ARM_FEATURE_THUMB_DSP);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     cpu->midr = 0x410fd213; /* r0p3 */
     cpu->pmsav7_dregion = 16;
     cpu->sau_sregion = 8;
@@ -XXX,XX +XXX,XX @@ static void cortex_r5f_initfn(Object *obj)
     ARMCPU *cpu = ARM_CPU(obj);
 
     cortex_r5_initfn(obj);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     cpu->isar.mvfr0 = 0x10110221;
     cpu->isar.mvfr1 = 0x00000011;
 }
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a8";
     set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a9";
     set_feature(&cpu->env, ARM_FEATURE_V7);
-    set_feature(&cpu->env, ARM_FEATURE_VFP3);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_EL3);
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a7";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a15";
     set_feature(&cpu->env, ARM_FEATURE_V7VE);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_THUMB2EE);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a57";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a53";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
 
     cpu->dtb_compatible = "arm,cortex-a72";
     set_feature(&cpu->env, ARM_FEATURE_V8);
-    set_feature(&cpu->env, ARM_FEATURE_VFP4);
     set_feature(&cpu->env, ARM_FEATURE_NEON);
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_AARCH64);
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * bits, but a few must be tested.
      */
     set_feature(&features, ARM_FEATURE_V7VE);
-    set_feature(&features, ARM_FEATURE_VFP3);
     set_feature(&features, ARM_FEATURE_GENERIC_TIMER);
 
     if (extract32(id_pfr0, 12, 4) == 1) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     if (extract32(ahcf->isar.mvfr1, 12, 4) == 1) {
         set_feature(&features, ARM_FEATURE_NEON);
     }
-    if (extract32(ahcf->isar.mvfr1, 28, 4) == 1) {
-        /* FMAC support implies VFPv4 */
-        set_feature(&features, ARM_FEATURE_VFP4);
-    }
 
     ahcf->features = features;
 
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * feature bits.
      */
     set_feature(&features, ARM_FEATURE_V8);
-    set_feature(&features, ARM_FEATURE_VFP4);
     set_feature(&features, ARM_FEATURE_NEON);
     set_feature(&features, ARM_FEATURE_AARCH64);
     set_feature(&features, ARM_FEATURE_PMU);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Those vfp instructions without extra opcode fields can
share a common @format for brevity.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/vfp.decode | 134 ++++++++++++++++--------------------------
 1 file changed, 52 insertions(+), 82 deletions(-)

diff --git a/target/arm/vfp.decode b/target/arm/vfp.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp.decode
+++ b/target/arm/vfp.decode
@@ -XXX,XX +XXX,XX @@
 
 %vmov_imm 16:4 0:4
 
+@vfp_dnm_s   ................................ vm=%vm_sp vn=%vn_sp vd=%vd_sp
+@vfp_dnm_d   ................................ vm=%vm_dp vn=%vn_dp vd=%vd_dp
+
+@vfp_dm_ss   ................................ vm=%vm_sp vd=%vd_sp
+@vfp_dm_dd   ................................ vm=%vm_dp vd=%vd_dp
+@vfp_dm_ds   ................................ vm=%vm_sp vd=%vd_dp
+@vfp_dm_sd   ................................ vm=%vm_dp vd=%vd_sp
+
 # VMOV scalar to general-purpose register; note that this does
 # include some Neon cases.
 VMOV_to_gp   ---- 1110 u:1 1.        1 .... rt:4 1011 ... 1 0000 \
@@ -XXX,XX +XXX,XX @@ VDUP         ---- 1110 1 b:1 q:1 0 .... rt:4 1011 . 0 e:1 1 0000 \
              vn=%vn_dp
 
 VMSR_VMRS    ---- 1110 111 l:1 reg:4 rt:4 1010 0001 0000
-VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000 \
-             vn=%vn_sp
+VMOV_single  ---- 1110 000 l:1 .... rt:4 1010 . 001 0000    vn=%vn_sp
 
-VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 .... \
-             vm=%vm_sp
-VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 .... \
-             vm=%vm_dp
+VMOV_64_sp   ---- 1100 010 op:1 rt2:4 rt:4 1010 00.1 ....   vm=%vm_sp
+VMOV_64_dp   ---- 1100 010 op:1 rt2:4 rt:4 1011 00.1 ....   vm=%vm_dp
 
 # Note that the half-precision variants of VLDR and VSTR are
 # not part of this decodetree at all because they have bits [9:8] == 0b01
-VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8 \
-             vd=%vd_sp
-VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8 \
-             vd=%vd_dp
+VLDR_VSTR_sp ---- 1101 u:1 .0 l:1 rn:4 .... 1010 imm:8      vd=%vd_sp
+VLDR_VSTR_dp ---- 1101 u:1 .0 l:1 rn:4 .... 1011 imm:8      vd=%vd_dp
 
 # We split the load/store multiple up into two patterns to avoid
 # overlap with other insns in the "Advanced SIMD load/store and 64-bit move"
@@ -XXX,XX +XXX,XX @@ VLDM_VSTM_dp ---- 1101 0.1 l:1 rn:4 .... 1011 imm:8 \
              vd=%vd_dp p=1 u=0 w=1
 
 # 3-register VFP data-processing; bits [23,21:20,6] identify the operation.
-VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMLA_sp      ---- 1110 0.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VMLA_dp      ---- 1110 0.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMLS_sp      ---- 1110 0.00 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VMLS_dp      ---- 1110 0.00 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMLS_sp     ---- 1110 0.01 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VNMLS_dp     ---- 1110 0.01 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMLA_sp     ---- 1110 0.01 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VNMLA_dp     ---- 1110 0.01 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VMUL_sp      ---- 1110 0.10 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VMUL_dp      ---- 1110 0.10 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VNMUL_sp     ---- 1110 0.10 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VNMUL_dp     ---- 1110 0.10 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VADD_sp      ---- 1110 0.11 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VADD_dp      ---- 1110 0.11 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
-VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VSUB_sp      ---- 1110 0.11 .... .... 1010 .1.0 ....        @vfp_dnm_s
+VSUB_dp      ---- 1110 0.11 .... .... 1011 .1.0 ....        @vfp_dnm_d
 
-VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 .... \
-             vm=%vm_sp vn=%vn_sp vd=%vd_sp
-VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 .... \
-             vm=%vm_dp vn=%vn_dp vd=%vd_dp
+VDIV_sp      ---- 1110 1.00 .... .... 1010 .0.0 ....        @vfp_dnm_s
+VDIV_dp      ---- 1110 1.00 .... .... 1011 .0.0 ....        @vfp_dnm_d
 
 VFM_sp       ---- 1110 1.01 .... .... 1010 . o2:1 . 0 .... \
              vm=%vm_sp vn=%vn_sp vd=%vd_sp o1=1
@@ -XXX,XX +XXX,XX @@ VMOV_imm_sp  ---- 1110 1.11 .... .... 1010 0000 .... \
 VMOV_imm_dp  ---- 1110 1.11 .... .... 1011 0000 .... \
              vd=%vd_dp imm=%vmov_imm
 
-VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VMOV_reg_sp  ---- 1110 1.11 0000 .... 1010 01.0 ....        @vfp_dm_ss
+VMOV_reg_dp  ---- 1110 1.11 0000 .... 1011 01.0 ....        @vfp_dm_dd
 
-VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VABS_sp      ---- 1110 1.11 0000 .... 1010 11.0 ....        @vfp_dm_ss
+VABS_dp      ---- 1110 1.11 0000 .... 1011 11.0 ....        @vfp_dm_dd
 
-VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VNEG_sp      ---- 1110 1.11 0001 .... 1010 01.0 ....        @vfp_dm_ss
+VNEG_dp      ---- 1110 1.11 0001 .... 1011 01.0 ....        @vfp_dm_dd
 
-VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VSQRT_sp     ---- 1110 1.11 0001 .... 1010 11.0 ....        @vfp_dm_ss
+VSQRT_dp     ---- 1110 1.11 0001 .... 1011 11.0 ....        @vfp_dm_dd
 
 VCMP_sp      ---- 1110 1.11 010 z:1 .... 1010 e:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
@@ -XXX,XX +XXX,XX @@ VCVT_f32_f16 ---- 1110 1.11 0010 .... 1010 t:1 1.0 .... \
 VCVT_f64_f16 ---- 1110 1.11 0010 .... 1011 t:1 1.0 .... \
              vd=%vd_dp vm=%vm_sp
 
-# VCVTB and VCVTT to f16: Vd format is always vd_sp; Vm format depends on size bit
+# VCVTB and VCVTT to f16: Vd format is always vd_sp;
+# Vm format depends on size bit
 VCVT_f16_f32 ---- 1110 1.11 0011 .... 1010 t:1 1.0 .... \
              vd=%vd_sp vm=%vm_sp
 VCVT_f16_f64 ---- 1110 1.11 0011 .... 1011 t:1 1.0 .... \
              vd=%vd_sp vm=%vm_dp
 
-VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTR_sp    ---- 1110 1.11 0110 .... 1010 01.0 ....        @vfp_dm_ss
+VRINTR_dp    ---- 1110 1.11 0110 .... 1011 01.0 ....        @vfp_dm_dd
 
-VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTZ_sp    ---- 1110 1.11 0110 .... 1010 11.0 ....        @vfp_dm_ss
+VRINTZ_dp    ---- 1110 1.11 0110 .... 1011 11.0 ....        @vfp_dm_dd
 
-VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 .... \
-             vd=%vd_sp vm=%vm_sp
-VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 .... \
-             vd=%vd_dp vm=%vm_dp
+VRINTX_sp    ---- 1110 1.11 0111 .... 1010 01.0 ....        @vfp_dm_ss
+VRINTX_dp    ---- 1110 1.11 0111 .... 1011 01.0 ....        @vfp_dm_dd
 
-# VCVT between single and double: Vm precision depends on size; Vd is its reverse
-VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 .... \
-             vd=%vd_dp vm=%vm_sp
-VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 .... \
-             vd=%vd_sp vm=%vm_dp
+# VCVT between single and double:
+# Vm precision depends on size; Vd is its reverse
+VCVT_sp      ---- 1110 1.11 0111 .... 1010 11.0 ....        @vfp_dm_ds
+VCVT_dp      ---- 1110 1.11 0111 .... 1011 11.0 ....        @vfp_dm_sd
 
 # VCVT from integer to floating point: Vm always single; Vd depends on size
 VCVT_int_sp  ---- 1110 1.11 1000 .... 1010 s:1 1.0 .... \
@@ -XXX,XX +XXX,XX @@ VCVT_int_dp  ---- 1110 1.11 1000 .... 1011 s:1 1.0 .... \
              vd=%vd_dp vm=%vm_sp
 
 # VJCVT is always dp to sp
-VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 .... \
-             vd=%vd_sp vm=%vm_dp
+VJCVT        ---- 1110 1.11 1001 .... 1011 11.0 ....        @vfp_dm_sd
 
 # VCVT between floating-point and fixed-point. The immediate value
 # is in the same format as a Vm single-precision register number.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Passing the raw o1 and o2 fields from the manual is less
instructive than it might be.  Do the full decode and let
the trans_* functions pass in booleans to a helper.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 52 ++++++++++++++++++++++++++++++----
 target/arm/vfp.decode          | 17 +++++------
 2 files changed, 55 insertions(+), 14 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Passing the raw op field from the manual is less instructive
than it might be.  Do the full decode and use the existing
helpers to perform the expansion.

Since these are v8 insns, VECLEN+VECSTRIDE are already RES0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224222232.13807-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 109 +++++++++++----------------------
 target/arm/vfp-uncond.decode   |  12 ++--
 2 files changed, 44 insertions(+), 77 deletions(-)

From: Guenter Roeck <linux@roeck-us.net>

USB ports on Xilinx Zync must be instantiated as TYPE_CHIPIDEA to work.
Linux expects and checks various chipidea registers, which do not exist
with the basic ehci emulation. This patch series fixes the problem.

Without this patch, USB ports fail to instantiate under Linux.

ci_hdrc ci_hdrc.0: doesn't support host
ci_hdrc ci_hdrc.0: no supported roles

With this patch, USB ports are instantiated, and it is possible
to boot from USB drive.

ci_hdrc ci_hdrc.0: EHCI Host Controller
ci_hdrc ci_hdrc.0: new USB bus registered, assigned bus number 1
ci_hdrc ci_hdrc.0: USB 2.0 started, EHCI 1.00
usb 1-1: new full-speed USB device number 2 using ci_hdrc
usb 1-1: not running at top speed; connect to a high speed hub
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 512, setting to 64
usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi host0: usb-storage 1-1:1.0

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200215122354.13706-2-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xilinx_zynq.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/loader.h"
 #include "hw/misc/zynq-xadc.h"
 #include "hw/ssi/ssi.h"
+#include "hw/usb/chipidea.h"
 #include "qemu/error-report.h"
 #include "hw/sd/sdhci.h"
 #include "hw/char/cadence_uart.h"
@@ -XXX,XX +XXX,XX @@ static void zynq_init(MachineState *machine)
     zynq_init_spi_flashes(0xE0007000, pic[81-IRQ_OFFSET], false);
     zynq_init_spi_flashes(0xE000D000, pic[51-IRQ_OFFSET], true);
 
-    sysbus_create_simple("xlnx,ps7-usb", 0xE0002000, pic[53-IRQ_OFFSET]);
-    sysbus_create_simple("xlnx,ps7-usb", 0xE0003000, pic[76-IRQ_OFFSET]);
+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0002000, pic[53 - IRQ_OFFSET]);
+    sysbus_create_simple(TYPE_CHIPIDEA, 0xE0003000, pic[76 - IRQ_OFFSET]);
 
     cadence_uart_create(0xE0000000, pic[59 - IRQ_OFFSET], serial_hd(0));
     cadence_uart_create(0xE0001000, pic[82 - IRQ_OFFSET], serial_hd(1));
-- 
2.20.1

From: Guenter Roeck <linux@roeck-us.net>

Xilinx USB devices are now instantiated through TYPE_CHIPIDEA,
and xlnx support in the EHCI code is no longer needed.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Message-id: 20200215122354.13706-3-linux@roeck-us.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/hcd-ehci-sysbus.c | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/hw/usb/hcd-ehci-sysbus.c b/hw/usb/hcd-ehci-sysbus.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/hcd-ehci-sysbus.c
+++ b/hw/usb/hcd-ehci-sysbus.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo ehci_platform_type_info = {
     .class_init    = ehci_platform_class_init,
 };
 
