Series comparison

-[Qemu-devel] [PULL 00/24] target-arm queue
+[PULL 00/72] target-arm queue
-target-arm queue: Eric's SMMUv3 patchset, and an array
+First arm pullreq of the cycle; this is mostly my softfloat NaN
-of minor bugfixes and improvements from various others.
+handling series. (Lots more in my to-review queue, but I don't
 like pullreqs growing too close to a hundred patches at a time :-))
 thanks
 -- PMM
-The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:
+The following changes since commit 97f2796a3736ed37a1b85dc1c76a6c45b829dd17:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)
+  Open 10.0 development tree (2024-12-10 17:41:17 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241211
-for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:
+for you to fetch changes up to 1abe28d519239eea5cf9620bb13149423e5665f8:
-  hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)
+  MAINTAINERS: Add correct email address for Vikram Garhwal (2024-12-11 15:31:09 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board
+ * hw/net/lan9118: Extract PHY model, reuse with imx_fec, fix bugs
-   if the commandline includes "-machine iommu=smmuv3"
+ * fpu: Make muladd NaN handling runtime-selected, not compile-time
- * target/arm: Implement v8M VLLDM and VLSTM
+ * fpu: Make default NaN pattern runtime-selected, not compile-time
- * hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+ * fpu: Minor NaN-related cleanups
- * Some fixes to silence Coverity false-positives
+ * MAINTAINERS: email address updates
  * arm: boot: set boot_info starting from first_cpu
    (fixes a technical bug not visible in practice)
  * hw/net/smc91c111: Convert away from old_mmio
  * hw/usb/tusb6010: Convert away from old_mmio
  * hw/char/cmsdk-apb-uart.c: Accept more input after character read
  * target/arm: Make MPUIR write-ignored on OMAP, StrongARM
  * hw/arm/virt: Add linux,pci-domain property
 ----------------------------------------------------------------
-Eric Auger (11):
+Bernhard Beschow (5):
-      hw/arm/smmu-common: smmu base device and datatypes
+      hw/net/lan9118: Extract lan9118_phy
-      hw/arm/smmu-common: IOMMU memory region and address space setup
+      hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
-      hw/arm/smmu-common: VMSAv8-64 page table walk
+      hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
-      hw/arm/smmuv3: Wired IRQ and GERROR helpers
+      hw/net/lan9118_phy: Reuse MII constants
-      hw/arm/smmuv3: Queue helpers
+      hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement
       hw/arm/smmuv3: Implement MMIO write operations
       hw/arm/smmuv3: Event queue recording helper
       hw/arm/smmuv3: Implement translate callback
       hw/arm/smmuv3: Abort on vfio or vhost case
       target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
       hw/arm/virt: Introduce the iommu option
-Igor Mammedov (1):
+Leif Lindholm (1):
-      arm: boot: set boot_info starting from first_cpu
+      MAINTAINERS: update email address for Leif Lindholm
-Jan Kiszka (1):
+Peter Maydell (54):
-      hw/arm/virt: Add linux,pci-domain property
+      fpu: handle raising Invalid for infzero in pick_nan_muladd
       fpu: Check for default_nan_mode before calling pickNaNMulAdd
       softfloat: Allow runtime choice of inf * 0 + NaN result
       tests/fp: Explicitly set inf-zero-nan rule
       target/arm: Set FloatInfZeroNaNRule explicitly
       target/s390: Set FloatInfZeroNaNRule explicitly
       target/ppc: Set FloatInfZeroNaNRule explicitly
       target/mips: Set FloatInfZeroNaNRule explicitly
       target/sparc: Set FloatInfZeroNaNRule explicitly
       target/xtensa: Set FloatInfZeroNaNRule explicitly
       target/x86: Set FloatInfZeroNaNRule explicitly
       target/loongarch: Set FloatInfZeroNaNRule explicitly
       target/hppa: Set FloatInfZeroNaNRule explicitly
       softfloat: Pass have_snan to pickNaNMulAdd
       softfloat: Allow runtime choice of NaN propagation for muladd
       tests/fp: Explicitly set 3-NaN propagation rule
       target/arm: Set Float3NaNPropRule explicitly
       target/loongarch: Set Float3NaNPropRule explicitly
       target/ppc: Set Float3NaNPropRule explicitly
       target/s390x: Set Float3NaNPropRule explicitly
       target/sparc: Set Float3NaNPropRule explicitly
       target/mips: Set Float3NaNPropRule explicitly
       target/xtensa: Set Float3NaNPropRule explicitly
       target/i386: Set Float3NaNPropRule explicitly
       target/hppa: Set Float3NaNPropRule explicitly
       fpu: Remove use_first_nan field from float_status
       target/m68k: Don't pass NULL float_status to floatx80_default_nan()
       softfloat: Create floatx80 default NaN from parts64_default_nan
       target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
       target/m68k: In frem helper, initialize local float_status from env->fp_status
       target/m68k: Init local float_status from env fp_status in gdb get/set reg
       target/sparc: Initialize local scratch float_status from env->fp_status
       target/ppc: Use env->fp_status in helper_compute_fprf functions
       fpu: Allow runtime choice of default NaN value
       tests/fp: Set default NaN pattern explicitly
       target/microblaze: Set default NaN pattern explicitly
       target/i386: Set default NaN pattern explicitly
       target/hppa: Set default NaN pattern explicitly
       target/alpha: Set default NaN pattern explicitly
       target/arm: Set default NaN pattern explicitly
       target/loongarch: Set default NaN pattern explicitly
       target/m68k: Set default NaN pattern explicitly
       target/mips: Set default NaN pattern explicitly
       target/openrisc: Set default NaN pattern explicitly
       target/ppc: Set default NaN pattern explicitly
       target/sh4: Set default NaN pattern explicitly
       target/rx: Set default NaN pattern explicitly
       target/s390x: Set default NaN pattern explicitly
       target/sparc: Set default NaN pattern explicitly
       target/xtensa: Set default NaN pattern explicitly
       target/hexagon: Set default NaN pattern explicitly
       target/riscv: Set default NaN pattern explicitly
       target/tricore: Set default NaN pattern explicitly
       fpu: Remove default handling for dnan_pattern
-Mathew Maidment (1):
+Richard Henderson (11):
-      target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case
+      target/arm: Copy entire float_status in is_ebf
       softfloat: Inline pickNaNMulAdd
       softfloat: Use goto for default nan case in pick_nan_muladd
       softfloat: Remove which from parts_pick_nan_muladd
       softfloat: Pad array size in pick_nan_muladd
       softfloat: Move propagateFloatx80NaN to softfloat.c
       softfloat: Use parts_pick_nan in propagateFloatx80NaN
       softfloat: Inline pickNaN
       softfloat: Share code between parts_pick_nan cases
       softfloat: Sink frac_cmp in parts_pick_nan until needed
       softfloat: Replace WHICH with RET in parts_pick_nan
-Patrick Oppenlander (1):
+Vikram Garhwal (1):
-      hw/char/cmsdk-apb-uart.c: Accept more input after character read
+      MAINTAINERS: Add correct email address for Vikram Garhwal
-Peter Maydell (3):
+ MAINTAINERS                       |   4 +-
-      hw/usb/tusb6010: Convert away from old_mmio
+ include/fpu/softfloat-helpers.h   |  38 +++-
-      hw/net/smc91c111: Convert away from old_mmio
+ include/fpu/softfloat-types.h     |  89 +++++++-
-      target/arm: Implement v8M VLLDM and VLSTM
+ include/hw/net/imx_fec.h          |   9 +-
+ include/hw/net/lan9118_phy.h      |  37 ++++
-Prem Mallappa (3):
+ include/hw/net/mii.h              |   6 +
-      hw/arm/smmuv3: Skeleton
+ target/mips/fpu_helper.h          |  20 ++
-      hw/arm/virt: Add SMMUv3 to the virt board
+ target/sparc/helper.h             |   4 +-
-      hw/arm/virt-acpi-build: Add smmuv3 node in IORT table
+ fpu/softfloat.c                   |  19 ++
+ hw/net/imx_fec.c                  | 146 ++------------
-Richard Henderson (2):
+ hw/net/lan9118.c                  | 137 ++-----------
-      target/arm: Tidy conditions in handle_vec_simd_shri
+ hw/net/lan9118_phy.c              | 222 ++++++++++++++++++++
-      target/arm: Tidy condition in disas_simd_two_reg_misc
+ linux-user/arm/nwfpe/fpa11.c      |   5 +
+ target/alpha/cpu.c                |   2 +
-Thomas Huth (1):
+ target/arm/cpu.c                  |  10 +
-      hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+ target/arm/tcg/vec_helper.c       |  20 +-
+ target/hexagon/cpu.c              |   2 +
- hw/arm/Makefile.objs                |    1 +
+ target/hppa/fpu_helper.c          |  12 ++
- hw/arm/smmu-internal.h              |   99 +++
+ target/i386/tcg/fpu_helper.c      |  12 ++
- hw/arm/smmuv3-internal.h            |  621 ++++++++++++++++++
+ target/loongarch/tcg/fpu_helper.c |  14 +-
- include/hw/acpi/acpi-defs.h         |   15 +
+ target/m68k/cpu.c                 |  14 +-
- include/hw/arm/smmu-common.h        |  145 +++++
+ target/m68k/fpu_helper.c          |   6 +-
- include/hw/arm/smmuv3.h             |   87 +++
+ target/m68k/helper.c              |   6 +-
- include/hw/arm/virt.h               |   10 +
+ target/microblaze/cpu.c           |   2 +
- hw/arm/boot.c                       |    2 +-
+ target/mips/msa.c                 |  10 +
- hw/arm/omap1.c                      |    8 +-
+ target/openrisc/cpu.c             |   2 +
- hw/arm/omap2.c                      |    8 +-
+ target/ppc/cpu_init.c             |  19 ++
- hw/arm/pxa2xx.c                     |   15 +-
+ target/ppc/fpu_helper.c           |   3 +-
- hw/arm/smmu-common.c                |  372 +++++++++++
+ target/riscv/cpu.c                |   2 +
- hw/arm/smmuv3.c                     | 1191 +++++++++++++++++++++++++++++++++++
+ target/rx/cpu.c                   |   2 +
- hw/arm/virt-acpi-build.c            |   55 +-
+ target/s390x/cpu.c                |   5 +
- hw/arm/virt.c                       |  101 ++-
+ target/sh4/cpu.c                  |   2 +
- hw/char/cmsdk-apb-uart.c            |    1 +
+ target/sparc/cpu.c                |   6 +
- hw/net/smc91c111.c                  |   54 +-
+ target/sparc/fop_helper.c         |   8 +-
- hw/usb/tusb6010.c                   |   40 +-
+ target/sparc/translate.c          |   4 +-
- target/arm/helper.c                 |    2 +-
+ target/tricore/helper.c           |   2 +
- target/arm/kvm.c                    |   38 +-
+ target/xtensa/cpu.c               |   4 +
- target/arm/translate-a64.c          |   12 +-
+ target/xtensa/fpu_helper.c        |   3 +-
- target/arm/translate.c              |   17 +-
+ tests/fp/fp-bench.c               |   7 +
- default-configs/aarch64-softmmu.mak |    1 +
+ tests/fp/fp-test-log2.c           |   1 +
- hw/arm/trace-events                 |   37 ++
+ tests/fp/fp-test.c                |   7 +
- target/arm/trace-events             |    3 +
+ fpu/softfloat-parts.c.inc         | 152 +++++++++++---
-files changed, 2868 insertions(+), 67 deletions(-)
+ fpu/softfloat-specialize.c.inc    | 412 ++------------------------------------
- create mode 100644 hw/arm/smmu-internal.h
+ .mailmap                          |   5 +-
- create mode 100644 hw/arm/smmuv3-internal.h
+ hw/net/Kconfig                    |   5 +
- create mode 100644 include/hw/arm/smmu-common.h
+ hw/net/meson.build                |   1 +
- create mode 100644 include/hw/arm/smmuv3.h
+ hw/net/trace-events               |  10 +-
- create mode 100644 hw/arm/smmu-common.c
+files changed, 778 insertions(+), 730 deletions(-)
- create mode 100644 hw/arm/smmuv3.c
+ create mode 100644 include/hw/net/lan9118_phy.h
+ create mode 100644 hw/net/lan9118_phy.c

-[Qemu-devel] [PULL 14/24] hw/arm/smmuv3: Skeleton
+[PULL 01/72] hw/net/lan9118: Extract lan9118_phy
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+From: Bernhard Beschow <shentey@gmail.com>
-This patch implements a skeleton for the smmuv3 device.