-static void ehci_xlnx_class_init(ObjectClass *oc, void *data)
-{
-    SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    set_bit(DEVICE_CATEGORY_USB, dc->categories);
-    sec->capsbase = 0x100;
-    sec->opregbase = 0x140;
-}
-
-static const TypeInfo ehci_xlnx_type_info = {
-    .name          = "xlnx,ps7-usb",
-    .parent        = TYPE_SYS_BUS_EHCI,
-    .class_init    = ehci_xlnx_class_init,
-};
-
 static void ehci_exynos4210_class_init(ObjectClass *oc, void *data)
 {
     SysBusEHCIClass *sec = SYS_BUS_EHCI_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static void ehci_sysbus_register_types(void)
 {
     type_register_static(&ehci_type_info);
     type_register_static(&ehci_platform_type_info);
-    type_register_static(&ehci_xlnx_type_info);
     type_register_static(&ehci_exynos4210_type_info);
     type_register_static(&ehci_tegra2_type_info);
     type_register_static(&ehci_ppc4xx_type_info);
-- 
2.20.1

From: Thomas Huth <thuth@redhat.com>

Old kernels from the Meego project can be used to check that Linux
is at least starting on these machines.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-2-philmd@redhat.com
Message-Id: <20200129131920.22302-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                          |  1 +
 tests/acceptance/machine_arm_n8x0.py | 49 ++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+)
 create mode 100644 tests/acceptance/machine_arm_n8x0.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/rtc/twl92230.c
 F: include/hw/display/blizzard.h
 F: include/hw/input/tsc2xxx.h
 F: include/hw/misc/cbus.h
+F: tests/acceptance/machine_arm_n8x0.py
 
 Palm
 M: Andrzej Zaborowski <balrogg@gmail.com>
diff --git a/tests/acceptance/machine_arm_n8x0.py b/tests/acceptance/machine_arm_n8x0.py
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/acceptance/machine_arm_n8x0.py
@@ -XXX,XX +XXX,XX @@
+# Functional test that boots a Linux kernel and checks the console
+#
+# Copyright (c) 2020 Red Hat, Inc.
+#
+# Author:
+#  Thomas Huth <thuth@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+import os
+
+from avocado import skipUnless
+from avocado_qemu import Test
+from avocado_qemu import wait_for_console_pattern
+
+class N8x0Machine(Test):
+    """Boots the Linux kernel and checks that the console is operational"""
+
+    timeout = 90
+
+    def __do_test_n8x0(self):
+        kernel_url = ('http://stskeeps.subnetmask.net/meego-n8x0/'
+                      'meego-arm-n8x0-1.0.80.20100712.1431-'
+                      'vmlinuz-2.6.35~rc4-129.1-n8x0')
+        kernel_hash = 'e9d5ab8d7548923a0061b6fbf601465e479ed269'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        self.vm.set_console(console_index=1)
+        self.vm.add_args('-kernel', kernel_path,
+                         '-append', 'printk.time=0 console=ttyS1')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'TSC2005 driver initializing')
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_n800(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:n800
+        """
+        self.__do_test_n8x0()
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_n810(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:n810
+        """
+        self.__do_test_n8x0()
-- 
2.20.1

From: Thomas Huth <thuth@redhat.com>

There is a kernel and initrd available on github which we can use
for testing this machine.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-3-philmd@redhat.com
Message-Id: <20200131170233.14584-1-thuth@redhat.com>
[PMD: Renamed test method, moved description from class to method]
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                                  |  1 +
 tests/acceptance/machine_arm_integratorcp.py | 43 ++++++++++++++++++++
 2 files changed, 44 insertions(+)
 create mode 100644 tests/acceptance/machine_arm_integratorcp.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Maintained
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 F: include/hw/misc/arm_integrator_debug.h
+F: tests/acceptance/machine_arm_integratorcp.py
 
 MCIMX6UL EVK / i.MX6ul
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/acceptance/machine_arm_integratorcp.py
@@ -XXX,XX +XXX,XX @@
+# Functional test that boots a Linux kernel and checks the console
+#
+# Copyright (c) 2020 Red Hat, Inc.
+#
+# Author:
+#  Thomas Huth <thuth@redhat.com>
+#
+# This work is licensed under the terms of the GNU GPL, version 2 or
+# later.  See the COPYING file in the top-level directory.
+
+import os
+
+from avocado import skipUnless
+from avocado_qemu import Test
+from avocado_qemu import wait_for_console_pattern
+
+class IntegratorMachine(Test):
+
+    timeout = 90
+
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_integratorcp_console(self):
+        """
+        Boots the Linux kernel and checks that the console is operational
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:integratorcp
+        """
+        kernel_url = ('https://github.com/zayac/qemu-arm/raw/master/'
+                      'arm-test/kernel/zImage.integrator')
+        kernel_hash = '0d7adba893c503267c946a3cbdc63b4b54f25468'
+        kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
+
+        initrd_url = ('https://github.com/zayac/qemu-arm/raw/master/'
+                      'arm-test/kernel/arm_root.img')
+        initrd_hash = 'b51e4154285bf784e017a37586428332d8c7bd8b'
+        initrd_path = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+
+        self.vm.set_console()
+        self.vm.add_args('-kernel', kernel_path,
+                         '-initrd', initrd_path,
+                         '-append', 'printk.time=0 console=ttyAMA0')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Log in as root')
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As we want to re-use this code, extract it as a new function.
Since we are using the PL011 serial console, add a Avocado tag
to ease filtering of tests.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20200225172501.29609-4-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/machine_arm_integratorcp.py | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add a test that verifies the Tux logo is displayed on the framebuffer.

We simply follow the OpenCV "Template Matching with Multiple Objects"
tutorial, replacing Lionel Messi by Tux:
https://docs.opencv.org/4.2.0/d4/dc6/tutorial_py_template_matching.html

When OpenCV and NumPy are installed, this test can be run using:

$ AVOCADO_ALLOW_UNTRUSTED_CODE=hmmm \
    avocado --show=app,framebuffer run -t device:framebuffer \
      tests/acceptance/machine_arm_integratorcp.py
  JOB ID     : 8c46b0f8269242e87d738247883ea2a470df949e
  JOB LOG    : avocado/job-results/job-2020-01-31T21.38-8c46b0f/job.log
   (1/1) tests/acceptance/machine_arm_integratorcp.py:IntegratorMachine.test_framebuffer_tux_logo:
  framebuffer: found Tux at position [x, y] = (0, 0)
  PASS (3.96 s)
  RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
  JOB TIME   : 4.23 s

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-id: 20200225172501.29609-5-philmd@redhat.com
Message-Id: <20200131211102.29612-3-f4bug@amsat.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/machine_arm_integratorcp.py | 52 ++++++++++++++++++++
 1 file changed, 52 insertions(+)

diff --git a/tests/acceptance/machine_arm_integratorcp.py b/tests/acceptance/machine_arm_integratorcp.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/machine_arm_integratorcp.py
+++ b/tests/acceptance/machine_arm_integratorcp.py
@@ -XXX,XX +XXX,XX @@
 # later.  See the COPYING file in the top-level directory.
 
 import os
+import logging
 
 from avocado import skipUnless
 from avocado_qemu import Test
 from avocado_qemu import wait_for_console_pattern
 
+
+NUMPY_AVAILABLE = True
+try:
+    import numpy as np
+except ImportError:
+    NUMPY_AVAILABLE = False
+
+CV2_AVAILABLE = True
+try:
+    import cv2
+except ImportError:
+    CV2_AVAILABLE = False
+
+
 class IntegratorMachine(Test):
 
     timeout = 90
@@ -XXX,XX +XXX,XX @@ class IntegratorMachine(Test):
         """
         self.boot_integratorcp()
         wait_for_console_pattern(self, 'Log in as root')
+
+    @skipUnless(NUMPY_AVAILABLE, 'Python NumPy not installed')
+    @skipUnless(CV2_AVAILABLE, 'Python OpenCV not installed')
+    @skipUnless(os.getenv('AVOCADO_ALLOW_UNTRUSTED_CODE'), 'untrusted code')
+    def test_framebuffer_tux_logo(self):
+        """
+        Boot Linux and verify the Tux logo is displayed on the framebuffer.
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:integratorcp
+        :avocado: tags=device:pl110
+        :avocado: tags=device:framebuffer
+        """
+        screendump_path = os.path.join(self.workdir, "screendump.pbm")
+        tuxlogo_url = ('https://github.com/torvalds/linux/raw/v2.6.12/'
+                       'drivers/video/logo/logo_linux_vga16.ppm')
+        tuxlogo_hash = '3991c2ddbd1ddaecda7601f8aafbcf5b02dc86af'
+        tuxlogo_path = self.fetch_asset(tuxlogo_url, asset_hash=tuxlogo_hash)
+
+        self.boot_integratorcp()
+        framebuffer_ready = 'Console: switching to colour frame buffer device'
+        wait_for_console_pattern(self, framebuffer_ready)
+        self.vm.command('human-monitor-command', command_line='stop')
+        self.vm.command('human-monitor-command',
+                        command_line='screendump %s' % screendump_path)
+        logger = logging.getLogger('framebuffer')
+
+        cpu_count = 1
+        match_threshold = 0.92
+        screendump_bgr = cv2.imread(screendump_path)
+        screendump_gray = cv2.cvtColor(screendump_bgr, cv2.COLOR_BGR2GRAY)
+        result = cv2.matchTemplate(screendump_gray, cv2.imread(tuxlogo_path, 0),
+                                   cv2.TM_CCOEFF_NORMED)
+        loc = np.where(result >= match_threshold)
+        tux_count = 0
+        for tux_count, pt in enumerate(zip(*loc[::-1]), start=1):
+            logger.debug('found Tux at position [x, y] = %s', pt)
+        self.assertGreaterEqual(tux_count, cpu_count)
-- 
2.20.1

We missed an instance of using FIELD_EX32 on a 64-bit ID
register, in isar_feature_aa64_pmu_8_4(). Fix it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-2-peter.maydell@linaro.org
---
 target/arm/cpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pmu_8_1(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_pmu_8_4(const ARMISARegisters *id)
 {
-    return FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
-        FIELD_EX32(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
+    return FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) >= 5 &&
+        FIELD_EX64(id->id_aa64dfr0, ID_AA64DFR0, PMUVER) != 0xf;
 }
 
 /*
-- 
2.20.1

The v8.3-RCPC extension implements three new load instructions
which provide slightly weaker consistency guarantees than the
existing load-acquire operations. For QEMU we choose to simply
implement them with a full LDAQ barrier.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-3-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  5 +++++
 linux-user/elfload.c       |  1 +
 target/arm/cpu64.c         |  1 +
 target/arm/translate-a64.c | 24 ++++++++++++++++++++++++
 4 files changed, 31 insertions(+)

The v8.4-RCPC extension implements some new instructions:
 * LDAPUR, LDAPURB, LDAPURH, LDAPRSB, LDAPRSH, LDAPRSW
 * STLUR, STLURB, STLURH

These are all in a new subgroup of encodings that sits below the
top-level "Loads and Stores" group in the Arm ARM.

The STLUR* instructions have standard store-release semantics; the
LDAPUR* have Load-AcquirePC semantics, but (as with LDAPR*) we choose
to implement them as the slightly stronger Load-Acquire.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224172846.13053-4-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  5 +++
 linux-user/elfload.c       |  1 +
 target/arm/cpu64.c         |  2 +-
 target/arm/translate-a64.c | 90 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 97 insertions(+), 1 deletion(-)

The ARMv8.3-CCIDX extension makes the CCSIDR_EL1 system ID registers
have a format that uses the full 64 bit width of the register, and
adds a new CCSIDR2 register so AArch32 can get at the high 32 bits.

QEMU doesn't implement caches, so we just treat these ID registers as
opaque values that are set to the correct constant values for each
CPU.  The only thing we need to do is allow 64-bit values in our
cssidr[] array and provide the CCSIDR2 accessors.

We don't set the CCIDX field in our 'max' CPU because the CCSIDR
constant values we use are the same as the ones used by the
Cortex-A57 and they are in the old 32-bit format. This means
that the extra regdef added here is unused currently, but it
means that whenever in the future we add a CPU that does need
the new 64-bit format it will just work when we set the cssidr
values and the ID registers for it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200224182626.29252-1-peter.maydell@linaro.org
---
 target/arm/cpu.h    | 17 ++++++++++++++++-
 target/arm/helper.c | 19 +++++++++++++++++++
 2 files changed, 35 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* The elements of this array are the CCSIDR values for each cache,
      * in the order L1DCache, L1ICache, L2DCache, L2ICache, etc.
      */
-    uint32_t ccsidr[16];
+    uint64_t ccsidr[16];
     uint64_t reset_cbar;
     uint32_t reset_auxcr;
     bool reset_hivecs;
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ac2(const ARMISARegisters *id)
     return FIELD_EX32(id->id_mmfr4, ID_MMFR4, AC2) != 0;
 }
 
+static inline bool isar_feature_aa32_ccidx(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_mmfr4, ID_MMFR4, CCIDX) != 0;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_rcpc_8_4(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, LRCPC) >= 2;
 }
 
+static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_any_pmu_8_4(const ARMISARegisters *id)
     return isar_feature_aa64_pmu_8_4(id) || isar_feature_aa32_pmu_8_4(id);
 }
 
+static inline bool isar_feature_any_ccidx(const ARMISARegisters *id)
+{
+    return isar_feature_aa64_ccidx(id) || isar_feature_aa32_ccidx(id);
+}
+
 /*
  * Forward to the above feature tests given an ARMCPU pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static uint64_t ccsidr2_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* Read the high 32 bits of the current CCSIDR */
+    return extract64(ccsidr_read(env, ri), 32, 32);
+}
+
+static const ARMCPRegInfo ccsidr2_reginfo[] = {
+    { .name = "CCSIDR2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 2,
+      .access = PL1_R,
+      .accessfn = access_aa64_tid2,
+      .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
+    REGINFO_SENTINEL
+};
+
 static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
                                        bool isread)
 {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, predinv_reginfo);
     }
 
+    if (cpu_isar_feature(any_ccidx, cpu)) {
+        define_arm_cp_regs(cpu, ccsidr2_reginfo);
+    }
+
 #ifndef CONFIG_USER_ONLY
     /*
      * Register redirections and aliases must be done last,
-- 
2.20.1

In our KVM GICv2 realize function, we try to cope with old kernels
that don't provide the device control API (KVM_CAP_DEVICE_CTRL): we
try to use the device control, and if that fails we fall back to
assuming that the kernel has the old style KVM_CREATE_IRQCHIP and
that it will provide a GICv2.