+A very similar implementation of the same device exists in imx_fec. Prepare for
-Datatypes and register definitions are introduced. The MMIO
+a common implementation by extracting a device model into its own files.
 region, the interrupts and the queue are initialized.
-Only the MMIO read operation is implemented here.
+Some migration state has been moved into the new device model which breaks
 migration compatibility for the following machines:
 * smdkc210
 * realview-*
 * vexpress-*
 * kzm
 * mps2-*
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+While breaking migration ABI, fix the size of the MII registers to be 16 bit,
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+as defined by IEEE 802.3u.
 Signed-off-by: Bernhard Beschow <shentey@gmail.com>
 Tested-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-5-git-send-email-eric.auger@redhat.com
+Message-id: 20241102125724.532843-2-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs     |   2 +-
+ include/hw/net/lan9118_phy.h |  37 ++++++++
- hw/arm/smmuv3-internal.h | 142 +++++++++++++++
+ hw/net/lan9118.c             | 137 +++++-----------------------
- include/hw/arm/smmuv3.h  |  87 ++++++++++
+ hw/net/lan9118_phy.c         | 169 +++++++++++++++++++++++++++++++++++
- hw/arm/smmuv3.c          | 366 +++++++++++++++++++++++++++++++++++++++
+ hw/net/Kconfig               |   4 +
- hw/arm/trace-events      |   3 +
+ hw/net/meson.build           |   1 +
-files changed, 599 insertions(+), 1 deletion(-)
+files changed, 233 insertions(+), 115 deletions(-)
- create mode 100644 hw/arm/smmuv3-internal.h
+ create mode 100644 include/hw/net/lan9118_phy.h
- create mode 100644 include/hw/arm/smmuv3.h
+ create mode 100644 hw/net/lan9118_phy.c
  create mode 100644 hw/arm/smmuv3.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/include/hw/net/lan9118_phy.h b/include/hw/net/lan9118_phy.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Makefile.objs
 +++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
  obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
  obj-$(CONFIG_IOTKIT) += iotkit.o
  obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
 -obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
 +obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/arm/smmuv3-internal.h
++++ b/include/hw/net/lan9118_phy.h
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ARM SMMUv3 support - Internal API
++ * SMSC LAN9118 PHY emulation
 + *
-+ * Copyright (C) 2014-2016 Broadcom Corporation
++ * Copyright (c) 2009 CodeSourcery, LLC.
-+ * Copyright (c) 2017 Red Hat, Inc.
++ * Written by Paul Brook
 + * Written by Prem Mallappa, Eric Auger
 + *
-+ * This program is free software; you can redistribute it and/or modify
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * it under the terms of the GNU General Public License version 2 as
++ * See the COPYING file in the top-level directory.
 + * published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
-+#ifndef HW_ARM_SMMU_V3_INTERNAL_H
++#ifndef HW_NET_LAN9118_PHY_H
-+#define HW_ARM_SMMU_V3_INTERNAL_H
++#define HW_NET_LAN9118_PHY_H
 +
-+#include "hw/arm/smmu-common.h"
++#include "qom/object.h"
-+
++#include "hw/sysbus.h"
-+/* MMIO Registers */
++
-+
++#define TYPE_LAN9118_PHY "lan9118-phy"
-+REG32(IDR0,                0x0)
++OBJECT_DECLARE_SIMPLE_TYPE(Lan9118PhyState, LAN9118_PHY)
-+    FIELD(IDR0, S1P,         1 , 1)
++
-+    FIELD(IDR0, TTF,         2 , 2)
++typedef struct Lan9118PhyState {
-+    FIELD(IDR0, COHACC,      4 , 1)
++    SysBusDevice parent_obj;
-+    FIELD(IDR0, ASID16,      12, 1)
++
-+    FIELD(IDR0, TTENDIAN,    21, 2)
++    uint16_t status;
-+    FIELD(IDR0, STALL_MODEL, 24, 2)
++    uint16_t control;
-+    FIELD(IDR0, TERM_MODEL,  26, 1)
++    uint16_t advertise;
-+    FIELD(IDR0, STLEVEL,     27, 2)
++    uint16_t ints;
-+
++    uint16_t int_mask;
-+REG32(IDR1,                0x4)
++    qemu_irq irq;
-+    FIELD(IDR1, SIDSIZE,      0 , 6)
++    bool link_down;
-+    FIELD(IDR1, EVENTQS,      16, 5)
++} Lan9118PhyState;
-+    FIELD(IDR1, CMDQS,        21, 5)
++
-+
++void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down);
-+#define SMMU_IDR1_SIDSIZE 16
++void lan9118_phy_reset(Lan9118PhyState *s);
-+#define SMMU_CMDQS   19
++uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg);
-+#define SMMU_EVENTQS 19
++void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val);
 +
 +REG32(IDR2,                0x8)
 +REG32(IDR3,                0xc)
 +REG32(IDR4,                0x10)
 +REG32(IDR5,                0x14)
 +     FIELD(IDR5, OAS,         0, 3);
 +     FIELD(IDR5, GRAN4K,      4, 1);
 +     FIELD(IDR5, GRAN16K,     5, 1);
 +     FIELD(IDR5, GRAN64K,     6, 1);
 +
 +#define SMMU_IDR5_OAS 4
 +
 +REG32(IIDR,                0x1c)
 +REG32(CR0,                 0x20)
 +    FIELD(CR0, SMMU_ENABLE,   0, 1)
 +    FIELD(CR0, EVENTQEN,      2, 1)
 +    FIELD(CR0, CMDQEN,        3, 1)
 +
 +REG32(CR0ACK,              0x24)
 +REG32(CR1,                 0x28)
 +REG32(CR2,                 0x2c)
 +REG32(STATUSR,             0x40)
 +REG32(IRQ_CTRL,            0x50)
 +    FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
 +    FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
 +    FIELD(IRQ_CTRL, EVENTQ_IRQEN,        2, 1)
 +
 +REG32(IRQ_CTRL_ACK,        0x54)
 +REG32(GERROR,              0x60)
 +    FIELD(GERROR, CMDQ_ERR,           0, 1)
 +    FIELD(GERROR, EVENTQ_ABT_ERR,     2, 1)
 +    FIELD(GERROR, PRIQ_ABT_ERR,       3, 1)
 +    FIELD(GERROR, MSI_CMDQ_ABT_ERR,   4, 1)
 +    FIELD(GERROR, MSI_EVENTQ_ABT_ERR, 5, 1)
 +    FIELD(GERROR, MSI_PRIQ_ABT_ERR,   6, 1)
 +    FIELD(GERROR, MSI_GERROR_ABT_ERR, 7, 1)
 +    FIELD(GERROR, MSI_SFM_ERR,        8, 1)
 +
 +REG32(GERRORN,             0x64)
 +
 +#define A_GERROR_IRQ_CFG0  0x68 /* 64b */
 +REG32(GERROR_IRQ_CFG1, 0x70)
 +REG32(GERROR_IRQ_CFG2, 0x74)
 +
 +#define A_STRTAB_BASE      0x80 /* 64b */
 +
 +#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
 +
 +REG32(STRTAB_BASE_CFG,     0x88)
 +    FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
 +    FIELD(STRTAB_BASE_CFG, SPLIT,    6 , 5)
 +    FIELD(STRTAB_BASE_CFG, LOG2SIZE, 0 , 6)
 +
 +#define A_CMDQ_BASE        0x90 /* 64b */
 +REG32(CMDQ_PROD,           0x98)
 +REG32(CMDQ_CONS,           0x9c)
 +    FIELD(CMDQ_CONS, ERR, 24, 7)
 +
 +#define A_EVENTQ_BASE      0xa0 /* 64b */
 +REG32(EVENTQ_PROD,         0xa8)
 +REG32(EVENTQ_CONS,         0xac)
 +
 +#define A_EVENTQ_IRQ_CFG0  0xb0 /* 64b */
 +REG32(EVENTQ_IRQ_CFG1,     0xb8)
 +REG32(EVENTQ_IRQ_CFG2,     0xbc)
 +
 +#define A_IDREGS           0xfd0
 +
 +static inline int smmu_enabled(SMMUv3State *s)
 +{
 +    return FIELD_EX32(s->cr[0], CR0, SMMU_ENABLE);
 +}
 +
 +/* Command Queue Entry */
 +typedef struct Cmd {
 +    uint32_t word[4];
 +} Cmd;
 +
 +/* Event Queue Entry */
 +typedef struct Evt  {
 +    uint32_t word[8];
 +} Evt;
 +
 +static inline uint32_t smmuv3_idreg(int regoffset)
 +{
 +    /*
 +     * Return the value of the Primecell/Corelink ID registers at the
 +     * specified offset from the first ID register.
 +     * These value indicate an ARM implementation of MMU600 p1
 +     */
 +    static const uint8_t smmuv3_ids[] = {
 +        0x04, 0, 0, 0, 0x84, 0xB4, 0xF0, 0x10, 0x0D, 0xF0, 0x05, 0xB1
 +    };
 +    return smmuv3_ids[regoffset / 4];
 +}
 +
 +#endif
-diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
+diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/lan9118.c
 +++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "net/eth.h"
  #include "hw/irq.h"
 +#include "hw/net/lan9118_phy.h"
  #include "hw/net/lan9118.h"
  #include "hw/ptimer.h"
  #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
  #define MAC_CR_RXEN     0x00000004
  #define MAC_CR_RESERVED 0x7f404213
 -#define PHY_INT_ENERGYON            0x80
 -#define PHY_INT_AUTONEG_COMPLETE    0x40
 -#define PHY_INT_FAULT               0x20
 -#define PHY_INT_DOWN                0x10
 -#define PHY_INT_AUTONEG_LP          0x08
 -#define PHY_INT_PARFAULT            0x04
 -#define PHY_INT_AUTONEG_PAGE        0x02
 -
  #define GPT_TIMER_EN    0x20000000
  /*
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
      uint32_t mac_mii_data;
      uint32_t mac_flow;
 -    uint32_t phy_status;
 -    uint32_t phy_control;
 -    uint32_t phy_advertise;
 -    uint32_t phy_int;
 -    uint32_t phy_int_mask;
 +    Lan9118PhyState mii;
 +    IRQState mii_irq;
      int32_t eeprom_writable;
      uint8_t eeprom[128];
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
  static const VMStateDescription vmstate_lan9118 = {
      .name = "lan9118",
 -    .version_id = 2,
 -    .minimum_version_id = 1,
 +    .version_id = 3,
 +    .minimum_version_id = 3,
      .fields = (const VMStateField[]) {
          VMSTATE_PTIMER(timer, lan9118_state),
          VMSTATE_UINT32(irq_cfg, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118 = {
          VMSTATE_UINT32(mac_mii_acc, lan9118_state),
          VMSTATE_UINT32(mac_mii_data, lan9118_state),
          VMSTATE_UINT32(mac_flow, lan9118_state),
 -        VMSTATE_UINT32(phy_status, lan9118_state),
 -        VMSTATE_UINT32(phy_control, lan9118_state),
 -        VMSTATE_UINT32(phy_advertise, lan9118_state),
 -        VMSTATE_UINT32(phy_int, lan9118_state),
 -        VMSTATE_UINT32(phy_int_mask, lan9118_state),
          VMSTATE_INT32(eeprom_writable, lan9118_state),
          VMSTATE_UINT8_ARRAY(eeprom, lan9118_state, 128),
          VMSTATE_INT32(tx_fifo_size, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static void lan9118_reload_eeprom(lan9118_state *s)
      lan9118_mac_changed(s);
  }
 -static void phy_update_irq(lan9118_state *s)
 +static void lan9118_update_irq(void *opaque, int n, int level)
  {
 -    if (s->phy_int & s->phy_int_mask) {
 +    lan9118_state *s = opaque;
 +
 +    if (level) {
          s->int_sts |= PHY_INT;
      } else {
          s->int_sts &= ~PHY_INT;
@@ -XXX,XX +XXX,XX @@ static void phy_update_irq(lan9118_state *s)
      lan9118_update(s);
  }
 -static void phy_update_link(lan9118_state *s)
 -{
 -    /* Autonegotiation status mirrors link status.  */
 -    if (qemu_get_queue(s->nic)->link_down) {
 -        s->phy_status &= ~0x0024;
 -        s->phy_int |= PHY_INT_DOWN;
 -    } else {
 -        s->phy_status |= 0x0024;
 -        s->phy_int |= PHY_INT_ENERGYON;
 -        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
 -    }
 -    phy_update_irq(s);
 -}
 -
  static void lan9118_set_link(NetClientState *nc)
  {
 -    phy_update_link(qemu_get_nic_opaque(nc));
 -}
 -
 -static void phy_reset(lan9118_state *s)
 -{
 -    s->phy_status = 0x7809;
 -    s->phy_control = 0x3000;
 -    s->phy_advertise = 0x01e1;
 -    s->phy_int_mask = 0;
 -    s->phy_int = 0;
 -    phy_update_link(s);
 +    lan9118_phy_update_link(&LAN9118(qemu_get_nic_opaque(nc))->mii,
 +                            nc->link_down);
  }
  static void lan9118_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
      s->read_word_n = 0;
      s->write_word_n = 0;
 -    phy_reset(s);
 -
      s->eeprom_writable = 0;
      lan9118_reload_eeprom(s);
  }
@@ -XXX,XX +XXX,XX @@ static void do_tx_packet(lan9118_state *s)
      uint32_t status;
      /* FIXME: Honor TX disable, and allow queueing of packets.  */
 -    if (s->phy_control & 0x4000)  {
 +    if (s->mii.control & 0x4000) {
          /* This assumes the receive routine doesn't touch the VLANClient.  */
          qemu_receive_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
      } else {
@@ -XXX,XX +XXX,XX @@ static void tx_fifo_push(lan9118_state *s, uint32_t val)
      }
  }
 -static uint32_t do_phy_read(lan9118_state *s, int reg)
 -{
 -    uint32_t val;
 -
 -    switch (reg) {
 -    case 0: /* Basic Control */
 -        return s->phy_control;
 -    case 1: /* Basic Status */
 -        return s->phy_status;
 -    case 2: /* ID1 */
 -        return 0x0007;
 -    case 3: /* ID2 */
 -        return 0xc0d1;
 -    case 4: /* Auto-neg advertisement */
 -        return s->phy_advertise;
 -    case 5: /* Auto-neg Link Partner Ability */
 -        return 0x0f71;
 -    case 6: /* Auto-neg Expansion */
 -        return 1;
 -        /* TODO 17, 18, 27, 29, 30, 31 */
 -    case 29: /* Interrupt source.  */
 -        val = s->phy_int;
 -        s->phy_int = 0;
 -        phy_update_irq(s);
 -        return val;
 -    case 30: /* Interrupt mask */
 -        return s->phy_int_mask;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "do_phy_read: PHY read reg %d\n", reg);
 -        return 0;
 -    }
 -}
 -
 -static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
 -{
 -    switch (reg) {
 -    case 0: /* Basic Control */
 -        if (val & 0x8000) {
 -            phy_reset(s);
 -            break;
 -        }
 -        s->phy_control = val & 0x7980;
 -        /* Complete autonegotiation immediately.  */
 -        if (val & 0x1000) {
 -            s->phy_status |= 0x0020;
 -        }
 -        break;
 -    case 4: /* Auto-neg advertisement */
 -        s->phy_advertise = (val & 0x2d7f) | 0x80;
 -        break;
 -        /* TODO 17, 18, 27, 31 */
 -    case 30: /* Interrupt mask */
 -        s->phy_int_mask = val & 0xff;
 -        phy_update_irq(s);
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 -    }
 -}
 -
  static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
  {
      switch (reg) {
@@ -XXX,XX +XXX,XX @@ static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
          if (val & 2) {
              DPRINTF("PHY write %d = 0x%04x\n",
                      (val >> 6) & 0x1f, s->mac_mii_data);
 -            do_phy_write(s, (val >> 6) & 0x1f, s->mac_mii_data);
 +            lan9118_phy_write(&s->mii, (val >> 6) & 0x1f, s->mac_mii_data);
          } else {
 -            s->mac_mii_data = do_phy_read(s, (val >> 6) & 0x1f);
 +            s->mac_mii_data = lan9118_phy_read(&s->mii, (val >> 6) & 0x1f);
              DPRINTF("PHY read %d = 0x%04x\n",
                      (val >> 6) & 0x1f, s->mac_mii_data);
          }
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
          break;
      case CSR_PMT_CTRL:
          if (val & 0x400) {
 -            phy_reset(s);
 +            lan9118_phy_reset(&s->mii);
          }
          s->pmt_ctrl &= ~0x34e;
          s->pmt_ctrl |= (val & 0x34e);
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
      const MemoryRegionOps *mem_ops =
              s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 +    qemu_init_irq(&s->mii_irq, lan9118_update_irq, s, 0);
 +    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
 +    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
 +
      memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                            "lan9118-mmio", 0x100);
      sysbus_init_mmio(sbd, &s->mmio);
 diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/hw/arm/smmuv3.h
++++ b/hw/net/lan9118_phy.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * Copyright (C) 2014-2016 Broadcom Corporation
++ * SMSC LAN9118 PHY emulation
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Written by Prem Mallappa, Eric Auger
 + *
-+ * This program is free software; you can redistribute it and/or modify
++ * Copyright (c) 2009 CodeSourcery, LLC.