This doesn't cater for the possibility of a kernel and hardware which
only provide a GICv3, which is very common now.  On that setup we
will abort() later on in kvm_arm_pmu_set_irq() when we try to wire up
an interrupt to the GIC we failed to create:

qemu-system-aarch64: PMU: KVM_SET_DEVICE_ATTR: Invalid argument
qemu-system-aarch64: failed to set irq for PMU
Aborted

If the kernel advertises KVM_CAP_DEVICE_CTRL we should trust it if it
says it can't create a GICv2, rather than assuming it has one.  We
can then produce a more helpful error message including a hint about
the most probable reason for the failure.

If the kernel doesn't advertise KVM_CAP_DEVICE_CTRL then it is truly
ancient by this point but we might as well still fall back to a
KVM_CREATE_IRQCHIP GICv2.

With this patch then the user misconfiguration which previously
caused an abort now prints:
qemu-system-aarch64: Initialization of device kvm-arm-gic failed: error creating in-kernel VGIC: No such device
Perhaps the host CPU does not support GICv2?

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Tested-by: Andrew Jones <drjones@redhat.com>
Message-id: 20200225182435.1131-1-peter.maydell@linaro.org
---
 hw/intc/arm_gic_kvm.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/intc/arm_gic_kvm.c b/hw/intc/arm_gic_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gic_kvm.c
+++ b/hw/intc/arm_gic_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_gic_realize(DeviceState *dev, Error **errp)
                               KVM_DEV_ARM_VGIC_CTRL_INIT, NULL, true,
                               &error_abort);
         }
+    } else if (kvm_check_extension(kvm_state, KVM_CAP_DEVICE_CTRL)) {
+        error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
+        error_append_hint(errp,
+                          "Perhaps the host CPU does not support GICv2?\n");
     } else if (ret != -ENODEV && ret != -ENOTSUP) {
+        /*
+         * Very ancient kernel without KVM_CAP_DEVICE_CTRL: assume that
+         * ENODEV or ENOTSUP mean "can't create GICv2 with KVM_CREATE_DEVICE",
+         * and that we will get a GICv2 via KVM_CREATE_IRQCHIP.
+         */
         error_setg_errno(errp, -ret, "error creating in-kernel VGIC");
         return;
     }
-- 
2.20.1

The following changes since commit 5a67d7735d4162630769ef495cf813244fc850df:

Merge remote-tracking branch 'remotes/berrange-gitlab/tags/tls-deps-pull-request' into staging (2021-07-02 08:22:39 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210702

for you to fetch changes up to 04ea4d3cfd0a21b248ece8eb7a9436a3d9898dd8:

target/arm: Implement MVE shifts by register (2021-07-02 11:48:38 +0100)

----------------------------------------------------------------
target-arm queue:
 * more MVE instructions
 * hw/gpio/gpio_pwr: use shutdown function for reboot
 * target/arm: Check NaN mode before silencing NaN
 * tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine
 * hw/arm: Add basic power management to raspi.
 * docs/system/arm: Add quanta-gbs-bmc, quanta-q7l1-bmc

----------------------------------------------------------------
Joe Komlodi (1):
      target/arm: Check NaN mode before silencing NaN

Maxim Uvarov (1):
      hw/gpio/gpio_pwr: use shutdown function for reboot

Nolan Leake (1):
      hw/arm: Add basic power management to raspi.

Patrick Venture (2):
      docs/system/arm: Add quanta-q7l1-bmc reference
      docs/system/arm: Add quanta-gbs-bmc reference

Peter Maydell (18):
      target/arm: Fix MVE widening/narrowing VLDR/VSTR offset calculation
      target/arm: Fix bugs in MVE VRMLALDAVH, VRMLSLDAVH
      target/arm: Make asimd_imm_const() public
      target/arm: Use asimd_imm_const for A64 decode
      target/arm: Use dup_const() instead of bitfield_replicate()
      target/arm: Implement MVE logical immediate insns
      target/arm: Implement MVE vector shift left by immediate insns
      target/arm: Implement MVE vector shift right by immediate insns
      target/arm: Implement MVE VSHLL
      target/arm: Implement MVE VSRI, VSLI
      target/arm: Implement MVE VSHRN, VRSHRN
      target/arm: Implement MVE saturating narrowing shifts
      target/arm: Implement MVE VSHLC
      target/arm: Implement MVE VADDLV
      target/arm: Implement MVE long shifts by immediate
      target/arm: Implement MVE long shifts by register
      target/arm: Implement MVE shifts by immediate
      target/arm: Implement MVE shifts by register

Philippe Mathieu-Daudé (1):
      tests: Boot and halt a Linux guest on the Raspberry Pi 2 machine

docs/system/arm/aspeed.rst             |   1 +
 docs/system/arm/nuvoton.rst            |   5 +-
 include/hw/arm/bcm2835_peripherals.h   |   3 +-
 include/hw/misc/bcm2835_powermgt.h     |  29 ++
 target/arm/helper-mve.h                | 108 +++++++
 target/arm/translate.h                 |  41 +++
 target/arm/mve.decode                  | 177 ++++++++++-
 target/arm/t32.decode                  |  71 ++++-
 hw/arm/bcm2835_peripherals.c           |  13 +-
 hw/gpio/gpio_pwr.c                     |   2 +-
 hw/misc/bcm2835_powermgt.c             | 160 ++++++++++
 target/arm/helper-a64.c                |  12 +-
 target/arm/mve_helper.c                | 524 +++++++++++++++++++++++++++++++--
 target/arm/translate-a64.c             |  86 +-----
 target/arm/translate-mve.c             | 261 +++++++++++++++-
 target/arm/translate-neon.c            |  81 -----
 target/arm/translate.c                 | 327 +++++++++++++++++++-
 target/arm/vfp_helper.c                |  24 +-
 hw/misc/meson.build                    |   1 +
 tests/acceptance/boot_linux_console.py |  43 +++
 20 files changed, 1760 insertions(+), 209 deletions(-)
 create mode 100644 include/hw/misc/bcm2835_powermgt.h
 create mode 100644 hw/misc/bcm2835_powermgt.c

From: Patrick Venture <venture@google.com>

Add line item reference to quanta-gbs-bmc machine.

Signed-off-by: Patrick Venture <venture@google.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210615192848.1065297-3-venture@google.com
[PMM: fixed underline Sphinx warning]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@
-Nuvoton iBMC boards (``npcm750-evb``, ``quanta-gsj``)
-=====================================================
+Nuvoton iBMC boards (``*-bmc``, ``npcm750-evb``, ``quanta-gsj``)
+================================================================
 
 The `Nuvoton iBMC`_ chips (NPCM7xx) are a family of ARM-based SoCs that are
 designed to be used as Baseboard Management Controllers (BMCs) in various
@@ -XXX,XX +XXX,XX @@ segment. The following machines are based on this chip :
 The NPCM730 SoC has two Cortex-A9 cores and is targeted for Data Center and
 Hyperscale applications. The following machines are based on this chip :
 
+- ``quanta-gbs-bmc``    Quanta GBS server BMC
 - ``quanta-gsj``        Quanta GSJ server BMC
 
 There are also two more SoCs, NPCM710 and NPCM705, which are single-core
-- 
2.20.1

From: Nolan Leake <nolan@sigbus.net>

This is just enough to make reboot and poweroff work. Works for
linux, u-boot, and the arm trusted firmware. Not tested, but should
work for plan9, and bare-metal/hobby OSes, since they seem to generally
do what linux does for reset.

The watchdog timer functionality is not yet implemented.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/64
Signed-off-by: Nolan Leake <nolan@sigbus.net>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210625210209.1870217-1-nolan@sigbus.net
[PMM: tweaked commit title; fixed region size to 0x200;
 moved header file to include/]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h |   3 +-
 include/hw/misc/bcm2835_powermgt.h   |  29 +++++
 hw/arm/bcm2835_peripherals.c         |  13 ++-
 hw/misc/bcm2835_powermgt.c           | 160 +++++++++++++++++++++++++++
 hw/misc/meson.build                  |   1 +
 5 files changed, 204 insertions(+), 2 deletions(-)
 create mode 100644 include/hw/misc/bcm2835_powermgt.h
 create mode 100644 hw/misc/bcm2835_powermgt.c

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/bcm2835_mphi.h"
 #include "hw/misc/bcm2835_thermal.h"
 #include "hw/misc/bcm2835_cprman.h"
+#include "hw/misc/bcm2835_powermgt.h"
 #include "hw/sd/sdhci.h"
 #include "hw/sd/bcm2835_sdhost.h"
 #include "hw/gpio/bcm2835_gpio.h"
@@ -XXX,XX +XXX,XX @@ struct BCM2835PeripheralState {
     BCM2835MphiState mphi;
     UnimplementedDeviceState txp;
     UnimplementedDeviceState armtmr;
-    UnimplementedDeviceState powermgt;
+    BCM2835PowerMgtState powermgt;
     BCM2835CprmanState cprman;
     PL011State uart0;
     BCM2835AuxState aux;
diff --git a/include/hw/misc/bcm2835_powermgt.h b/include/hw/misc/bcm2835_powermgt.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/bcm2835_powermgt.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * BCM2835 Power Management emulation
+ *
+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
+ * Copyright (C) 2021 Nolan Leake <nolan@sigbus.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef BCM2835_POWERMGT_H
+#define BCM2835_POWERMGT_H
+
+#include "hw/sysbus.h"
+#include "qom/object.h"
+
+#define TYPE_BCM2835_POWERMGT "bcm2835-powermgt"
+OBJECT_DECLARE_SIMPLE_TYPE(BCM2835PowerMgtState, BCM2835_POWERMGT)
+
+struct BCM2835PowerMgtState {
+    SysBusDevice busdev;
+    MemoryRegion iomem;
+
+    uint32_t rstc;
+    uint32_t rsts;
+    uint32_t wdog;
+};
+
+#endif
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_init(Object *obj)
 
     object_property_add_const_link(OBJECT(&s->dwc2), "dma-mr",
                                    OBJECT(&s->gpu_bus_mr));
+
+    /* Power Management */
+    object_initialize_child(obj, "powermgt", &s->powermgt,
+                            TYPE_BCM2835_POWERMGT);
 }
 
 static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void bcm2835_peripherals_realize(DeviceState *dev, Error **errp)
         qdev_get_gpio_in_named(DEVICE(&s->ic), BCM2835_IC_GPU_IRQ,
                                INTERRUPT_USB));
 
+    /* Power Management */
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->powermgt), errp)) {
+        return;
+    }
+
+    memory_region_add_subregion(&s->peri_mr, PM_OFFSET,
+                sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->powermgt), 0));
+
     create_unimp(s, &s->txp, "bcm2835-txp", TXP_OFFSET, 0x1000);
     create_unimp(s, &s->armtmr, "bcm2835-sp804", ARMCTRL_TIMER0_1_OFFSET, 0x40);
-    create_unimp(s, &s->powermgt, "bcm2835-powermgt", PM_OFFSET, 0x114);
     create_unimp(s, &s->i2s, "bcm2835-i2s", I2S_OFFSET, 0x100);
     create_unimp(s, &s->smi, "bcm2835-smi", SMI_OFFSET, 0x100);
     create_unimp(s, &s->spi[0], "bcm2835-spi0", SPI0_OFFSET, 0x20);
diff --git a/hw/misc/bcm2835_powermgt.c b/hw/misc/bcm2835_powermgt.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/bcm2835_powermgt.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * BCM2835 Power Management emulation
+ *
+ * Copyright (C) 2017 Marcin Chojnacki <marcinch7@gmail.com>
+ * Copyright (C) 2021 Nolan Leake <nolan@sigbus.net>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "hw/misc/bcm2835_powermgt.h"
+#include "migration/vmstate.h"
+#include "sysemu/runstate.h"
+
+#define PASSWORD 0x5a000000
+#define PASSWORD_MASK 0xff000000
+
+#define R_RSTC 0x1c
+#define V_RSTC_RESET 0x20
+#define R_RSTS 0x20
+#define V_RSTS_POWEROFF 0x555 /* Linux uses partition 63 to indicate halt. */
+#define R_WDOG 0x24
+
+static uint64_t bcm2835_powermgt_read(void *opaque, hwaddr offset,
+                                      unsigned size)
+{
+    BCM2835PowerMgtState *s = (BCM2835PowerMgtState *)opaque;
+    uint32_t res = 0;
+
+    switch (offset) {
+    case R_RSTC:
+        res = s->rstc;
+        break;
+    case R_RSTS:
+        res = s->rsts;
+        break;
+    case R_WDOG:
+        res = s->wdog;
+        break;
+
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_powermgt_read: Unknown offset 0x%08"HWADDR_PRIx
+                      "\n", offset);
+        res = 0;
+        break;
+    }
+
+    return res;
+}
+
+static void bcm2835_powermgt_write(void *opaque, hwaddr offset,
+                                   uint64_t value, unsigned size)
+{
+    BCM2835PowerMgtState *s = (BCM2835PowerMgtState *)opaque;
+
+    if ((value & PASSWORD_MASK) != PASSWORD) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "bcm2835_powermgt_write: Bad password 0x%"PRIx64
+                      " at offset 0x%08"HWADDR_PRIx"\n",
+                      value, offset);
+        return;
+    }
+
+    value = value & ~PASSWORD_MASK;
+
+    switch (offset) {
+    case R_RSTC:
+        s->rstc = value;
+        if (value & V_RSTC_RESET) {
+            if ((s->rsts & 0xfff) == V_RSTS_POWEROFF) {
+                qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+            } else {
+                qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+            }
+        }
+        break;
+    case R_RSTS:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_powermgt_write: RSTS\n");
+        s->rsts = value;
+        break;
+    case R_WDOG:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_powermgt_write: WDOG\n");
+        s->wdog = value;
+        break;
+
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "bcm2835_powermgt_write: Unknown offset 0x%08"HWADDR_PRIx
+                      "\n", offset);
+        break;
+    }
+}
+
+static const MemoryRegionOps bcm2835_powermgt_ops = {
+    .read = bcm2835_powermgt_read,
+    .write = bcm2835_powermgt_write,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 4,
+};
+
+static const VMStateDescription vmstate_bcm2835_powermgt = {
+    .name = TYPE_BCM2835_POWERMGT,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(rstc, BCM2835PowerMgtState),
+        VMSTATE_UINT32(rsts, BCM2835PowerMgtState),
+        VMSTATE_UINT32(wdog, BCM2835PowerMgtState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void bcm2835_powermgt_init(Object *obj)
+{
+    BCM2835PowerMgtState *s = BCM2835_POWERMGT(obj);
+
+    memory_region_init_io(&s->iomem, obj, &bcm2835_powermgt_ops, s,
+                          TYPE_BCM2835_POWERMGT, 0x200);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+}
+
+static void bcm2835_powermgt_reset(DeviceState *dev)
+{
+    BCM2835PowerMgtState *s = BCM2835_POWERMGT(dev);
+
+    /* https://elinux.org/BCM2835_registers#PM */
+    s->rstc = 0x00000102;
+    s->rsts = 0x00001000;
+    s->wdog = 0x00000000;
+}
+
+static void bcm2835_powermgt_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = bcm2835_powermgt_reset;
+    dc->vmsd = &vmstate_bcm2835_powermgt;
+}
+
+static TypeInfo bcm2835_powermgt_info = {
+    .name          = TYPE_BCM2835_POWERMGT,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(BCM2835PowerMgtState),
+    .class_init    = bcm2835_powermgt_class_init,
+    .instance_init = bcm2835_powermgt_init,
+};
+
+static void bcm2835_powermgt_register_types(void)
+{
+    type_register_static(&bcm2835_powermgt_info);
+}
+
+type_init(bcm2835_powermgt_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
   'bcm2835_rng.c',
   'bcm2835_thermal.c',
   'bcm2835_cprman.c',
+  'bcm2835_powermgt.c',
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c', 'zynq-xadc.c'))
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Add a test booting and quickly shutdown a raspi2 machine,
to test the power management model:

(1/1) tests/acceptance/boot_linux_console.py:BootLinuxConsole.test_arm_raspi2_initrd:
  console: [    0.000000] Booting Linux on physical CPU 0xf00
  console: [    0.000000] Linux version 4.14.98-v7+ (dom@dom-XPS-13-9370) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1200 SMP Tue Feb 12 20:27:48 GMT 2019
  console: [    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
  console: [    0.000000] CPU: div instructions available: patching division code
  console: [    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
  console: [    0.000000] OF: fdt: Machine model: Raspberry Pi 2 Model B
  ...
  console: Boot successful.
  console: cat /proc/cpuinfo
  console: / # cat /proc/cpuinfo
  ...
  console: processor      : 3
  console: model name     : ARMv7 Processor rev 5 (v7l)
  console: BogoMIPS       : 125.00
  console: Features       : half thumb fastmult vfp edsp neon vfpv3 tls vfpv4 idiva idivt vfpd32 lpae evtstrm
  console: CPU implementer        : 0x41
  console: CPU architecture: 7
  console: CPU variant    : 0x0
  console: CPU part       : 0xc07
  console: CPU revision   : 5
  console: Hardware       : BCM2835
  console: Revision       : 0000
  console: Serial         : 0000000000000000
  console: cat /proc/iomem
  console: / # cat /proc/iomem
  console: 00000000-3bffffff : System RAM
  console: 00008000-00afffff : Kernel code
  console: 00c00000-00d468ef : Kernel data
  console: 3f006000-3f006fff : dwc_otg
  console: 3f007000-3f007eff : /soc/dma@7e007000
  console: 3f00b880-3f00b8bf : /soc/mailbox@7e00b880
  console: 3f100000-3f100027 : /soc/watchdog@7e100000
  console: 3f101000-3f102fff : /soc/cprman@7e101000
  console: 3f200000-3f2000b3 : /soc/gpio@7e200000
  PASS (24.59 s)
  RESULTS    : PASS 1 | ERROR 0 | FAIL 0 | SKIP 0 | WARN 0 | INTERRUPT 0 | CANCEL 0
  JOB TIME   : 25.02 s

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Wainer dos Santos Moschetta <wainersm@redhat.com>
Message-id: 20210531113837.1689775-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/acceptance/boot_linux_console.py | 43 ++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)

diff --git a/tests/acceptance/boot_linux_console.py b/tests/acceptance/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/acceptance/boot_linux_console.py
+++ b/tests/acceptance/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@
 from avocado import skip
 from avocado import skipUnless
 from avocado_qemu import Test
+from avocado_qemu import exec_command
 from avocado_qemu import exec_command_and_wait_for_pattern
 from avocado_qemu import interrupt_interactive_console_until_pattern
 from avocado_qemu import wait_for_console_pattern
@@ -XXX,XX +XXX,XX @@ def test_arm_raspi2_uart0(self):
         """
         self.do_test_arm_raspi2(0)
 
+    def test_arm_raspi2_initrd(self):
+        """
+        :avocado: tags=arch:arm
+        :avocado: tags=machine:raspi2
+        """
+        deb_url = ('http://archive.raspberrypi.org/debian/'
+                   'pool/main/r/raspberrypi-firmware/'
+                   'raspberrypi-kernel_1.20190215-1_armhf.deb')
+        deb_hash = 'cd284220b32128c5084037553db3c482426f3972'
+        deb_path = self.fetch_asset(deb_url, asset_hash=deb_hash)
+        kernel_path = self.extract_from_deb(deb_path, '/boot/kernel7.img')
+        dtb_path = self.extract_from_deb(deb_path, '/boot/bcm2709-rpi-2-b.dtb')
+
+        initrd_url = ('https://github.com/groeck/linux-build-test/raw/'
+                      '2eb0a73b5d5a28df3170c546ddaaa9757e1e0848/rootfs/'
+                      'arm/rootfs-armv7a.cpio.gz')
+        initrd_hash = '604b2e45cdf35045846b8bbfbf2129b1891bdc9c'
+        initrd_path_gz = self.fetch_asset(initrd_url, asset_hash=initrd_hash)
+        initrd_path = os.path.join(self.workdir, 'rootfs.cpio')
+        archive.gzip_uncompress(initrd_path_gz, initrd_path)
+
+        self.vm.set_console()
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'earlycon=pl011,0x3f201000 console=ttyAMA0 '
+                               'panic=-1 noreboot ' +
+                               'dwc_otg.fiq_fsm_enable=0')
+        self.vm.add_args('-kernel', kernel_path,
+                         '-dtb', dtb_path,
+                         '-initrd', initrd_path,
+                         '-append', kernel_command_line,
+                         '-no-reboot')
+        self.vm.launch()
+        self.wait_for_console_pattern('Boot successful.')
+
+        exec_command_and_wait_for_pattern(self, 'cat /proc/cpuinfo',
+                                                'BCM2835')
+        exec_command_and_wait_for_pattern(self, 'cat /proc/iomem',
+                                                '/soc/cprman@7e101000')
+        exec_command(self, 'halt')
+        # Wait for VM to shut down gracefully
+        self.vm.wait()
+
     def test_arm_exynos4210_initrd(self):
         """
         :avocado: tags=arch:arm
-- 
2.20.1

From: Joe Komlodi <joe.komlodi@xilinx.com>

If the CPU is running in default NaN mode (FPCR.DN == 1) and we execute
FRSQRTE, FRECPE, or FRECPX with a signaling NaN, parts_silence_nan_frac() will
assert due to fpst->default_nan_mode being set.

To avoid this, we check to see what NaN mode we're running in before we call
floatxx_silence_nan().

Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1624662174-175828-2-git-send-email-joe.komlodi@xilinx.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.c | 12 +++++++++---
 target/arm/vfp_helper.c | 24 ++++++++++++++++++------
 2 files changed, 27 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(frecpx_f16)(uint32_t a, void *fpstp)
         float16 nan = a;
         if (float16_is_signaling_nan(a, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float16_silence_nan(a, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float16_silence_nan(a, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan = float16_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(frecpx_f32)(float32 a, void *fpstp)
         float32 nan = a;
         if (float32_is_signaling_nan(a, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float32_silence_nan(a, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float32_silence_nan(a, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan = float32_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(frecpx_f64)(float64 a, void *fpstp)
         float64 nan = a;
         if (float64_is_signaling_nan(a, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float64_silence_nan(a, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float64_silence_nan(a, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan = float64_default_nan(fpst);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, void *fpstp)
         float16 nan = f16;
         if (float16_is_signaling_nan(f16, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float16_silence_nan(f16, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float16_silence_nan(f16, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan =  float16_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(recpe_f32)(float32 input, void *fpstp)
         float32 nan = f32;
         if (float32_is_signaling_nan(f32, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float32_silence_nan(f32, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float32_silence_nan(f32, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan =  float32_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpe_f64)(float64 input, void *fpstp)
         float64 nan = f64;
         if (float64_is_signaling_nan(f64, fpst)) {
             float_raise(float_flag_invalid, fpst);
-            nan = float64_silence_nan(f64, fpst);
+            if (!fpst->default_nan_mode) {
+                nan = float64_silence_nan(f64, fpst);
+            }
         }
         if (fpst->default_nan_mode) {
             nan =  float64_default_nan(fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, void *fpstp)
         float16 nan = f16;
         if (float16_is_signaling_nan(f16, s)) {
             float_raise(float_flag_invalid, s);
-            nan = float16_silence_nan(f16, s);
+            if (!s->default_nan_mode) {
+                nan = float16_silence_nan(f16, fpstp);
+            }
         }
         if (s->default_nan_mode) {
             nan =  float16_default_nan(s);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrte_f32)(float32 input, void *fpstp)
         float32 nan = f32;
         if (float32_is_signaling_nan(f32, s)) {
             float_raise(float_flag_invalid, s);
-            nan = float32_silence_nan(f32, s);
+            if (!s->default_nan_mode) {
+                nan = float32_silence_nan(f32, fpstp);
+            }
         }
         if (s->default_nan_mode) {
             nan =  float32_default_nan(s);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrte_f64)(float64 input, void *fpstp)
         float64 nan = f64;
         if (float64_is_signaling_nan(f64, s)) {
             float_raise(float_flag_invalid, s);
-            nan = float64_silence_nan(f64, s);
+            if (!s->default_nan_mode) {
+                nan = float64_silence_nan(f64, fpstp);
+            }
         }
         if (s->default_nan_mode) {
             nan =  float64_default_nan(s);
-- 
2.20.1

From: Maxim Uvarov <maxim.uvarov@linaro.org>

qemu has 2 type of functions: shutdown and reboot. Shutdown
function has to be used for machine shutdown. Otherwise we cause
a reset with a bogus "cause" value, when we intended a shutdown.

Signed-off-by: Maxim Uvarov <maxim.uvarov@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210625111842.3790-3-maxim.uvarov@linaro.org
[PMM: tweaked commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/gpio_pwr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/gpio/gpio_pwr.c b/hw/gpio/gpio_pwr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/gpio_pwr.c
+++ b/hw/gpio/gpio_pwr.c
@@ -XXX,XX +XXX,XX @@ static void gpio_pwr_reset(void *opaque, int n, int level)
 static void gpio_pwr_shutdown(void *opaque, int n, int level)
 {
     if (level) {
-        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
+        qemu_system_shutdown_request(SHUTDOWN_CAUSE_GUEST_SHUTDOWN);
     }
 }
 
-- 
2.20.1

In do_ldst(), the calculation of the offset needs to be based on the
size of the memory access, not the size of the elements in the
vector.  This meant we were getting it wrong for the widening and
narrowing variants of the various VLDR and VSTR insns.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-2-peter.maydell@linaro.org
---
 target/arm/translate-mve.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ static bool mve_skip_first_beat(DisasContext *s)
     }
 }
 
-static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn)
+static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn,
+                    unsigned msize)
 {
     TCGv_i32 addr;
     uint32_t offset;
@@ -XXX,XX +XXX,XX @@ static bool do_ldst(DisasContext *s, arg_VLDR_VSTR *a, MVEGenLdStFn *fn)
         return true;
     }
 
-    offset = a->imm << a->size;
+    offset = a->imm << msize;
     if (!a->a) {
         offset = -offset;
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_VLDR_VSTR(DisasContext *s, arg_VLDR_VSTR *a)
         { gen_helper_mve_vstrw, gen_helper_mve_vldrw },
         { NULL, NULL }
     };
-    return do_ldst(s, a, ldstfns[a->size][a->l]);
+    return do_ldst(s, a, ldstfns[a->size][a->l], a->size);
 }
 
-#define DO_VLDST_WIDE_NARROW(OP, SLD, ULD, ST)                  \
+#define DO_VLDST_WIDE_NARROW(OP, SLD, ULD, ST, MSIZE)           \
     static bool trans_##OP(DisasContext *s, arg_VLDR_VSTR *a)   \
     {                                                           \
         static MVEGenLdStFn * const ldstfns[2][2] = {           \
             { gen_helper_mve_##ST, gen_helper_mve_##SLD },      \
             { NULL, gen_helper_mve_##ULD },                     \
         };                                                      \
-        return do_ldst(s, a, ldstfns[a->u][a->l]);              \
+        return do_ldst(s, a, ldstfns[a->u][a->l], MSIZE);       \
     }
 
-DO_VLDST_WIDE_NARROW(VLDSTB_H, vldrb_sh, vldrb_uh, vstrb_h)
-DO_VLDST_WIDE_NARROW(VLDSTB_W, vldrb_sw, vldrb_uw, vstrb_w)
-DO_VLDST_WIDE_NARROW(VLDSTH_W, vldrh_sw, vldrh_uw, vstrh_w)
+DO_VLDST_WIDE_NARROW(VLDSTB_H, vldrb_sh, vldrb_uh, vstrb_h, MO_8)
+DO_VLDST_WIDE_NARROW(VLDSTB_W, vldrb_sw, vldrb_uw, vstrb_w, MO_8)
+DO_VLDST_WIDE_NARROW(VLDSTH_W, vldrh_sw, vldrh_uw, vstrh_w, MO_16)
 
 static bool trans_VDUP(DisasContext *s, arg_VDUP *a)
 {
-- 
2.20.1

The initial implementation of the MVE VRMLALDAVH and VRMLSLDAVH
insns had some bugs:
 * the 32x32 multiply of elements was being done as 32x32->32,
   not 32x32->64
 * we were incorrectly maintaining the accumulator in its full
   72-bit form across all 4 beats of the insn; in the pseudocode
   it is squashed back into the 64 bits of the RdaHi:RdaLo
   registers after each beat

In particular, fixing the second of these allows us to recast
the implementation to avoid 128-bit arithmetic entirely.

Since the element size here is always 4, we can also drop the
parameterization of ESIZE to make the code a little more readable.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-3-peter.maydell@linaro.org
---
 target/arm/mve_helper.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve_helper.c
+++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/int128.h"
 #include "cpu.h"
 #include "internals.h"
 #include "vec_internal.h"
@@ -XXX,XX +XXX,XX @@ DO_LDAV(vmlsldavsw, 4, int32_t, false, +=, -=)
 DO_LDAV(vmlsldavxsw, 4, int32_t, true, +=, -=)
 
 /*
- * Rounding multiply add long dual accumulate high: we must keep
- * a 72-bit internal accumulator value and return the top 64 bits.
+ * Rounding multiply add long dual accumulate high. In the pseudocode
+ * this is implemented with a 72-bit internal accumulator value of which
+ * the top 64 bits are returned. We optimize this to avoid having to
+ * use 128-bit arithmetic -- we can do this because the 74-bit accumulator
+ * is squashed back into 64-bits after each beat.
  */
-#define DO_LDAVH(OP, ESIZE, TYPE, XCHG, EVENACC, ODDACC, TO128)         \
+#define DO_LDAVH(OP, TYPE, LTYPE, XCHG, SUB)                            \
     uint64_t HELPER(glue(mve_, OP))(CPUARMState *env, void *vn,         \
                                     void *vm, uint64_t a)               \
     {                                                                   \
         uint16_t mask = mve_element_mask(env);                          \
         unsigned e;                                                     \
         TYPE *n = vn, *m = vm;                                          \
-        Int128 acc = int128_lshift(TO128(a), 8);                        \
-        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
+        for (e = 0; e < 16 / 4; e++, mask >>= 4) {                      \
             if (mask & 1) {                                             \
+                LTYPE mul;                                              \
                 if (e & 1) {                                            \
-                    acc = ODDACC(acc, TO128(n[H##ESIZE(e - 1 * XCHG)] * \
-                                            m[H##ESIZE(e)]));           \
+                    mul = (LTYPE)n[H4(e - 1 * XCHG)] * m[H4(e)];        \
+                    if (SUB) {                                          \
+                        mul = -mul;                                     \
+                    }                                                   \
                 } else {                                                \
-                    acc = EVENACC(acc, TO128(n[H##ESIZE(e + 1 * XCHG)] * \
-                                             m[H##ESIZE(e)]));          \
+                    mul = (LTYPE)n[H4(e + 1 * XCHG)] * m[H4(e)];        \
                 }                                                       \
-                acc = int128_add(acc, int128_make64(1 << 7));           \
+                mul = (mul >> 8) + ((mul >> 7) & 1);                    \
+                a += mul;                                               \
             }                                                           \
         }                                                               \
         mve_advance_vpt(env);                                           \
-        return int128_getlo(int128_rshift(acc, 8));                     \
+        return a;                                                       \
     }
 
-DO_LDAVH(vrmlaldavhsw, 4, int32_t, false, int128_add, int128_add, int128_makes64)
-DO_LDAVH(vrmlaldavhxsw, 4, int32_t, true, int128_add, int128_add, int128_makes64)
+DO_LDAVH(vrmlaldavhsw, int32_t, int64_t, false, false)
+DO_LDAVH(vrmlaldavhxsw, int32_t, int64_t, true, false)
 
-DO_LDAVH(vrmlaldavhuw, 4, uint32_t, false, int128_add, int128_add, int128_make64)
+DO_LDAVH(vrmlaldavhuw, uint32_t, uint64_t, false, false)
 
-DO_LDAVH(vrmlsldavhsw, 4, int32_t, false, int128_add, int128_sub, int128_makes64)
-DO_LDAVH(vrmlsldavhxsw, 4, int32_t, true, int128_add, int128_sub, int128_makes64)
+DO_LDAVH(vrmlsldavhsw, int32_t, int64_t, false, true)
+DO_LDAVH(vrmlsldavhxsw, int32_t, int64_t, true, true)
 
 /* Vector add across vector */
 #define DO_VADDV(OP, ESIZE, TYPE)                               \
-- 
2.20.1

The function asimd_imm_const() in translate-neon.c is an
implementation of the pseudocode AdvSIMDExpandImm(), which we will
also want for MVE.  Move the implementation to translate.c, with a
prototype in translate.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-4-peter.maydell@linaro.org
---
 target/arm/translate.h      | 16 ++++++++++
 target/arm/translate-neon.c | 63 -------------------------------------
 target/arm/translate.c      | 57 +++++++++++++++++++++++++++++++++
 3 files changed, 73 insertions(+), 63 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline MemOp finalize_memop(DisasContext *s, MemOp opc)
     return opc | s->be_data;
 }
 
+/**
+ * asimd_imm_const: Expand an encoded SIMD constant value
+ *
+ * Expand a SIMD constant value. This is essentially the pseudocode
+ * AdvSIMDExpandImm, except that we also perform the boolean NOT needed for
+ * VMVN and VBIC (when cmode < 14 && op == 1).
+ *
+ * The combination cmode == 15 op == 1 is a reserved encoding for AArch32;
+ * callers must catch this.
+ *
+ * cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 was UNPREDICTABLE in v7A but
+ * is either not unpredictable or merely CONSTRAINED UNPREDICTABLE in v8A;
+ * we produce an immediate constant value of 0 in these cases.
+ */
+uint64_t asimd_imm_const(uint32_t imm, int cmode, int op);
+
 #endif /* TARGET_ARM_TRANSLATE_H */
diff --git a/target/arm/translate-neon.c b/target/arm/translate-neon.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c
+++ b/target/arm/translate-neon.c
@@ -XXX,XX +XXX,XX @@ DO_FP_2SH(VCVT_UH, gen_helper_gvec_vcvt_uh)
 DO_FP_2SH(VCVT_HS, gen_helper_gvec_vcvt_hs)
 DO_FP_2SH(VCVT_HU, gen_helper_gvec_vcvt_hu)
 
-static uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
-{
-    /*
-     * Expand the encoded constant.
-     * Note that cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 is UNPREDICTABLE.
-     * We choose to not special-case this and will behave as if a
-     * valid constant encoding of 0 had been given.
-     * cmode = 15 op = 1 must UNDEF; we assume decode has handled that.
-     */
-    switch (cmode) {
-    case 0: case 1:
-        /* no-op */
-        break;
-    case 2: case 3:
-        imm <<= 8;
-        break;
-    case 4: case 5:
-        imm <<= 16;
-        break;
-    case 6: case 7:
-        imm <<= 24;
-        break;
-    case 8: case 9:
-        imm |= imm << 16;
-        break;
-    case 10: case 11:
-        imm = (imm << 8) | (imm << 24);
-        break;
-    case 12:
-        imm = (imm << 8) | 0xff;
-        break;
-    case 13:
-        imm = (imm << 16) | 0xffff;
-        break;
-    case 14:
-        if (op) {
-            /*
-             * This is the only case where the top and bottom 32 bits
-             * of the encoded constant differ.
-             */
-            uint64_t imm64 = 0;
-            int n;
-
-            for (n = 0; n < 8; n++) {
-                if (imm & (1 << n)) {
-                    imm64 |= (0xffULL << (n * 8));
-                }
-            }
-            return imm64;
-        }
-        imm |= (imm << 8) | (imm << 16) | (imm << 24);
-        break;
-    case 15:
-        imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
-            | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
-        break;
-    }
-    if (op) {
-        imm = ~imm;
-    }
-    return dup_const(MO_32, imm);
-}
-
 static bool do_1reg_imm(DisasContext *s, arg_1reg_imm *a,
                         GVecGen2iFn *fn)
 {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void)
     a64_translate_init();
 }
 
+uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
+{
+    /* Expand the encoded constant as per AdvSIMDExpandImm pseudocode */
+    switch (cmode) {
+    case 0: case 1:
+        /* no-op */
+        break;
+    case 2: case 3:
+        imm <<= 8;
+        break;
+    case 4: case 5:
+        imm <<= 16;
+        break;
+    case 6: case 7:
+        imm <<= 24;
+        break;
+    case 8: case 9:
+        imm |= imm << 16;
+        break;
+    case 10: case 11:
+        imm = (imm << 8) | (imm << 24);
+        break;
+    case 12:
+        imm = (imm << 8) | 0xff;
+        break;
+    case 13:
+        imm = (imm << 16) | 0xffff;
+        break;
+    case 14:
+        if (op) {
+            /*
+             * This is the only case where the top and bottom 32 bits
+             * of the encoded constant differ.
+             */
+            uint64_t imm64 = 0;
+            int n;
+
+            for (n = 0; n < 8; n++) {
+                if (imm & (1 << n)) {
+                    imm64 |= (0xffULL << (n * 8));
+                }
+            }
+            return imm64;
+        }
+        imm |= (imm << 8) | (imm << 16) | (imm << 24);
+        break;
+    case 15:
+        imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
+            | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
+        break;
+    }
+    if (op) {
+        imm = ~imm;
+    }
+    return dup_const(MO_32, imm);
+}
+
 /* Generate a label used for skipping this instruction */
 void arm_gen_condlabel(DisasContext *s)
 {
-- 
2.20.1

The A64 AdvSIMD modified-immediate grouping uses almost the same
constant encoding that A32 Neon does; reuse asimd_imm_const() (to
which we add the AArch64-specific case for cmode 15 op 1) instead of
reimplementing it all.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-5-peter.maydell@linaro.org
---
 target/arm/translate.h     |  3 +-
 target/arm/translate-a64.c | 86 ++++----------------------------------
 target/arm/translate.c     | 17 +++++++-
 3 files changed, 24 insertions(+), 82 deletions(-)

diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ static inline MemOp finalize_memop(DisasContext *s, MemOp opc)
  * VMVN and VBIC (when cmode < 14 && op == 1).
  *
  * The combination cmode == 15 op == 1 is a reserved encoding for AArch32;
- * callers must catch this.
+ * callers must catch this; we return the 64-bit constant value defined
+ * for AArch64.
  *
  * cmode = 2,3,4,5,6,7,10,11,12,13 imm=0 was UNPREDICTABLE in v7A but
  * is either not unpredictable or merely CONSTRAINED UNPREDICTABLE in v8A;
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int cmode = extract32(insn, 12, 4);
-    int cmode_3_1 = extract32(cmode, 1, 3);
-    int cmode_0 = extract32(cmode, 0, 1);
     int o2 = extract32(insn, 11, 1);
     uint64_t abcdefgh = extract32(insn, 5, 5) | (extract32(insn, 16, 3) << 5);
     bool is_neg = extract32(insn, 29, 1);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* See AdvSIMDExpandImm() in ARM ARM */
-    switch (cmode_3_1) {
-    case 0: /* Replicate(Zeros(24):imm8, 2) */
-    case 1: /* Replicate(Zeros(16):imm8:Zeros(8), 2) */
-    case 2: /* Replicate(Zeros(8):imm8:Zeros(16), 2) */
-    case 3: /* Replicate(imm8:Zeros(24), 2) */
-    {
-        int shift = cmode_3_1 * 8;
-        imm = bitfield_replicate(abcdefgh << shift, 32);
-        break;
-    }
-    case 4: /* Replicate(Zeros(8):imm8, 4) */
-    case 5: /* Replicate(imm8:Zeros(8), 4) */
-    {
-        int shift = (cmode_3_1 & 0x1) * 8;
-        imm = bitfield_replicate(abcdefgh << shift, 16);
-        break;
-    }
-    case 6:
-        if (cmode_0) {
-            /* Replicate(Zeros(8):imm8:Ones(16), 2) */
-            imm = (abcdefgh << 16) | 0xffff;
-        } else {
-            /* Replicate(Zeros(16):imm8:Ones(8), 2) */
-            imm = (abcdefgh << 8) | 0xff;
-        }
-        imm = bitfield_replicate(imm, 32);
-        break;
-    case 7:
-        if (!cmode_0 && !is_neg) {
-            imm = bitfield_replicate(abcdefgh, 8);
-        } else if (!cmode_0 && is_neg) {
-            int i;
-            imm = 0;
-            for (i = 0; i < 8; i++) {
-                if ((abcdefgh) & (1 << i)) {
-                    imm |= 0xffULL << (i * 8);
-                }
-            }
-        } else if (cmode_0) {
-            if (is_neg) {
-                imm = (abcdefgh & 0x3f) << 48;
-                if (abcdefgh & 0x80) {
-                    imm |= 0x8000000000000000ULL;
-                }
-                if (abcdefgh & 0x40) {
-                    imm |= 0x3fc0000000000000ULL;
-                } else {
-                    imm |= 0x4000000000000000ULL;
-                }
-            } else {
-                if (o2) {
-                    /* FMOV (vector, immediate) - half-precision */
-                    imm = vfp_expand_imm(MO_16, abcdefgh);
-                    /* now duplicate across the lanes */
-                    imm = bitfield_replicate(imm, 16);
-                } else {
-                    imm = (abcdefgh & 0x3f) << 19;
-                    if (abcdefgh & 0x80) {
-                        imm |= 0x80000000;
-                    }
-                    if (abcdefgh & 0x40) {
-                        imm |= 0x3e000000;
-                    } else {
-                        imm |= 0x40000000;
-                    }
-                    imm |= (imm << 32);
-                }
-            }
-        }
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    if (cmode_3_1 != 7 && is_neg) {
-        imm = ~imm;
+    if (cmode == 15 && o2 && !is_neg) {
+        /* FMOV (vector, immediate) - half-precision */
+        imm = vfp_expand_imm(MO_16, abcdefgh);
+        /* now duplicate across the lanes */
+        imm = bitfield_replicate(imm, 16);
+    } else {
+        imm = asimd_imm_const(abcdefgh, cmode, is_neg);
     }
 
     if (!((cmode & 0x9) == 0x1 || (cmode & 0xd) == 0x9)) {
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
     case 14:
         if (op) {
             /*
-             * This is the only case where the top and bottom 32 bits
-             * of the encoded constant differ.
+             * This and cmode == 15 op == 1 are the only cases where
+             * the top and bottom 32 bits of the encoded constant differ.
              */
             uint64_t imm64 = 0;
             int n;
@@ -XXX,XX +XXX,XX @@ uint64_t asimd_imm_const(uint32_t imm, int cmode, int op)
         imm |= (imm << 8) | (imm << 16) | (imm << 24);
         break;
     case 15:
+        if (op) {
+            /* Reserved encoding for AArch32; valid for AArch64 */
+            uint64_t imm64 = (uint64_t)(imm & 0x3f) << 48;
+            if (imm & 0x80) {
+                imm64 |= 0x8000000000000000ULL;
+            }
+            if (imm & 0x40) {
+                imm64 |= 0x3fc0000000000000ULL;
+            } else {
+                imm64 |= 0x4000000000000000ULL;
+            }
+            return imm64;
+        }
         imm = ((imm & 0x80) << 24) | ((imm & 0x3f) << 19)
             | ((imm & 0x40) ? (0x1f << 25) : (1 << 30));
         break;
-- 
2.20.1

Use dup_const() instead of bitfield_replicate() in
disas_simd_mod_imm().