-+ * it under the terms of the GNU General Public License version 2 as
++ * Written by Paul Brook
 + * published by the Free Software Foundation.
 + *
-+ * This program is distributed in the hope that it will be useful,
++ * This code is licensed under the GNU GPL v2
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
-+ * You should have received a copy of the GNU General Public License along
++ * Contributions after 2012-01-13 are licensed under the terms of the
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
++ * GNU GPL, version 2 or (at your option) any later version.
 + */
 +
-+#ifndef HW_ARM_SMMUV3_H
-+#define HW_ARM_SMMUV3_H
-+
-+#include "hw/arm/smmu-common.h"
-+#include "hw/registerfields.h"
-+
-+#define TYPE_SMMUV3_IOMMU_MEMORY_REGION "smmuv3-iommu-memory-region"
-+
-+typedef struct SMMUQueue {
-+     uint64_t base; /* base register */
-+     uint32_t prod;
-+     uint32_t cons;
-+     uint8_t entry_size;
-+     uint8_t log2size;
-+} SMMUQueue;
-+
-+typedef struct SMMUv3State {
-+    SMMUState     smmu_state;
-+
-+    uint32_t features;
-+    uint8_t sid_size;
-+    uint8_t sid_split;
-+
-+    uint32_t idr[6];
-+    uint32_t iidr;
-+    uint32_t cr[3];
-+    uint32_t cr0ack;
-+    uint32_t statusr;
-+    uint32_t irq_ctrl;
-+    uint32_t gerror;
-+    uint32_t gerrorn;
-+    uint64_t gerror_irq_cfg0;
-+    uint32_t gerror_irq_cfg1;
-+    uint32_t gerror_irq_cfg2;
-+    uint64_t strtab_base;
-+    uint32_t strtab_base_cfg;
-+    uint64_t eventq_irq_cfg0;
-+    uint32_t eventq_irq_cfg1;
-+    uint32_t eventq_irq_cfg2;
-+
-+    SMMUQueue eventq, cmdq;
-+
-+    qemu_irq     irq[4];
-+} SMMUv3State;
-+
-+typedef enum {
-+    SMMU_IRQ_EVTQ,
-+    SMMU_IRQ_PRIQ,
-+    SMMU_IRQ_CMD_SYNC,
-+    SMMU_IRQ_GERROR,
-+} SMMUIrq;
-+
-+typedef struct {
-+    /*< private >*/
-+    SMMUBaseClass smmu_base_class;
-+    /*< public >*/
-+
-+    DeviceRealize parent_realize;
-+    DeviceReset   parent_reset;
-+} SMMUv3Class;
-+
-+#define TYPE_ARM_SMMUV3   "arm-smmuv3"
-+#define ARM_SMMUV3(obj) OBJECT_CHECK(SMMUv3State, (obj), TYPE_ARM_SMMUV3)
-+#define ARM_SMMUV3_CLASS(klass)                              \
-+    OBJECT_CLASS_CHECK(SMMUv3Class, (klass), TYPE_ARM_SMMUV3)
-+#define ARM_SMMUV3_GET_CLASS(obj) \
-+     OBJECT_GET_CLASS(SMMUv3Class, (obj), TYPE_ARM_SMMUV3)
-+
-+#endif
-diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * Copyright (C) 2014-2016 Broadcom Corporation
-+ * Copyright (c) 2017 Red Hat, Inc.
-+ * Written by Prem Mallappa, Eric Auger
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License version 2 as
-+ * published by the Free Software Foundation.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program; if not, see <http://www.gnu.org/licenses/>.
-+ */
-+
 +#include "qemu/osdep.h"
-+#include "hw/boards.h"
++#include "hw/net/lan9118_phy.h"
-+#include "sysemu/sysemu.h"
++#include "hw/irq.h"
-+#include "hw/sysbus.h"
++#include "hw/resettable.h"
-+#include "hw/qdev-core.h"
++#include "migration/vmstate.h"
 +#include "hw/pci/pci.h"
 +#include "exec/address-spaces.h"
 +#include "trace.h"
 +#include "qemu/log.h"
-+#include "qemu/error-report.h"
++
-+#include "qapi/error.h"
++#define PHY_INT_ENERGYON            (1 << 7)
-+
++#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-+#include "hw/arm/smmuv3.h"
++#define PHY_INT_FAULT               (1 << 5)
-+#include "smmuv3-internal.h"
++#define PHY_INT_DOWN                (1 << 4)
-+
++#define PHY_INT_AUTONEG_LP          (1 << 3)
-+static void smmuv3_init_regs(SMMUv3State *s)
++#define PHY_INT_PARFAULT            (1 << 2)
-+{
++#define PHY_INT_AUTONEG_PAGE        (1 << 1)
-+    /**
++
-+     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
++static void lan9118_phy_update_irq(Lan9118PhyState *s)
-+     *       multi-level stream table
++{
-+     */
++    qemu_set_irq(s->irq, !!(s->ints & s->int_mask));
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
++}
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
++
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
++uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
++{
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
++    uint16_t val;
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
++
-+    /* terminated transaction will always be aborted/error returned */
++    switch (reg) {
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
++    case 0: /* Basic Control */
-+    /* 2-level stream table supported */
++        return s->control;
-+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
++    case 1: /* Basic Status */
-+
++        return s->status;
-+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
++    case 2: /* ID1 */
-+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
++        return 0x0007;
-+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
++    case 3: /* ID2 */
-+
++        return 0xc0d1;
-+   /* 4K and 64K granule support */
++    case 4: /* Auto-neg advertisement */
-+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
++        return s->advertise;
-+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
++    case 5: /* Auto-neg Link Partner Ability */
-+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
++        return 0x0f71;
-+
++    case 6: /* Auto-neg Expansion */
-+    s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
++        return 1;
-+    s->cmdq.prod = 0;
++        /* TODO 17, 18, 27, 29, 30, 31 */
-+    s->cmdq.cons = 0;
++    case 29: /* Interrupt source. */
-+    s->cmdq.entry_size = sizeof(struct Cmd);
++        val = s->ints;
-+    s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
++        s->ints = 0;
-+    s->eventq.prod = 0;
++        lan9118_phy_update_irq(s);
-+    s->eventq.cons = 0;
++        return val;
-+    s->eventq.entry_size = sizeof(struct Evt);
++    case 30: /* Interrupt mask */
-+
++        return s->int_mask;
 +    s->features = 0;
 +    s->sid_split = 0;
 +}
 +
 +static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
 +                                   unsigned size, MemTxAttrs attrs)
 +{
 +    /* not yet implemented */
 +    return MEMTX_ERROR;
 +}
 +
 +static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
 +                               uint64_t *data, MemTxAttrs attrs)
 +{
 +    switch (offset) {
 +    case A_GERROR_IRQ_CFG0:
 +        *data = s->gerror_irq_cfg0;
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE:
 +        *data = s->strtab_base;
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE:
 +        *data = s->cmdq.base;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE:
 +        *data = s->eventq.base;
 +        return MEMTX_OK;
 +    default:
-+        *data = 0;
++        qemu_log_mask(LOG_GUEST_ERROR,
-+        qemu_log_mask(LOG_UNIMP,
++                      "lan9118_phy_read: PHY read reg %d\n", reg);
-+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
++        return 0;
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
-+static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
++void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
-+                              uint64_t *data, MemTxAttrs attrs)
++{
-+{
++    switch (reg) {
-+    switch (offset) {
++    case 0: /* Basic Control */
-+    case A_IDREGS ... A_IDREGS + 0x1f:
++        if (val & 0x8000) {
-+        *data = smmuv3_idreg(offset - A_IDREGS);
++            lan9118_phy_reset(s);
-+        return MEMTX_OK;
++            break;
-+    case A_IDR0 ... A_IDR5:
++        }
-+        *data = s->idr[(offset - A_IDR0) / 4];
++        s->control = val & 0x7980;
-+        return MEMTX_OK;
++        /* Complete autonegotiation immediately. */
-+    case A_IIDR:
++        if (val & 0x1000) {
-+        *data = s->iidr;
++            s->status |= 0x0020;
-+        return MEMTX_OK;
++        }
 +    case A_CR0:
 +        *data = s->cr[0];
 +        return MEMTX_OK;
 +    case A_CR0ACK:
 +        *data = s->cr0ack;
 +        return MEMTX_OK;
 +    case A_CR1:
 +        *data = s->cr[1];
 +        return MEMTX_OK;
 +    case A_CR2:
 +        *data = s->cr[2];
 +        return MEMTX_OK;
 +    case A_STATUSR:
 +        *data = s->statusr;
 +        return MEMTX_OK;
 +    case A_IRQ_CTRL:
 +    case A_IRQ_CTRL_ACK:
 +        *data = s->irq_ctrl;
 +        return MEMTX_OK;
 +    case A_GERROR:
 +        *data = s->gerror;
 +        return MEMTX_OK;
 +    case A_GERRORN:
 +        *data = s->gerrorn;
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0: /* 64b */
 +        *data = extract64(s->gerror_irq_cfg0, 0, 32);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG0 + 4:
 +        *data = extract64(s->gerror_irq_cfg0, 32, 32);
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG1:
 +        *data = s->gerror_irq_cfg1;
 +        return MEMTX_OK;
 +    case A_GERROR_IRQ_CFG2:
 +        *data = s->gerror_irq_cfg2;
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE: /* 64b */
 +        *data = extract64(s->strtab_base, 0, 32);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE + 4: /* 64b */
 +        *data = extract64(s->strtab_base, 32, 32);
 +        return MEMTX_OK;
 +    case A_STRTAB_BASE_CFG:
 +        *data = s->strtab_base_cfg;
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE: /* 64b */
 +        *data = extract64(s->cmdq.base, 0, 32);
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE + 4:
 +        *data = extract64(s->cmdq.base, 32, 32);
 +        return MEMTX_OK;
 +    case A_CMDQ_PROD:
 +        *data = s->cmdq.prod;
 +        return MEMTX_OK;
 +    case A_CMDQ_CONS:
 +        *data = s->cmdq.cons;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE: /* 64b */
 +        *data = extract64(s->eventq.base, 0, 32);