(We can't replace the other use of bitfield_replicate() in this file,
in logic_imm_decode_wmask(), because that location needs to handle 2
and 4 bit elements, which dup_const() cannot.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-6-peter.maydell@linaro.org
---
 target/arm/translate-a64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_mod_imm(DisasContext *s, uint32_t insn)
         /* FMOV (vector, immediate) - half-precision */
         imm = vfp_expand_imm(MO_16, abcdefgh);
         /* now duplicate across the lanes */
-        imm = bitfield_replicate(imm, 16);
+        imm = dup_const(MO_16, imm);
     } else {
         imm = asimd_imm_const(abcdefgh, cmode, is_neg);
     }
-- 
2.20.1

Implement the MVE logical-immediate insns (VMOV, VMVN,
VORR and VBIC). These have essentially the same encoding
as their Neon equivalents, and we implement the decode
in the same way.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-7-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  4 +++
 target/arm/mve.decode      | 17 +++++++++++++
 target/arm/mve_helper.c    | 24 ++++++++++++++++++
 target/arm/translate-mve.c | 50 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 95 insertions(+)

Implement the MVE shift-vector-left-by-immediate insns VSHL, VQSHL
and VQSHLU.

The size-and-immediate encoding here is the same as Neon, and we
handle it the same way neon-dp.decode does.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-8-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    | 16 +++++++++++
 target/arm/mve.decode      | 23 +++++++++++++++
 target/arm/mve_helper.c    | 57 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-mve.c | 51 ++++++++++++++++++++++++++++++++++
 4 files changed, 147 insertions(+)

diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-mve.h
+++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(mve_vaddvuw, TCG_CALL_NO_WG, i32, env, ptr, i32)
 DEF_HELPER_FLAGS_3(mve_vmovi, TCG_CALL_NO_WG, void, env, ptr, i64)
 DEF_HELPER_FLAGS_3(mve_vandi, TCG_CALL_NO_WG, void, env, ptr, i64)
 DEF_HELPER_FLAGS_3(mve_vorri, TCG_CALL_NO_WG, void, env, ptr, i64)
+
+DEF_HELPER_FLAGS_4(mve_vshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshli_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshli_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshlui_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshlui_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshlui_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
diff --git a/target/arm/mve.decode b/target/arm/mve.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve.decode
+++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@
 &2op qd qm qn size
 &2scalar qd qn rm size
 &1imm qd imm cmode op
+&2shift qd qm shift size
 
 @vldr_vstr ....... . . . . l:1 rn:4 ... ...... imm:7 &vldr_vstr qd=%qd u=0
 # Note that both Rn and Qd are 3 bits only (no D bit)
@@ -XXX,XX +XXX,XX @@
 @2scalar .... .... .. size:2 .... .... .... .... rm:4 &2scalar qd=%qd qn=%qn
 @2scalar_nosz .... .... .... .... .... .... .... rm:4 &2scalar qd=%qd qn=%qn
 
+@2_shl_b .... .... .. 001 shift:3 .... .... .... .... &2shift qd=%qd qm=%qm size=0
+@2_shl_h .... .... .. 01  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
+@2_shl_w .... .... .. 1   shift:5 .... .... .... .... &2shift qd=%qd qm=%qm size=2
+
 # Vector loads and stores
 
 # Widening loads and narrowing stores:
@@ -XXX,XX +XXX,XX @@ VPST             1111 1110 0 . 11 000 1 ... 0 1111 0100 1101 mask=%mask_22_13
 # So we have a single decode line and check the cmode/op in the
 # trans function.
 Vimm_1r 111 . 1111 1 . 00 0 ... ... 0 .... 0 1 . 1 .... @1imm
+
+# Shifts by immediate
+
+VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_b
+VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_h
+VSHLI             111 0 1111 1 . ... ... ... 0 0101 0 1 . 1 ... 0 @2_shl_w
+
+VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_b
+VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_h
+VQSHLI_S          111 0 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_w
+
+VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_b
+VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_h
+VQSHLI_U          111 1 1111 1 . ... ... ... 0 0111 0 1 . 1 ... 0 @2_shl_w
+
+VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_b
+VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_h
+VQSHLUI           111 1 1111 1 . ... ... ... 0 0110 0 1 . 1 ... 0 @2_shl_w
diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve_helper.c
+++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_2OP_SAT(vqsubsw, 4, int32_t, DO_SQSUB_W)
     WRAP_QRSHL_HELPER(do_sqrshl_bhs, N, M, true, satp)
 #define DO_UQRSHL_OP(N, M, satp) \
     WRAP_QRSHL_HELPER(do_uqrshl_bhs, N, M, true, satp)
+#define DO_SUQSHL_OP(N, M, satp) \
+    WRAP_QRSHL_HELPER(do_suqrshl_bhs, N, M, false, satp)
 
 DO_2OP_SAT_S(vqshls, DO_SQSHL_OP)
 DO_2OP_SAT_U(vqshlu, DO_UQSHL_OP)
@@ -XXX,XX +XXX,XX @@ DO_VADDV(vaddvsw, 4, uint32_t)
 DO_VADDV(vaddvub, 1, uint8_t)
 DO_VADDV(vaddvuh, 2, uint16_t)
 DO_VADDV(vaddvuw, 4, uint32_t)
+
+/* Shifts by immediate */
+#define DO_2SHIFT(OP, ESIZE, TYPE, FN)                          \
+    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
+                                void *vm, uint32_t shift)       \
+    {                                                           \
+        TYPE *d = vd, *m = vm;                                  \
+        uint16_t mask = mve_element_mask(env);                  \
+        unsigned e;                                             \
+        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
+            mergemask(&d[H##ESIZE(e)],                          \
+                      FN(m[H##ESIZE(e)], shift), mask);         \
+        }                                                       \
+        mve_advance_vpt(env);                                   \
+    }
+
+#define DO_2SHIFT_SAT(OP, ESIZE, TYPE, FN)                      \
+    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
+                                void *vm, uint32_t shift)       \
+    {                                                           \
+        TYPE *d = vd, *m = vm;                                  \
+        uint16_t mask = mve_element_mask(env);                  \
+        unsigned e;                                             \
+        bool qc = false;                                        \
+        for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
+            bool sat = false;                                   \
+            mergemask(&d[H##ESIZE(e)],                          \
+                      FN(m[H##ESIZE(e)], shift, &sat), mask);   \
+            qc |= sat & mask & 1;                               \
+        }                                                       \
+        if (qc) {                                               \
+            env->vfp.qc[0] = qc;                                \
+        }                                                       \
+        mve_advance_vpt(env);                                   \
+    }
+
+/* provide unsigned 2-op shift helpers for all sizes */
+#define DO_2SHIFT_U(OP, FN)                     \
+    DO_2SHIFT(OP##b, 1, uint8_t, FN)            \
+    DO_2SHIFT(OP##h, 2, uint16_t, FN)           \
+    DO_2SHIFT(OP##w, 4, uint32_t, FN)
+
+#define DO_2SHIFT_SAT_U(OP, FN)                 \
+    DO_2SHIFT_SAT(OP##b, 1, uint8_t, FN)        \
+    DO_2SHIFT_SAT(OP##h, 2, uint16_t, FN)       \
+    DO_2SHIFT_SAT(OP##w, 4, uint32_t, FN)
+#define DO_2SHIFT_SAT_S(OP, FN)                 \
+    DO_2SHIFT_SAT(OP##b, 1, int8_t, FN)         \
+    DO_2SHIFT_SAT(OP##h, 2, int16_t, FN)        \
+    DO_2SHIFT_SAT(OP##w, 4, int32_t, FN)
+
+DO_2SHIFT_U(vshli_u, DO_VSHLU)
+DO_2SHIFT_SAT_U(vqshli_u, DO_UQSHL_OP)
+DO_2SHIFT_SAT_S(vqshli_s, DO_SQSHL_OP)
+DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ typedef void MVEGenLdStFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void MVEGenOneOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 typedef void MVEGenTwoOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_ptr);
 typedef void MVEGenTwoOpScalarFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32);
+typedef void MVEGenTwoOpShiftFn(TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void MVEGenDualAccOpFn(TCGv_i64, TCGv_ptr, TCGv_ptr, TCGv_ptr, TCGv_i64);
 typedef void MVEGenVADDVFn(TCGv_i32, TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void MVEGenOneOpImmFn(TCGv_ptr, TCGv_ptr, TCGv_i64);
@@ -XXX,XX +XXX,XX @@ static bool trans_Vimm_1r(DisasContext *s, arg_1imm *a)
     }
     return do_1imm(s, a, fn);
 }
+
+static bool do_2shift(DisasContext *s, arg_2shift *a, MVEGenTwoOpShiftFn fn,
+                      bool negateshift)
+{
+    TCGv_ptr qd, qm;
+    int shift = a->shift;
+
+    if (!dc_isar_feature(aa32_mve, s) ||
+        !mve_check_qreg_bank(s, a->qd | a->qm) ||
+        !fn) {
+        return false;
+    }
+    if (!mve_eci_check(s) || !vfp_access_check(s)) {
+        return true;
+    }
+
+    /*
+     * When we handle a right shift insn using a left-shift helper
+     * which permits a negative shift count to indicate a right-shift,
+     * we must negate the shift count.
+     */
+    if (negateshift) {
+        shift = -shift;
+    }
+
+    qd = mve_qreg_ptr(a->qd);
+    qm = mve_qreg_ptr(a->qm);
+    fn(cpu_env, qd, qm, tcg_constant_i32(shift));
+    tcg_temp_free_ptr(qd);
+    tcg_temp_free_ptr(qm);
+    mve_update_eci(s);
+    return true;
+}
+
+#define DO_2SHIFT(INSN, FN, NEGATESHIFT)                         \
+    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
+    {                                                           \
+        static MVEGenTwoOpShiftFn * const fns[] = {             \
+            gen_helper_mve_##FN##b,                             \
+            gen_helper_mve_##FN##h,                             \
+            gen_helper_mve_##FN##w,                             \
+            NULL,                                               \
+        };                                                      \
+        return do_2shift(s, a, fns[a->size], NEGATESHIFT);      \
+    }
+
+DO_2SHIFT(VSHLI, vshli_u, false)
+DO_2SHIFT(VQSHLI_S, vqshli_s, false)
+DO_2SHIFT(VQSHLI_U, vqshli_u, false)
+DO_2SHIFT(VQSHLUI, vqshlui_s, false)
-- 
2.20.1

Implement the MVE vector shift right by immediate insns VSHRI and
VRSHRI.  As with Neon, we implement these by using helper functions
which perform left shifts but allow negative shift counts to indicate
right shifts.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-9-peter.maydell@linaro.org
---
 target/arm/helper-mve.h     | 12 ++++++++++++
 target/arm/translate.h      | 20 ++++++++++++++++++++
 target/arm/mve.decode       | 28 ++++++++++++++++++++++++++++
 target/arm/mve_helper.c     |  7 +++++++
 target/arm/translate-mve.c  |  5 +++++
 target/arm/translate-neon.c | 18 ------------------
 6 files changed, 72 insertions(+), 18 deletions(-)

Implement the MVE VHLL (vector shift left long) insn.  This has two
encodings: the T1 encoding is the usual shift-by-immediate format,
and the T2 encoding is a special case where the shift count is always
equal to the element size.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-10-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  9 +++++++
 target/arm/mve.decode      | 53 +++++++++++++++++++++++++++++++++++---
 target/arm/mve_helper.c    | 32 +++++++++++++++++++++++
 target/arm/translate-mve.c | 15 +++++++++++
 4 files changed, 105 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-mve.h
+++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vrshli_sw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshli_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshli_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshli_uw, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vshllbsb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshllbsh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshllbub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshllbuh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshlltsb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshlltsh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshlltub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vshlltuh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
diff --git a/target/arm/mve.decode b/target/arm/mve.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve.decode
+++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@
 @2_shl_h .... .... .. 01  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
 @2_shl_w .... .... .. 1   shift:5 .... .... .... .... &2shift qd=%qd qm=%qm size=2
 
+@2_shll_b .... .... ... 01 shift:3 .... .... .... .... &2shift qd=%qd qm=%qm size=0
+@2_shll_h .... .... ... 1  shift:4 .... .... .... .... &2shift qd=%qd qm=%qm size=1
+# VSHLL encoding T2 where shift == esize
+@2_shll_esize_b .... .... .... 00 .. .... .... .... .... &2shift \
+                qd=%qd qm=%qm size=0 shift=8
+@2_shll_esize_h .... .... .... 01 .. .... .... .... .... &2shift \
+                qd=%qd qm=%qm size=1 shift=16
+
 # Right shifts are encoded as N - shift, where N is the element size in bits.
 %rshift_i5  16:5 !function=rsub_32
 %rshift_i4  16:4 !function=rsub_16
@@ -XXX,XX +XXX,XX @@ VADD             1110 1111 0 . .. ... 0 ... 0 1000 . 1 . 0 ... 0 @2op
 VSUB             1111 1111 0 . .. ... 0 ... 0 1000 . 1 . 0 ... 0 @2op
 VMUL             1110 1111 0 . .. ... 0 ... 0 1001 . 1 . 1 ... 0 @2op
 
-VMULH_S          111 0 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
-VMULH_U          111 1 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
+# The VSHLL T2 encoding is not a @2op pattern, but is here because it
+# overlaps what would be size=0b11 VMULH/VRMULH
+{
+  VSHLL_BS       111 0 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_b
+  VSHLL_BS       111 0 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_h
 
-VRMULH_S         111 0 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
-VRMULH_U         111 1 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
+  VMULH_S        111 0 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
+}
+
+{
+  VSHLL_BU       111 1 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_b
+  VSHLL_BU       111 1 1110 0 . 11 .. 01 ... 0 1110 0 0 . 0 ... 1 @2_shll_esize_h
+
+  VMULH_U        111 1 1110 0 . .. ...1 ... 0 1110 . 0 . 0 ... 1 @2op
+}
+
+{
+  VSHLL_TS       111 0 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_b
+  VSHLL_TS       111 0 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_h
+
+  VRMULH_S       111 0 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
+}
+
+{
+  VSHLL_TU       111 1 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_b
+  VSHLL_TU       111 1 1110 0 . 11 .. 01 ... 1 1110 0 0 . 0 ... 1 @2_shll_esize_h
+
+  VRMULH_U       111 1 1110 0 . .. ...1 ... 1 1110 . 0 . 0 ... 1 @2op
+}
 