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE + 4: /* 64b */
 +        *data = extract64(s->eventq.base, 32, 32);
 +        return MEMTX_OK;
 +    case A_EVENTQ_PROD:
 +        *data = s->eventq.prod;
 +        return MEMTX_OK;
 +    case A_EVENTQ_CONS:
 +        *data = s->eventq.cons;
 +        return MEMTX_OK;
 +    default:
 +        *data = 0;
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
 +static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
 +                                  unsigned size, MemTxAttrs attrs)
 +{
 +    SMMUState *sys = opaque;
 +    SMMUv3State *s = ARM_SMMUV3(sys);
 +    MemTxResult r;
 +
 +    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
 +    offset &= ~0x10000;
 +
 +    switch (size) {
 +    case 8:
 +        r = smmu_readll(s, offset, data, attrs);
 +        break;
-+    case 4:
++    case 4: /* Auto-neg advertisement */
-+        r = smmu_readl(s, offset, data, attrs);
++        s->advertise = (val & 0x2d7f) | 0x80;
 +        break;
 +        /* TODO 17, 18, 27, 31 */
 +    case 30: /* Interrupt mask */
 +        s->int_mask = val & 0xff;
 +        lan9118_phy_update_irq(s);
 +        break;
 +    default:
-+        r = MEMTX_ERROR;
++        qemu_log_mask(LOG_GUEST_ERROR,
-+        break;
++                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 +    }
-+
++}
-+    trace_smmuv3_read_mmio(offset, *data, size, r);
++
-+    return r;
++void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
-+}
++{
-+
++    s->link_down = link_down;
-+static const MemoryRegionOps smmu_mem_ops = {
++
-+    .read_with_attrs = smmu_read_mmio,
++    /* Autonegotiation status mirrors link status. */
-+    .write_with_attrs = smmu_write_mmio,
++    if (link_down) {
-+    .endianness = DEVICE_LITTLE_ENDIAN,
++        s->status &= ~0x0024;
-+    .valid = {
++        s->ints |= PHY_INT_DOWN;
-+        .min_access_size = 4,
++    } else {
-+        .max_access_size = 8,
++        s->status |= 0x0024;
-+    },
++        s->ints |= PHY_INT_ENERGYON;
-+    .impl = {
++        s->ints |= PHY_INT_AUTONEG_COMPLETE;
 +        .min_access_size = 4,
 +        .max_access_size = 8,
 +    },
 +};
 +
 +static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
 +{
 +    int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
 +        sysbus_init_irq(dev, &s->irq[i]);
 +    }
-+}
++    lan9118_phy_update_irq(s);
-+
++}
-+static void smmu_reset(DeviceState *dev)
++
-+{
++void lan9118_phy_reset(Lan9118PhyState *s)
-+    SMMUv3State *s = ARM_SMMUV3(dev);
++{
-+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
++    s->control = 0x3000;
-+
++    s->status = 0x7809;
-+    c->parent_reset(dev);
++    s->advertise = 0x01e1;
-+
++    s->int_mask = 0;
-+    smmuv3_init_regs(s);
++    s->ints = 0;
-+}
++    lan9118_phy_update_link(s, s->link_down);
-+
++}
-+static void smmu_realize(DeviceState *d, Error **errp)
++
-+{
++static void lan9118_phy_reset_hold(Object *obj, ResetType type)
-+    SMMUState *sys = ARM_SMMU(d);
++{
-+    SMMUv3State *s = ARM_SMMUV3(sys);
++    Lan9118PhyState *s = LAN9118_PHY(obj);
-+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
++
-+    SysBusDevice *dev = SYS_BUS_DEVICE(d);
++    lan9118_phy_reset(s);
-+    Error *local_err = NULL;
++}
 +
-+    c->parent_realize(d, &local_err);
++static void lan9118_phy_init(Object *obj)
-+    if (local_err) {
++{
-+        error_propagate(errp, local_err);
++    Lan9118PhyState *s = LAN9118_PHY(obj);
-+        return;
++
-+    }
++    qdev_init_gpio_out(DEVICE(s), &s->irq, 1);
-+
++}
-+    memory_region_init_io(&sys->iomem, OBJECT(s),
++
-+                          &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
++static const VMStateDescription vmstate_lan9118_phy = {
-+
++    .name = "lan9118-phy",
 +    sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
 +
 +    sysbus_init_mmio(dev, &sys->iomem);
 +
 +    smmu_init_irq(s, dev);
 +}
 +
 +static const VMStateDescription vmstate_smmuv3_queue = {
 +    .name = "smmuv3_queue",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
++    .fields = (const VMStateField[]) {
-+        VMSTATE_UINT64(base, SMMUQueue),
++        VMSTATE_UINT16(control, Lan9118PhyState),
-+        VMSTATE_UINT32(prod, SMMUQueue),
++        VMSTATE_UINT16(status, Lan9118PhyState),
-+        VMSTATE_UINT32(cons, SMMUQueue),
++        VMSTATE_UINT16(advertise, Lan9118PhyState),
-+        VMSTATE_UINT8(log2size, SMMUQueue),
++        VMSTATE_UINT16(ints, Lan9118PhyState),
-+    },
++        VMSTATE_UINT16(int_mask, Lan9118PhyState),
 +        VMSTATE_BOOL(link_down, Lan9118PhyState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+static const VMStateDescription vmstate_smmuv3 = {
++static void lan9118_phy_class_init(ObjectClass *klass, void *data)
-+    .name = "smmuv3",
++{
-+    .version_id = 1,
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
-+    .minimum_version_id = 1,
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+    .fields = (VMStateField[]) {
++
-+        VMSTATE_UINT32(features, SMMUv3State),
++    rc->phases.hold = lan9118_phy_reset_hold;
-+        VMSTATE_UINT8(sid_size, SMMUv3State),
++    dc->vmsd = &vmstate_lan9118_phy;
-+        VMSTATE_UINT8(sid_split, SMMUv3State),
++}
 +
-+        VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
++static const TypeInfo types[] = {
-+        VMSTATE_UINT32(cr0ack, SMMUv3State),
++    {
-+        VMSTATE_UINT32(statusr, SMMUv3State),
++        .name          = TYPE_LAN9118_PHY,
-+        VMSTATE_UINT32(irq_ctrl, SMMUv3State),
++        .parent        = TYPE_SYS_BUS_DEVICE,
-+        VMSTATE_UINT32(gerror, SMMUv3State),
++        .instance_size = sizeof(Lan9118PhyState),
-+        VMSTATE_UINT32(gerrorn, SMMUv3State),
++        .instance_init = lan9118_phy_init,
-+        VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
++        .class_init    = lan9118_phy_class_init,
-+        VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
++    }
 +        VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
 +        VMSTATE_UINT64(strtab_base, SMMUv3State),
 +        VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
 +        VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
 +        VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
 +        VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
 +
 +        VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
 +        VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
 +
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
-+static void smmuv3_instance_init(Object *obj)
++DEFINE_TYPES(types)
-+{
+diff --git a/hw/net/Kconfig b/hw/net/Kconfig
 +    /* Nothing much to do here as of now */
 +}
 +
 +static void smmuv3_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_smmuv3;
 +    device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
 +    c->parent_realize = dc->realize;
 +    dc->realize = smmu_realize;
 +}
 +
 +static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
 +                                                  void *data)
 +{
 +}
 +
 +static const TypeInfo smmuv3_type_info = {
 +    .name          = TYPE_ARM_SMMUV3,
 +    .parent        = TYPE_ARM_SMMU,
 +    .instance_size = sizeof(SMMUv3State),
 +    .instance_init = smmuv3_instance_init,
 +    .class_size    = sizeof(SMMUv3Class),
 +    .class_init    = smmuv3_class_init,
 +};
 +
 +static const TypeInfo smmuv3_iommu_memory_region_info = {
 +    .parent = TYPE_IOMMU_MEMORY_REGION,
 +    .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
 +    .class_init = smmuv3_iommu_memory_region_class_init,
 +};
 +
 +static void smmuv3_register_types(void)
 +{
 +    type_register(&smmuv3_type_info);
 +    type_register(&smmuv3_iommu_memory_region_info);
 +}
 +
 +type_init(smmuv3_register_types)
 +
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/trace-events
+--- a/hw/net/Kconfig
-+++ b/hw/arm/trace-events
++++ b/hw/net/Kconfig
-@@ -XXX,XX +XXX,XX @@ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr,
+@@ -XXX,XX +XXX,XX @@ config VMXNET3_PCI
- smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
+ config SMC91C111
- smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
+     bool
- smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
-+
++config LAN9118_PHY
-+#hw/arm/smmuv3.c
++    bool
-+smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
++
  config LAN9118
      bool
 +    select LAN9118_PHY
      select PTIMER
  config NE2000_ISA
 diff --git a/hw/net/meson.build b/hw/net/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/meson.build
 +++ b/hw/net/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VMXNET3_PCI', if_true: files('vmxnet3.c'))
  system_ss.add(when: 'CONFIG_SMC91C111', if_true: files('smc91c111.c'))
  system_ss.add(when: 'CONFIG_LAN9118', if_true: files('lan9118.c'))
 +system_ss.add(when: 'CONFIG_LAN9118_PHY', if_true: files('lan9118_phy.c'))
  system_ss.add(when: 'CONFIG_NE2000_ISA', if_true: files('ne2000-isa.c'))
  system_ss.add(when: 'CONFIG_OPENCORES_ETH', if_true: files('opencores_eth.c'))
  system_ss.add(when: 'CONFIG_XGMAC', if_true: files('xgmac.c'))
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 11/24] hw/arm/smmu-common: smmu base device and datatypes
+[PULL 02/72] hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
-From: Eric Auger <eric.auger@redhat.com>
+From: Bernhard Beschow <shentey@gmail.com>
-The patch introduces the smmu base device and class for the ARM
+imx_fec models the same PHY as lan9118_phy. The code is almost the same with
-smmu. Devices for specific versions will be derived from this
+imx_fec having more logging and tracing. Merge these improvements into
-base device.
+lan9118_phy and reuse in imx_fec to fix the code duplication.
-We also introduce some important datatypes.
+Some migration state how resides in the new device model which breaks migration
 compatibility for the following machines:
 * imx25-pdk
 * sabrelite
 * mcimx7d-sabre
 * mcimx6ul-evk
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-2-git-send-email-eric.auger@redhat.com
+Message-id: 20241102125724.532843-3-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Makefile.objs                |   1 +
+ include/hw/net/imx_fec.h |   9 ++-
- include/hw/arm/smmu-common.h        | 123 ++++++++++++++++++++++++++++
+ hw/net/imx_fec.c         | 146 ++++-----------------------------------
- hw/arm/smmu-common.c                |  81 ++++++++++++++++++
+ hw/net/lan9118_phy.c     |  82 ++++++++++++++++------
- default-configs/aarch64-softmmu.mak |   1 +
+ hw/net/Kconfig           |   1 +
-files changed, 206 insertions(+)
+ hw/net/trace-events      |  10 +--
- create mode 100644 include/hw/arm/smmu-common.h
+files changed, 85 insertions(+), 163 deletions(-)
  create mode 100644 hw/arm/smmu-common.c
-diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
+diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Makefile.objs
+--- a/include/hw/net/imx_fec.h
-+++ b/hw/arm/Makefile.objs
++++ b/include/hw/net/imx_fec.h
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IMXFECState, IMX_FEC)
- obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
+ #define TYPE_IMX_ENET "imx.enet"
- obj-$(CONFIG_IOTKIT) += iotkit.o
- obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
+ #include "hw/sysbus.h"
-+obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
++#include "hw/net/lan9118_phy.h"
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
++#include "hw/irq.h"
-new file mode 100644
+ #include "net/net.h"
-index XXXXXXX..XXXXXXX
---- /dev/null
+ #define ENET_EIR               1
-+++ b/include/hw/arm/smmu-common.h
+@@ -XXX,XX +XXX,XX @@ struct IMXFECState {
-@@ -XXX,XX +XXX,XX @@
+     uint32_t tx_descriptor[ENET_TX_RING_NUM];
-+/*
+     uint32_t tx_ring_num;
-+ * ARM SMMU Support
-+ *
+-    uint32_t phy_status;
-+ * Copyright (C) 2015-2016 Broadcom Corporation
+-    uint32_t phy_control;
-+ * Copyright (c) 2017 Red Hat, Inc.
+-    uint32_t phy_advertise;
-+ * Written by Prem Mallappa, Eric Auger
+-    uint32_t phy_int;
-+ *
+-    uint32_t phy_int_mask;
-+ * This program is free software; you can redistribute it and/or modify
++    Lan9118PhyState mii;
-+ * it under the terms of the GNU General Public License version 2 as
++    IRQState mii_irq;
-+ * published by the Free Software Foundation.
+     uint32_t phy_num;
-+ *
+     bool phy_connected;
-+ * This program is distributed in the hope that it will be useful,
+     struct IMXFECState *phy_consumer;
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+index XXXXXXX..XXXXXXX 100644
-+ * GNU General Public License for more details.
+--- a/hw/net/imx_fec.c
-+ *
++++ b/hw/net/imx_fec.c
-+ */
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth_txdescs = {
-+
-+#ifndef HW_ARM_SMMU_COMMON_H
+ static const VMStateDescription vmstate_imx_eth = {
-+#define HW_ARM_SMMU_COMMON_H
+     .name = TYPE_IMX_FEC,
-+
+-    .version_id = 2,
-+#include "hw/sysbus.h"
+-    .minimum_version_id = 2,
-+#include "hw/pci/pci.h"
++    .version_id = 3,
-+
++    .minimum_version_id = 3,
-+#define SMMU_PCI_BUS_MAX      256
+     .fields = (const VMStateField[]) {
-+#define SMMU_PCI_DEVFN_MAX    256
+         VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
-+
+         VMSTATE_UINT32(rx_descriptor, IMXFECState),
-+#define SMMU_MAX_VA_BITS      48
+         VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
-+
+-        VMSTATE_UINT32(phy_status, IMXFECState),
-+/*
+-        VMSTATE_UINT32(phy_control, IMXFECState),
-+ * Page table walk error types
+-        VMSTATE_UINT32(phy_advertise, IMXFECState),
-+ */
+-        VMSTATE_UINT32(phy_int, IMXFECState),
-+typedef enum {
+-        VMSTATE_UINT32(phy_int_mask, IMXFECState),
-+    SMMU_PTW_ERR_NONE,
+         VMSTATE_END_OF_LIST()
-+    SMMU_PTW_ERR_WALK_EABT,   /* Translation walk external abort */
+     },
-+    SMMU_PTW_ERR_TRANSLATION, /* Translation fault */
+     .subsections = (const VMStateDescription * const []) {
-+    SMMU_PTW_ERR_ADDR_SIZE,   /* Address Size fault */
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
-+    SMMU_PTW_ERR_ACCESS,      /* Access fault */
+     },
-+    SMMU_PTW_ERR_PERMISSION,  /* Permission fault */
+ };
-+} SMMUPTWEventType;
-+
+-#define PHY_INT_ENERGYON            (1 << 7)
-+typedef struct SMMUPTWEventInfo {
+-#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-+    SMMUPTWEventType type;
+-#define PHY_INT_FAULT               (1 << 5)
-+    dma_addr_t addr; /* fetched address that induced an abort, if any */
+-#define PHY_INT_DOWN                (1 << 4)
-+} SMMUPTWEventInfo;
+-#define PHY_INT_AUTONEG_LP          (1 << 3)
-+
+-#define PHY_INT_PARFAULT            (1 << 2)
-+typedef struct SMMUTransTableInfo {
+-#define PHY_INT_AUTONEG_PAGE        (1 << 1)
-+    bool disabled;             /* is the translation table disabled? */
+-
-+    uint64_t ttb;              /* TT base address */
+ static void imx_eth_update(IMXFECState *s);
-+    uint8_t tsz;               /* input range, ie. 2^(64 -tsz)*/
-+    uint8_t granule_sz;        /* granule page shift */
+ /*
-+} SMMUTransTableInfo;
+@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s);
-+
+  * For now we don't handle any GPIO/interrupt line, so the OS will
-+/*
+  * have to poll for the PHY status.