 VMAX_S           111 0 1111 0 . .. ... 0 ... 0 0110 . 1 . 0 ... 0 @2op
 VMAX_U           111 1 1111 0 . .. ... 0 ... 0 0110 . 1 . 0 ... 0 @2op
@@ -XXX,XX +XXX,XX @@ VRSHRI_S          111 0 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
 VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_b
 VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_h
 VRSHRI_U          111 1 1111 1 . ... ... ... 0 0010 0 1 . 1 ... 0 @2_shr_w
+
+# VSHLL T1 encoding; the T2 VSHLL encoding is elsewhere in this file
+VSHLL_BS          111 0 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_b
+VSHLL_BS          111 0 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_h
+
+VSHLL_BU          111 1 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_b
+VSHLL_BU          111 1 1110 1 . 1 .. ... ... 0 1111 0 1 . 0 ... 0 @2_shll_h
+
+VSHLL_TS          111 0 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_b
+VSHLL_TS          111 0 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
+
+VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_b
+VSHLL_TU          111 1 1110 1 . 1 .. ... ... 1 1111 0 1 . 0 ... 0 @2_shll_h
diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve_helper.c
+++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_SAT_S(vqshli_s, DO_SQSHL_OP)
 DO_2SHIFT_SAT_S(vqshlui_s, DO_SUQSHL_OP)
 DO_2SHIFT_U(vrshli_u, DO_VRSHLU)
 DO_2SHIFT_S(vrshli_s, DO_VRSHLS)
+
+/*
+ * Long shifts taking half-sized inputs from top or bottom of the input
+ * vector and producing a double-width result. ESIZE, TYPE are for
+ * the input, and LESIZE, LTYPE for the output.
+ * Unlike the normal shift helpers, we do not handle negative shift counts,
+ * because the long shift is strictly left-only.
+ */
+#define DO_VSHLL(OP, TOP, ESIZE, TYPE, LESIZE, LTYPE)                   \
+    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,             \
+                                void *vm, uint32_t shift)               \
+    {                                                                   \
+        LTYPE *d = vd;                                                  \
+        TYPE *m = vm;                                                   \
+        uint16_t mask = mve_element_mask(env);                          \
+        unsigned le;                                                    \
+        assert(shift <= 16);                                            \
+        for (le = 0; le < 16 / LESIZE; le++, mask >>= LESIZE) {         \
+            LTYPE r = (LTYPE)m[H##ESIZE(le * 2 + TOP)] << shift;        \
+            mergemask(&d[H##LESIZE(le)], r, mask);                      \
+        }                                                               \
+        mve_advance_vpt(env);                                           \
+    }
+
+#define DO_VSHLL_ALL(OP, TOP)                                \
+    DO_VSHLL(OP##sb, TOP, 1, int8_t, 2, int16_t)             \
+    DO_VSHLL(OP##ub, TOP, 1, uint8_t, 2, uint16_t)           \
+    DO_VSHLL(OP##sh, TOP, 2, int16_t, 4, int32_t)            \
+    DO_VSHLL(OP##uh, TOP, 2, uint16_t, 4, uint32_t)          \
+
+DO_VSHLL_ALL(vshllb, false)
+DO_VSHLL_ALL(vshllt, true)
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT(VSHRI_S, vshli_s, true)
 DO_2SHIFT(VSHRI_U, vshli_u, true)
 DO_2SHIFT(VRSHRI_S, vrshli_s, true)
 DO_2SHIFT(VRSHRI_U, vrshli_u, true)
+
+#define DO_VSHLL(INSN, FN)                                      \
+    static bool trans_##INSN(DisasContext *s, arg_2shift *a)    \
+    {                                                           \
+        static MVEGenTwoOpShiftFn * const fns[] = {             \
+            gen_helper_mve_##FN##b,                             \
+            gen_helper_mve_##FN##h,                             \
+        };                                                      \
+        return do_2shift(s, a, fns[a->size], false);            \
+    }
+
+DO_VSHLL(VSHLL_BS, vshllbs)
+DO_VSHLL(VSHLL_BU, vshllbu)
+DO_VSHLL(VSHLL_TS, vshllts)
+DO_VSHLL(VSHLL_TU, vshlltu)
-- 
2.20.1

Implement the MVE VSRI and VSLI insns, which perform a
shift-and-insert operation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-11-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  8 ++++++++
 target/arm/mve.decode      |  9 ++++++++
 target/arm/mve_helper.c    | 42 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-mve.c |  3 +++
 4 files changed, 62 insertions(+)

Implement the MVE shift-right-and-narrow insn VSHRN and VRSHRN.

do_urshr() is borrowed from sve_helper.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-12-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    | 10 ++++++++++
 target/arm/mve.decode      | 11 +++++++++++
 target/arm/mve_helper.c    | 40 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-mve.c | 15 ++++++++++++++
 4 files changed, 76 insertions(+)

Implement the MVE saturating shift-right-and-narrow insns
VQSHRN, VQSHRUN, VQRSHRN and VQRSHRUN.

do_srshr() is borrowed from sve_helper.c.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-13-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  30 +++++++++++
 target/arm/mve.decode      |  28 ++++++++++
 target/arm/mve_helper.c    | 104 +++++++++++++++++++++++++++++++++++++
 target/arm/translate-mve.c |  12 +++++
 4 files changed, 174 insertions(+)

diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-mve.h
+++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vrshrnbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshrnbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshrntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 DEF_HELPER_FLAGS_4(mve_vrshrnth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshrnb_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnb_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnt_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnt_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshrnb_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnb_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnt_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrnt_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqshrunbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrunbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqrshrnb_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnb_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnt_sb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnt_sh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqrshrnb_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnb_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnt_ub, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrnt_uh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+
+DEF_HELPER_FLAGS_4(mve_vqrshrunbb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrunbh, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshruntb, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
+DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
diff --git a/target/arm/mve.decode b/target/arm/mve.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve.decode
+++ b/target/arm/mve.decode
@@ -XXX,XX +XXX,XX @@ VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_b
 VRSHRNB           111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 1 @2_shr_h
 VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_b
 VRSHRNT           111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 1 @2_shr_h
+
+VQSHRNB_S         111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_b
+VQSHRNB_S         111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_h
+VQSHRNT_S         111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_b
+VQSHRNT_S         111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_h
+VQSHRNB_U         111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_b
+VQSHRNB_U         111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 0 @2_shr_h
+VQSHRNT_U         111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_b
+VQSHRNT_U         111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 0 @2_shr_h
+
+VQSHRUNB          111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_b
+VQSHRUNB          111 0 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_h
+VQSHRUNT          111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_b
+VQSHRUNT          111 0 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_h
+
+VQRSHRNB_S        111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_b
+VQRSHRNB_S        111 0 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_h
+VQRSHRNT_S        111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_b
+VQRSHRNT_S        111 0 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_h
+VQRSHRNB_U        111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_b
+VQRSHRNB_U        111 1 1110 1 . ... ... ... 0 1111 0 1 . 0 ... 1 @2_shr_h
+VQRSHRNT_U        111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_b
+VQRSHRNT_U        111 1 1110 1 . ... ... ... 1 1111 0 1 . 0 ... 1 @2_shr_h
+
+VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_b
+VQRSHRUNB         111 1 1110 1 . ... ... ... 0 1111 1 1 . 0 ... 0 @2_shr_h
+VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_b
+VQRSHRUNT         111 1 1110 1 . ... ... ... 1 1111 1 1 . 0 ... 0 @2_shr_h
diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve_helper.c
+++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint64_t do_urshr(uint64_t x, unsigned sh)
     }
 }
 
+static inline int64_t do_srshr(int64_t x, unsigned sh)
+{
+    if (likely(sh < 64)) {
+        return (x >> sh) + ((x >> (sh - 1)) & 1);
+    } else {
+        /* Rounding the sign bit always produces 0. */
+        return 0;
+    }
+}
+
 DO_VSHRN_ALL(vshrn, DO_SHR)
 DO_VSHRN_ALL(vrshrn, do_urshr)
+
+static inline int32_t do_sat_bhs(int64_t val, int64_t min, int64_t max,
+                                 bool *satp)
+{
+    if (val > max) {
+        *satp = true;
+        return max;
+    } else if (val < min) {
+        *satp = true;
+        return min;
+    } else {
+        return val;
+    }
+}
+
+/* Saturating narrowing right shifts */
+#define DO_VSHRN_SAT(OP, TOP, ESIZE, TYPE, LESIZE, LTYPE, FN)   \
+    void HELPER(glue(mve_, OP))(CPUARMState *env, void *vd,     \
+                                void *vm, uint32_t shift)       \
+    {                                                           \
+        LTYPE *m = vm;                                          \
+        TYPE *d = vd;                                           \
+        uint16_t mask = mve_element_mask(env);                  \
+        bool qc = false;                                        \
+        unsigned le;                                            \
+        for (le = 0; le < 16 / LESIZE; le++, mask >>= LESIZE) { \
+            bool sat = false;                                   \
+            TYPE r = FN(m[H##LESIZE(le)], shift, &sat);         \
+            mergemask(&d[H##ESIZE(le * 2 + TOP)], r, mask);     \
+            qc |= sat && (mask & 1 << (TOP * ESIZE));           \
+        }                                                       \
+        if (qc) {                                               \
+            env->vfp.qc[0] = qc;                                \
+        }                                                       \
+        mve_advance_vpt(env);                                   \
+    }
+
+#define DO_VSHRN_SAT_UB(BOP, TOP, FN)                           \
+    DO_VSHRN_SAT(BOP, false, 1, uint8_t, 2, uint16_t, FN)       \
+    DO_VSHRN_SAT(TOP, true, 1, uint8_t, 2, uint16_t, FN)
+
+#define DO_VSHRN_SAT_UH(BOP, TOP, FN)                           \
+    DO_VSHRN_SAT(BOP, false, 2, uint16_t, 4, uint32_t, FN)      \
+    DO_VSHRN_SAT(TOP, true, 2, uint16_t, 4, uint32_t, FN)
+
+#define DO_VSHRN_SAT_SB(BOP, TOP, FN)                           \
+    DO_VSHRN_SAT(BOP, false, 1, int8_t, 2, int16_t, FN)         \
+    DO_VSHRN_SAT(TOP, true, 1, int8_t, 2, int16_t, FN)
+
+#define DO_VSHRN_SAT_SH(BOP, TOP, FN)                           \
+    DO_VSHRN_SAT(BOP, false, 2, int16_t, 4, int32_t, FN)        \
+    DO_VSHRN_SAT(TOP, true, 2, int16_t, 4, int32_t, FN)
+
+#define DO_SHRN_SB(N, M, SATP)                                  \
+    do_sat_bhs((int64_t)(N) >> (M), INT8_MIN, INT8_MAX, SATP)
+#define DO_SHRN_UB(N, M, SATP)                                  \
+    do_sat_bhs((uint64_t)(N) >> (M), 0, UINT8_MAX, SATP)
+#define DO_SHRUN_B(N, M, SATP)                                  \
+    do_sat_bhs((int64_t)(N) >> (M), 0, UINT8_MAX, SATP)
+
+#define DO_SHRN_SH(N, M, SATP)                                  \
+    do_sat_bhs((int64_t)(N) >> (M), INT16_MIN, INT16_MAX, SATP)
+#define DO_SHRN_UH(N, M, SATP)                                  \
+    do_sat_bhs((uint64_t)(N) >> (M), 0, UINT16_MAX, SATP)
+#define DO_SHRUN_H(N, M, SATP)                                  \
+    do_sat_bhs((int64_t)(N) >> (M), 0, UINT16_MAX, SATP)
+
+#define DO_RSHRN_SB(N, M, SATP)                                 \
+    do_sat_bhs(do_srshr(N, M), INT8_MIN, INT8_MAX, SATP)
+#define DO_RSHRN_UB(N, M, SATP)                                 \
+    do_sat_bhs(do_urshr(N, M), 0, UINT8_MAX, SATP)
+#define DO_RSHRUN_B(N, M, SATP)                                 \
+    do_sat_bhs(do_srshr(N, M), 0, UINT8_MAX, SATP)
+
+#define DO_RSHRN_SH(N, M, SATP)                                 \
+    do_sat_bhs(do_srshr(N, M), INT16_MIN, INT16_MAX, SATP)
+#define DO_RSHRN_UH(N, M, SATP)                                 \
+    do_sat_bhs(do_urshr(N, M), 0, UINT16_MAX, SATP)
+#define DO_RSHRUN_H(N, M, SATP)                                 \
+    do_sat_bhs(do_srshr(N, M), 0, UINT16_MAX, SATP)
+
+DO_VSHRN_SAT_SB(vqshrnb_sb, vqshrnt_sb, DO_SHRN_SB)
+DO_VSHRN_SAT_SH(vqshrnb_sh, vqshrnt_sh, DO_SHRN_SH)
+DO_VSHRN_SAT_UB(vqshrnb_ub, vqshrnt_ub, DO_SHRN_UB)
+DO_VSHRN_SAT_UH(vqshrnb_uh, vqshrnt_uh, DO_SHRN_UH)
+DO_VSHRN_SAT_SB(vqshrunbb, vqshruntb, DO_SHRUN_B)
+DO_VSHRN_SAT_SH(vqshrunbh, vqshrunth, DO_SHRUN_H)
+
+DO_VSHRN_SAT_SB(vqrshrnb_sb, vqrshrnt_sb, DO_RSHRN_SB)
+DO_VSHRN_SAT_SH(vqrshrnb_sh, vqrshrnt_sh, DO_RSHRN_SH)
+DO_VSHRN_SAT_UB(vqrshrnb_ub, vqrshrnt_ub, DO_RSHRN_UB)
+DO_VSHRN_SAT_UH(vqrshrnb_uh, vqrshrnt_uh, DO_RSHRN_UH)
+DO_VSHRN_SAT_SB(vqrshrunbb, vqrshruntb, DO_RSHRUN_B)
+DO_VSHRN_SAT_SH(vqrshrunbh, vqrshrunth, DO_RSHRUN_H)
diff --git a/target/arm/translate-mve.c b/target/arm/translate-mve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-mve.c
+++ b/target/arm/translate-mve.c
@@ -XXX,XX +XXX,XX @@ DO_2SHIFT_N(VSHRNB, vshrnb)
 DO_2SHIFT_N(VSHRNT, vshrnt)
 DO_2SHIFT_N(VRSHRNB, vrshrnb)
 DO_2SHIFT_N(VRSHRNT, vrshrnt)
+DO_2SHIFT_N(VQSHRNB_S, vqshrnb_s)
+DO_2SHIFT_N(VQSHRNT_S, vqshrnt_s)
+DO_2SHIFT_N(VQSHRNB_U, vqshrnb_u)
+DO_2SHIFT_N(VQSHRNT_U, vqshrnt_u)
+DO_2SHIFT_N(VQSHRUNB, vqshrunb)
+DO_2SHIFT_N(VQSHRUNT, vqshrunt)
+DO_2SHIFT_N(VQRSHRNB_S, vqrshrnb_s)
+DO_2SHIFT_N(VQRSHRNT_S, vqrshrnt_s)
+DO_2SHIFT_N(VQRSHRNB_U, vqrshrnb_u)
+DO_2SHIFT_N(VQRSHRNT_U, vqrshrnt_u)
+DO_2SHIFT_N(VQRSHRUNB, vqrshrunb)
+DO_2SHIFT_N(VQRSHRUNT, vqrshrunt)
-- 
2.20.1

Implement the MVE VSHLC insn, which performs a shift left of the
entire vector with carry in bits provided from a general purpose
register and carry out bits written back to that register.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-14-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  2 ++
 target/arm/mve.decode      |  2 ++
 target/arm/mve_helper.c    | 38 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-mve.c | 30 ++++++++++++++++++++++++++++++
 4 files changed, 72 insertions(+)

Implement the MVE VADDLV insn; this is similar to VADDV, except
that it accumulates 32-bit elements into a 64-bit accumulator
stored in a pair of general-purpose registers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-15-peter.maydell@linaro.org
---
 target/arm/helper-mve.h    |  3 ++
 target/arm/mve.decode      |  6 +++-
 target/arm/mve_helper.c    | 19 ++++++++++++
 target/arm/translate-mve.c | 63 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 90 insertions(+), 1 deletion(-)

The MVE extension to v8.1M includes some new shift instructions which
sit entirely within the non-coprocessor part of the encoding space
and which operate only on general-purpose registers.  They take up
the space which was previously UNPREDICTABLE MOVS and ORRS encodings
with Rm == 13 or 15.