-+ * Generic structure populated by derived SMMU devices
+  */
-+ * after decoding the configuration information and used as
+-static void imx_phy_update_irq(IMXFECState *s)
-+ * input to the page table walk
++static void imx_phy_update_irq(void *opaque, int n, int level)
-+ */
+ {
-+typedef struct SMMUTransCfg {
+-    imx_eth_update(s);
-+    int stage;                 /* translation stage */
+-}
-+    bool aa64;                 /* arch64 or aarch32 translation table */
+-
-+    bool disabled;             /* smmu is disabled */
+-static void imx_phy_update_link(IMXFECState *s)
-+    bool bypassed;             /* translation is bypassed */
+-{
-+    bool aborted;              /* translation is aborted */
+-    /* Autonegotiation status mirrors link status.  */
-+    uint64_t ttb;              /* TT base address */
+-    if (qemu_get_queue(s->nic)->link_down) {
-+    uint8_t oas;               /* output address width */
+-        trace_imx_phy_update_link("down");
-+    uint8_t tbi;               /* Top Byte Ignore */
+-        s->phy_status &= ~0x0024;
-+    uint16_t asid;
+-        s->phy_int |= PHY_INT_DOWN;
-+    SMMUTransTableInfo tt[2];
+-    } else {
-+} SMMUTransCfg;
+-        trace_imx_phy_update_link("up");
-+
+-        s->phy_status |= 0x0024;
-+typedef struct SMMUDevice {
+-        s->phy_int |= PHY_INT_ENERGYON;
-+    void               *smmu;
+-        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
-+    PCIBus             *bus;
+-    }
-+    int                devfn;
+-    imx_phy_update_irq(s);
-+    IOMMUMemoryRegion  iommu;
++    imx_eth_update(opaque);
-+    AddressSpace       as;
+ }
-+} SMMUDevice;
-+
+ static void imx_eth_set_link(NetClientState *nc)
-+typedef struct SMMUNotifierNode {
+ {
-+    SMMUDevice *sdev;
+-    imx_phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
-+    QLIST_ENTRY(SMMUNotifierNode) next;
+-}
-+} SMMUNotifierNode;
+-
-+
+-static void imx_phy_reset(IMXFECState *s)
-+typedef struct SMMUPciBus {
+-{
-+    PCIBus       *bus;
+-    trace_imx_phy_reset();
-+    SMMUDevice   *pbdev[0]; /* Parent array is sparse, so dynamically alloc */
+-
-+} SMMUPciBus;
+-    s->phy_status = 0x7809;
-+
+-    s->phy_control = 0x3000;
-+typedef struct SMMUState {
+-    s->phy_advertise = 0x01e1;
-+    /* <private> */
+-    s->phy_int_mask = 0;
-+    SysBusDevice  dev;
+-    s->phy_int = 0;
-+    const char *mrtypename;
+-    imx_phy_update_link(s);
-+    MemoryRegion iomem;
++    lan9118_phy_update_link(&IMX_FEC(qemu_get_nic_opaque(nc))->mii,
-+
++                            nc->link_down);
-+    GHashTable *smmu_pcibus_by_busptr;
+ }
-+    GHashTable *configs; /* cache for configuration data */
-+    GHashTable *iotlb;
+ static uint32_t imx_phy_read(IMXFECState *s, int reg)
-+    SMMUPciBus *smmu_pcibus_by_bus_num[SMMU_PCI_BUS_MAX];
+ {
-+    PCIBus *pci_bus;
+-    uint32_t val;
-+    QLIST_HEAD(, SMMUNotifierNode) notifiers_list;
+     uint32_t phy = reg / 32;
-+    uint8_t bus_num;
-+    PCIBus *primary_bus;
+     if (!s->phy_connected) {
-+} SMMUState;
+@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
-+
-+typedef struct {
+     reg %= 32;
-+    /* <private> */
-+    SysBusDeviceClass parent_class;
+-    switch (reg) {
-+
+-    case 0:     /* Basic Control */
-+    /*< public >*/
+-        val = s->phy_control;
-+
+-        break;
-+    DeviceRealize parent_realize;
+-    case 1:     /* Basic Status */
-+
+-        val = s->phy_status;
-+} SMMUBaseClass;
+-        break;
-+
+-    case 2:     /* ID1 */
-+#define TYPE_ARM_SMMU "arm-smmu"
+-        val = 0x0007;
-+#define ARM_SMMU(obj) OBJECT_CHECK(SMMUState, (obj), TYPE_ARM_SMMU)
+-        break;
-+#define ARM_SMMU_CLASS(klass)                                    \
+-    case 3:     /* ID2 */
-+    OBJECT_CLASS_CHECK(SMMUBaseClass, (klass), TYPE_ARM_SMMU)
+-        val = 0xc0d1;
-+#define ARM_SMMU_GET_CLASS(obj)                              \
+-        break;
-+    OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
+-    case 4:     /* Auto-neg advertisement */
-+
+-        val = s->phy_advertise;
-+#endif  /* HW_ARM_SMMU_COMMON */
+-        break;
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
+-    case 5:     /* Auto-neg Link Partner Ability */
-new file mode 100644
+-        val = 0x0f71;
-index XXXXXXX..XXXXXXX
+-        break;
---- /dev/null
+-    case 6:     /* Auto-neg Expansion */
-+++ b/hw/arm/smmu-common.c
+-        val = 1;
-@@ -XXX,XX +XXX,XX @@
+-        break;
-+/*
+-    case 29:    /* Interrupt source.  */
-+ * Copyright (C) 2014-2016 Broadcom Corporation
+-        val = s->phy_int;
-+ * Copyright (c) 2017 Red Hat, Inc.
+-        s->phy_int = 0;
-+ * Written by Prem Mallappa, Eric Auger
+-        imx_phy_update_irq(s);
-+ *
+-        break;
-+ * This program is free software; you can redistribute it and/or modify
+-    case 30:    /* Interrupt mask */
-+ * it under the terms of the GNU General Public License version 2 as
+-        val = s->phy_int_mask;
-+ * published by the Free Software Foundation.
+-        break;
-+ *
+-    case 17:
-+ * This program is distributed in the hope that it will be useful,
+-    case 18:
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+-    case 27:
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+-    case 31:
-+ * GNU General Public License for more details.
+-        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
-+ *
+-                      TYPE_IMX_FEC, __func__, reg);
-+ * Author: Prem Mallappa <pmallapp@broadcom.com>
+-        val = 0;
-+ *
+-        break;
-+ */
+-    default:
-+
+-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
-+#include "qemu/osdep.h"
+-                      TYPE_IMX_FEC, __func__, reg);
-+#include "sysemu/sysemu.h"
+-        val = 0;
-+#include "exec/address-spaces.h"
+-        break;
-+#include "trace.h"
+-    }
-+#include "exec/target_page.h"
+-
-+#include "qom/cpu.h"
+-    trace_imx_phy_read(val, phy, reg);
-+#include "hw/qdev-properties.h"
+-
-+#include "qapi/error.h"
+-    return val;
-+
++    return lan9118_phy_read(&s->mii, reg);
-+#include "qemu/error-report.h"
+ }
-+#include "hw/arm/smmu-common.h"
-+
+ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
-+static void smmu_base_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
-+{
-+    SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
+     reg %= 32;
-+    Error *local_err = NULL;
-+
+-    trace_imx_phy_write(val, phy, reg);
-+    sbc->parent_realize(dev, &local_err);
+-
-+    if (local_err) {
+-    switch (reg) {
-+        error_propagate(errp, local_err);
+-    case 0:     /* Basic Control */
 -        if (val & 0x8000) {
 -            imx_phy_reset(s);
 -        } else {
 -            s->phy_control = val & 0x7980;
 -            /* Complete autonegotiation immediately.  */
 -            if (val & 0x1000) {
 -                s->phy_status |= 0x0020;
 -            }
 -        }
 -        break;
 -    case 4:     /* Auto-neg advertisement */
 -        s->phy_advertise = (val & 0x2d7f) | 0x80;
 -        break;
 -    case 30:    /* Interrupt mask */
 -        s->phy_int_mask = val & 0xff;
 -        imx_phy_update_irq(s);
 -        break;
 -    case 17:
 -    case 18:
 -    case 27:
 -    case 31:
 -        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        break;
 -    }
 +    lan9118_phy_write(&s->mii, reg, val);
  }
  static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
      s->rx_descriptor = 0;
      memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
 -
 -    /* We also reset the PHY */
 -    imx_phy_reset(s);
  }
  static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
      sysbus_init_irq(sbd, &s->irq[0]);
      sysbus_init_irq(sbd, &s->irq[1]);
 +    qemu_init_irq(&s->mii_irq, imx_phy_update_irq, s, 0);
 +    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
 +    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
 +        return;
 +    }
-+}
++    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
 +
-+static void smmu_base_reset(DeviceState *dev)
+     qemu_macaddr_default_if_unset(&s->conf.macaddr);
-+{
-+    /* will be filled later on */
+     s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
-+}
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 +
 +static Property smmu_dev_properties[] = {
 +    DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
 +    DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus, "PCI", PCIBus *),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void smmu_base_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    SMMUBaseClass *sbc = ARM_SMMU_CLASS(klass);
 +
 +    dc->props = smmu_dev_properties;
 +    device_class_set_parent_realize(dc, smmu_base_realize,
 +                                    &sbc->parent_realize);
 +    dc->reset = smmu_base_reset;
 +}
 +
 +static const TypeInfo smmu_base_info = {
 +    .name          = TYPE_ARM_SMMU,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(SMMUState),
 +    .class_data    = NULL,
 +    .class_size    = sizeof(SMMUBaseClass),
 +    .class_init    = smmu_base_class_init,
 +    .abstract      = true,
 +};
 +
 +static void smmu_base_register_types(void)
 +{
 +    type_register_static(&smmu_base_info);
 +}
 +
 +type_init(smmu_base_register_types)
 +
 diff --git a/default-configs/aarch64-softmmu.mak b/default-configs/aarch64-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
---- a/default-configs/aarch64-softmmu.mak
+--- a/hw/net/lan9118_phy.c
-+++ b/default-configs/aarch64-softmmu.mak
++++ b/hw/net/lan9118_phy.c
-@@ -XXX,XX +XXX,XX @@ CONFIG_DDC=y
+@@ -XXX,XX +XXX,XX @@
- CONFIG_DPCD=y
+  * Copyright (c) 2009 CodeSourcery, LLC.