Implement the long shifts by immediate, which perform shifts on a
pair of general-purpose registers treated as a 64-bit quantity, with
an immediate shift count between 1 and 32.

Awkwardly, because the MOVS and ORRS trans functions do not UNDEF for
the Rm==13,15 case, we need to explicitly emit code to UNDEF for the
cases where v8.1M now requires that.  (Trying to change MOVS and ORRS
is too difficult, because the functions that generate the code are
shared between a dozen different kinds of arithmetic or logical
instruction for all A32, T16 and T32 encodings, and for some insns
and some encodings Rm==13,15 are valid.)

We make the helper functions we need for UQSHLL and SQSHLL take
a 32-bit value which the helper casts to int8_t because we'll need
these helpers also for the shift-by-register insns, where the shift
count might be < 0 or > 32.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-16-peter.maydell@linaro.org
---
 target/arm/helper-mve.h |  3 ++
 target/arm/translate.h  |  1 +
 target/arm/t32.decode   | 28 +++++++++++++
 target/arm/mve_helper.c | 10 +++++
 target/arm/translate.c  | 90 +++++++++++++++++++++++++++++++++++++++++
 5 files changed, 132 insertions(+)

Implement the MVE long shifts by register, which perform shifts on a
pair of general-purpose registers treated as a 64-bit quantity, with
the shift count in another general-purpose register, which might be
either positive or negative.

Like the long-shifts-by-immediate, these encodings sit in the space
that was previously the UNPREDICTABLE MOVS/ORRS with Rm==13,15.
Because LSLL_rr and ASRL_rr overlap with both MOV_rxri/ORR_rrri and
also with CSEL (as one of the previously-UNPREDICTABLE Rm==13 cases),
we have to move the CSEL pattern into the same decodetree group.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-17-peter.maydell@linaro.org
---
 target/arm/helper-mve.h |  6 +++
 target/arm/translate.h  |  1 +
 target/arm/t32.decode   | 16 +++++--
 target/arm/mve_helper.c | 93 +++++++++++++++++++++++++++++++++++++++++
 target/arm/translate.c  | 69 ++++++++++++++++++++++++++++++
 5 files changed, 182 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper-mve.h b/target/arm/helper-mve.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-mve.h
+++ b/target/arm/helper-mve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(mve_vqrshrunth, TCG_CALL_NO_WG, void, env, ptr, ptr, i32)
 
 DEF_HELPER_FLAGS_4(mve_vshlc, TCG_CALL_NO_WG, i32, env, ptr, i32, i32)
 
+DEF_HELPER_FLAGS_3(mve_sshrl, TCG_CALL_NO_RWG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(mve_ushll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 DEF_HELPER_FLAGS_3(mve_sqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
 DEF_HELPER_FLAGS_3(mve_uqshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(mve_sqrshrl, TCG_CALL_NO_RWG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(mve_uqrshll, TCG_CALL_NO_RWG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(mve_sqrshrl48, TCG_CALL_NO_RWG, i64, env, i64, i32)
+DEF_HELPER_FLAGS_3(mve_uqrshll48, TCG_CALL_NO_RWG, i64, env, i64, i32)
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef void CryptoThreeOpIntFn(TCGv_ptr, TCGv_ptr, TCGv_i32);
 typedef void CryptoThreeOpFn(TCGv_ptr, TCGv_ptr, TCGv_ptr);
 typedef void AtomicThreeOpFn(TCGv_i64, TCGv_i64, TCGv_i64, TCGArg, MemOp);
 typedef void WideShiftImmFn(TCGv_i64, TCGv_i64, int64_t shift);
+typedef void WideShiftFn(TCGv_i64, TCGv_ptr, TCGv_i64, TCGv_i32);
 
 /**
  * arm_tbflags_from_tb:
diff --git a/target/arm/t32.decode b/target/arm/t32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/t32.decode
+++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@
 &mcrr            !extern cp opc1 crm rt rt2
 
 &mve_shl_ri      rdalo rdahi shim
+&mve_shl_rr      rdalo rdahi rm
 
 # rdahi: bits [3:1] from insn, bit 0 is 1
 # rdalo: bits [3:1] from insn, bit 0 is 0
@@ -XXX,XX +XXX,XX @@
 
 @mve_shl_ri      ....... .... . ... . . ... ... . .. .. .... \
                  &mve_shl_ri shim=%imm5_12_6 rdalo=%rdalo_17 rdahi=%rdahi_9
+@mve_shl_rr      ....... .... . ... . rm:4  ... . .. .. .... \
+                 &mve_shl_rr rdalo=%rdalo_17 rdahi=%rdahi_9
 
 {
   TST_xrri       1110101 0000 1 .... 0 ... 1111 .... ....     @S_xrr_shi
@@ -XXX,XX +XXX,XX @@ BIC_rrri         1110101 0001 . .... 0 ... .... .... ....     @s_rrr_shi
     URSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 01 1111  @mve_shl_ri
     SRSHRL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 10 1111  @mve_shl_ri
     SQSHLL_ri    1110101 0010 1 ... 1 0 ... ... 1 .. 11 1111  @mve_shl_ri
+
+    LSLL_rr      1110101 0010 1 ... 0 ....  ... 1  0000 1101  @mve_shl_rr
+    ASRL_rr      1110101 0010 1 ... 0 ....  ... 1  0010 1101  @mve_shl_rr
+    UQRSHLL64_rr 1110101 0010 1 ... 1 ....  ... 1  0000 1101  @mve_shl_rr
+    SQRSHRL64_rr 1110101 0010 1 ... 1 ....  ... 1  0010 1101  @mve_shl_rr
+    UQRSHLL48_rr 1110101 0010 1 ... 1 ....  ... 1  1000 1101  @mve_shl_rr
+    SQRSHRL48_rr 1110101 0010 1 ... 1 ....  ... 1  1010 1101  @mve_shl_rr
   ]
 
   MOV_rxri       1110101 0010 . 1111 0 ... .... .... ....     @s_rxr_shi
   ORR_rrri       1110101 0010 . .... 0 ... .... .... ....     @s_rrr_shi
+
+  # v8.1M CSEL and friends
+  CSEL           1110101 0010 1 rn:4 10 op:2 rd:4 fcond:4 rm:4
 }
 {
   MVN_rxri       1110101 0011 . 1111 0 ... .... .... ....     @s_rxr_shi
@@ -XXX,XX +XXX,XX @@ SBC_rrri         1110101 1011 . .... 0 ... .... .... ....     @s_rrr_shi
 }
 RSB_rrri         1110101 1110 . .... 0 ... .... .... ....     @s_rrr_shi
 
-# v8.1M CSEL and friends
-CSEL             1110101 0010 1 rn:4 10 op:2 rd:4 fcond:4 rm:4
-
 # Data-processing (register-shifted register)
 
 MOV_rxrr         1111 1010 0 shty:2 s:1 rm:4 1111 rd:4 0000 rs:4 \
diff --git a/target/arm/mve_helper.c b/target/arm/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/mve_helper.c
+++ b/target/arm/mve_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mve_vshlc)(CPUARMState *env, void *vd, uint32_t rdm,
     return rdm;
 }
 
+uint64_t HELPER(mve_sshrl)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_sqrshl_d(n, -(int8_t)shift, false, NULL);
+}
+
+uint64_t HELPER(mve_ushll)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_uqrshl_d(n, (int8_t)shift, false, NULL);
+}
+
 uint64_t HELPER(mve_sqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
 {
     return do_sqrshl_d(n, (int8_t)shift, false, &env->QF);
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(mve_uqshll)(CPUARMState *env, uint64_t n, uint32_t shift)
 {
     return do_uqrshl_d(n, (int8_t)shift, false, &env->QF);
 }
+
+uint64_t HELPER(mve_sqrshrl)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_sqrshl_d(n, -(int8_t)shift, true, &env->QF);
+}
+
+uint64_t HELPER(mve_uqrshll)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_uqrshl_d(n, (int8_t)shift, true, &env->QF);
+}
+
+/* Operate on 64-bit values, but saturate at 48 bits */
+static inline int64_t do_sqrshl48_d(int64_t src, int64_t shift,
+                                    bool round, uint32_t *sat)
+{
+    if (shift <= -48) {
+        /* Rounding the sign bit always produces 0. */
+        if (round) {
+            return 0;
+        }
+        return src >> 63;
+    } else if (shift < 0) {
+        if (round) {
+            src >>= -shift - 1;
+            return (src >> 1) + (src & 1);
+        }
+        return src >> -shift;
+    } else if (shift < 48) {
+        int64_t val = src << shift;
+        int64_t extval = sextract64(val, 0, 48);
+        if (!sat || val == extval) {
+            return extval;
+        }
+    } else if (!sat || src == 0) {
+        return 0;
+    }
+
+    *sat = 1;
+    return (1ULL << 47) - (src >= 0);
+}
+
+/* Operate on 64-bit values, but saturate at 48 bits */
+static inline uint64_t do_uqrshl48_d(uint64_t src, int64_t shift,
+                                     bool round, uint32_t *sat)
+{
+    uint64_t val, extval;
+
+    if (shift <= -(48 + round)) {
+        return 0;
+    } else if (shift < 0) {
+        if (round) {
+            val = src >> (-shift - 1);
+            val = (val >> 1) + (val & 1);
+        } else {
+            val = src >> -shift;
+        }
+        extval = extract64(val, 0, 48);
+        if (!sat || val == extval) {
+            return extval;
+        }
+    } else if (shift < 48) {
+        uint64_t val = src << shift;
+        uint64_t extval = extract64(val, 0, 48);
+        if (!sat || val == extval) {
+            return extval;
+        }
+    } else if (!sat || src == 0) {
+        return 0;
+    }
+
+    *sat = 1;
+    return MAKE_64BIT_MASK(0, 48);
+}
+
+uint64_t HELPER(mve_sqrshrl48)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_sqrshl48_d(n, -(int8_t)shift, true, &env->QF);
+}
+
+uint64_t HELPER(mve_uqrshll48)(CPUARMState *env, uint64_t n, uint32_t shift)
+{
+    return do_uqrshl48_d(n, (int8_t)shift, true, &env->QF);
+}
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_URSHRL_ri(DisasContext *s, arg_mve_shl_ri *a)
     return do_mve_shl_ri(s, a, gen_urshr64_i64);
 }
 
+static bool do_mve_shl_rr(DisasContext *s, arg_mve_shl_rr *a, WideShiftFn *fn)
+{
+    TCGv_i64 rda;
+    TCGv_i32 rdalo, rdahi;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_V8_1M)) {
+        /* Decode falls through to ORR/MOV UNPREDICTABLE handling */
+        return false;
+    }
+    if (a->rdahi == 15) {
+        /* These are a different encoding (SQSHL/SRSHR/UQSHL/URSHR) */
+        return false;
+    }
+    if (!dc_isar_feature(aa32_mve, s) ||
+        !arm_dc_feature(s, ARM_FEATURE_M_MAIN) ||
+        a->rdahi == 13 || a->rm == 13 || a->rm == 15 ||
+        a->rm == a->rdahi || a->rm == a->rdalo) {
+        /* These rdahi/rdalo/rm cases are UNPREDICTABLE; we choose to UNDEF */
+        unallocated_encoding(s);
+        return true;
+    }
+
+    rda = tcg_temp_new_i64();
+    rdalo = load_reg(s, a->rdalo);
+    rdahi = load_reg(s, a->rdahi);
+    tcg_gen_concat_i32_i64(rda, rdalo, rdahi);
+
+    /* The helper takes care of the sign-extension of the low 8 bits of Rm */
+    fn(rda, cpu_env, rda, cpu_R[a->rm]);
+
+    tcg_gen_extrl_i64_i32(rdalo, rda);
+    tcg_gen_extrh_i64_i32(rdahi, rda);
+    store_reg(s, a->rdalo, rdalo);
+    store_reg(s, a->rdahi, rdahi);
+    tcg_temp_free_i64(rda);
+
+    return true;
+}
+
+static bool trans_LSLL_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_ushll);
+}
+
+static bool trans_ASRL_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_sshrl);
+}
+
+static bool trans_UQRSHLL64_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_uqrshll);
+}
+
+static bool trans_SQRSHRL64_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_sqrshrl);
+}
+
+static bool trans_UQRSHLL48_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_uqrshll48);
+}
+
+static bool trans_SQRSHRL48_rr(DisasContext *s, arg_mve_shl_rr *a)
+{
+    return do_mve_shl_rr(s, a, gen_helper_mve_sqrshrl48);
+}
+
 /*
  * Multiply and multiply accumulate
  */
-- 
2.20.1

Implement the MVE shifts by immediate, which perform shifts
on a single general-purpose register.

These patterns overlap with the long-shift-by-immediates,
so we have to rearrange the grouping a little here.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-18-peter.maydell@linaro.org
---
 target/arm/helper-mve.h |  3 ++
 target/arm/translate.h  |  1 +
 target/arm/t32.decode   | 31 ++++++++++++++-----
 target/arm/mve_helper.c | 10 ++++++
 target/arm/translate.c  | 68 +++++++++++++++++++++++++++++++++++++++--
 5 files changed, 104 insertions(+), 9 deletions(-)

Implement the MVE shifts by register, which perform
shifts on a single general-purpose register.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210628135835.6690-19-peter.maydell@linaro.org
---
 target/arm/helper-mve.h |  2 ++
 target/arm/translate.h  |  1 +
 target/arm/t32.decode   | 18 ++++++++++++++----
 target/arm/mve_helper.c | 10 ++++++++++
 target/arm/translate.c  | 30 ++++++++++++++++++++++++++++++
 5 files changed, 57 insertions(+), 4 deletions(-)