- CONFIG_XLNX_ZYNQMP=y
+  * Written by Paul Brook
- CONFIG_XLNX_ZYNQMP_ARM=y
+  *
-+CONFIG_ARM_SMMUV3=y
++ * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
 + *
   * This code is licensed under the GNU GPL v2
   *
   * Contributions after 2012-01-13 are licensed under the terms of the
@@ -XXX,XX +XXX,XX @@
  #include "hw/resettable.h"
  #include "migration/vmstate.h"
  #include "qemu/log.h"
 +#include "trace.h"
  #define PHY_INT_ENERGYON            (1 << 7)
  #define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
      switch (reg) {
      case 0: /* Basic Control */
 -        return s->control;
 +        val = s->control;
 +        break;
      case 1: /* Basic Status */
 -        return s->status;
 +        val = s->status;
 +        break;
      case 2: /* ID1 */
 -        return 0x0007;
 +        val = 0x0007;
 +        break;
      case 3: /* ID2 */
 -        return 0xc0d1;
 +        val = 0xc0d1;
 +        break;
      case 4: /* Auto-neg advertisement */
 -        return s->advertise;
 +        val = s->advertise;
 +        break;
      case 5: /* Auto-neg Link Partner Ability */
 -        return 0x0f71;
 +        val = 0x0f71;
 +        break;
      case 6: /* Auto-neg Expansion */
 -        return 1;
 -        /* TODO 17, 18, 27, 29, 30, 31 */
 +        val = 1;
 +        break;
      case 29: /* Interrupt source. */
          val = s->ints;
          s->ints = 0;
          lan9118_phy_update_irq(s);
 -        return val;
 +        break;
      case 30: /* Interrupt mask */
 -        return s->int_mask;
 +        val = s->int_mask;
 +        break;
 +    case 17:
 +    case 18:
 +    case 27:
 +    case 31:
 +        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
 +                      __func__, reg);
 +        val = 0;
 +        break;
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "lan9118_phy_read: PHY read reg %d\n", reg);
 -        return 0;
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
 +                      __func__, reg);
 +        val = 0;
 +        break;
      }
 +
 +    trace_lan9118_phy_read(val, reg);
 +
 +    return val;
  }
  void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
  {
 +    trace_lan9118_phy_write(val, reg);
 +
      switch (reg) {
      case 0: /* Basic Control */
          if (val & 0x8000) {
              lan9118_phy_reset(s);
 -            break;
 -        }
 -        s->control = val & 0x7980;
 -        /* Complete autonegotiation immediately. */
 -        if (val & 0x1000) {
 -            s->status |= 0x0020;
 +        } else {
 +            s->control = val & 0x7980;
 +            /* Complete autonegotiation immediately. */
 +            if (val & 0x1000) {
 +                s->status |= 0x0020;
 +            }
          }
          break;
      case 4: /* Auto-neg advertisement */
          s->advertise = (val & 0x2d7f) | 0x80;
          break;
 -        /* TODO 17, 18, 27, 31 */
      case 30: /* Interrupt mask */
          s->int_mask = val & 0xff;
          lan9118_phy_update_irq(s);
          break;
 +    case 17:
 +    case 18:
 +    case 27:
 +    case 31:
 +        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
 +                      __func__, reg);
 +        break;
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
 +                      __func__, reg);
 +        break;
      }
  }
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
      /* Autonegotiation status mirrors link status. */
      if (link_down) {
 +        trace_lan9118_phy_update_link("down");
          s->status &= ~0x0024;
          s->ints |= PHY_INT_DOWN;
      } else {
 +        trace_lan9118_phy_update_link("up");
          s->status |= 0x0024;
          s->ints |= PHY_INT_ENERGYON;
          s->ints |= PHY_INT_AUTONEG_COMPLETE;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
  void lan9118_phy_reset(Lan9118PhyState *s)
  {
 +    trace_lan9118_phy_reset();
 +
      s->control = 0x3000;
      s->status = 0x7809;
      s->advertise = 0x01e1;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118_phy = {
      .version_id = 1,
      .minimum_version_id = 1,
      .fields = (const VMStateField[]) {
 -        VMSTATE_UINT16(control, Lan9118PhyState),
          VMSTATE_UINT16(status, Lan9118PhyState),
 +        VMSTATE_UINT16(control, Lan9118PhyState),
          VMSTATE_UINT16(advertise, Lan9118PhyState),
          VMSTATE_UINT16(ints, Lan9118PhyState),
          VMSTATE_UINT16(int_mask, Lan9118PhyState),
 diff --git a/hw/net/Kconfig b/hw/net/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/Kconfig
 +++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_SUN8I_EMAC
  config IMX_FEC
      bool
 +    select LAN9118_PHY
  config CADENCE
      bool
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
  allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
  allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
 +# lan9118_phy.c
 +lan9118_phy_read(uint16_t val, int reg) "[0x%02x] -> 0x%04" PRIx16
 +lan9118_phy_write(uint16_t val, int reg) "[0x%02x] <- 0x%04" PRIx16
 +lan9118_phy_update_link(const char *s) "%s"
 +lan9118_phy_reset(void) ""
 +
  # lance.c
  lance_mem_readw(uint64_t addr, uint32_t ret) "addr=0x%"PRIx64"val=0x%04x"
  lance_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64"val=0x%04x"
@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"
  i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
  # imx_fec.c
 -imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
  imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
 -imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
  imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
 -imx_phy_update_link(const char *s) "%s"
 -imx_phy_reset(void) ""
  imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
  imx_enet_read_bd(uint64_t addr, int flags, int len, int data, int options, int status) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x option 0x%04x status 0x%04x"
  imx_eth_tx_bd_busy(void) "tx_bd ran out of descriptors to transmit"
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 06/24] arm: boot: set boot_info starting from first_cpu
+[PULL 03/72] hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
-From: Igor Mammedov <imammedo@redhat.com>
+From: Bernhard Beschow <shentey@gmail.com>
-Even though nothing is currently broken (since all boards
+Turns 0x70 into 0xe0 (== 0x70 << 1) which adds the missing MII_ANLPAR_TX and
-use first_cpu as boot cpu), make sure that boot_info is set
+fixes the MSB of selector field to be zero, as specified in the datasheet.
 on all CPUs.
 If some board would like support heterogenuos setup (i.e.
 init boot_info on subset of CPUs) in future, it should add
 a reasonable API to do it, instead of starting assigning
 boot_info from some CPU and till the end of present CPUs
 list.
-Ref:
+Fixes: 2a424990170b "LAN9118 emulation"
-"Message-ID: <CAFEAcA_NMWuA8WSs3cNeY6xX1kerO_uAcN_3=fK02BEhHJW86g@mail.gmail.com>"
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
 Signed-off-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1525176522-200354-5-git-send-email-imammedo@redhat.com
+Message-id: 20241102125724.532843-4-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/boot.c | 2 +-
+ hw/net/lan9118_phy.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/net/lan9118_phy.c
-+++ b/hw/arm/boot.c
++++ b/hw/net/lan9118_phy.c
-@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
+@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
-     }
+         val = s->advertise;
-     info->is_linux = is_linux;
+         break;
+     case 5: /* Auto-neg Link Partner Ability */
--    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
+-        val = 0x0f71;
-+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
++        val = 0x0fe1;
-         ARM_CPU(cs)->env.boot_info = info;
+         break;
-     }
+     case 6: /* Auto-neg Expansion */
- }
+         val = 1;
 --
-.17.0
+.34.1

-New patch
+[PULL 04/72] hw/net/lan9118_phy: Reuse MII constants
+From: Bernhard Beschow <shentey@gmail.com>
+Prefer named constants over magic values for better readability.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Message-id: 20241102125724.532843-5-shentey@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/net/mii.h |  6 +++++
+ hw/net/lan9118_phy.c | 63 ++++++++++++++++++++++++++++----------------
+files changed, 46 insertions(+), 23 deletions(-)
+diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/net/mii.h
++++ b/include/hw/net/mii.h
+@@ -XXX,XX +XXX,XX @@
+ #define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
+ #define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
++#define MII_ANAR_RFAULT     (1 << 13) /* Say we can detect faults */
+ #define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymmetric pause */
+ #define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
+ #define MII_ANAR_TXFD       (1 << 8)
+@@ -XXX,XX +XXX,XX @@
+ #define MII_ANAR_10FD       (1 << 6)
+ #define MII_ANAR_10         (1 << 5)
+ #define MII_ANAR_CSMACD     (1 << 0)
++#define MII_ANAR_SELECT     (0x001f)  /* Selector bits */
+ #define MII_ANLPAR_ACK      (1 << 14)
+ #define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
+@@ -XXX,XX +XXX,XX @@
+ #define RTL8201CP_PHYID1    0x0000
+ #define RTL8201CP_PHYID2    0x8201
++/* SMSC LAN9118 */
++#define SMSCLAN9118_PHYID1  0x0007
++#define SMSCLAN9118_PHYID2  0xc0d1
++
+ /* RealTek 8211E */
+ #define RTL8211E_PHYID1     0x001c
+ #define RTL8211E_PHYID2     0xc915
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/lan9118_phy.c
++++ b/hw/net/lan9118_phy.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
+ #include "hw/net/lan9118_phy.h"
++#include "hw/net/mii.h"
+ #include "hw/irq.h"
+ #include "hw/resettable.h"
+ #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
+     uint16_t val;
+     switch (reg) {
+-    case 0: /* Basic Control */
++    case MII_BMCR:
+         val = s->control;
+         break;
+-    case 1: /* Basic Status */
++    case MII_BMSR:
+         val = s->status;
+         break;
+-    case 2: /* ID1 */
+-        val = 0x0007;
++    case MII_PHYID1:
++        val = SMSCLAN9118_PHYID1;
+         break;
+-    case 3: /* ID2 */
+-        val = 0xc0d1;
++    case MII_PHYID2:
++        val = SMSCLAN9118_PHYID2;
+         break;
+-    case 4: /* Auto-neg advertisement */
++    case MII_ANAR:
+         val = s->advertise;
+         break;
+-    case 5: /* Auto-neg Link Partner Ability */
+-        val = 0x0fe1;
++    case MII_ANLPAR:
++        val = MII_ANLPAR_PAUSEASY | MII_ANLPAR_PAUSE | MII_ANLPAR_T4 |
++              MII_ANLPAR_TXFD | MII_ANLPAR_TX | MII_ANLPAR_10FD |
++              MII_ANLPAR_10 | MII_ANLPAR_CSMACD;
+         break;
+-    case 6: /* Auto-neg Expansion */
+-        val = 1;
++    case MII_ANER:
++        val = MII_ANER_NWAY;
+         break;
+     case 29: /* Interrupt source. */
+         val = s->ints;
+@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
+     trace_lan9118_phy_write(val, reg);
+     switch (reg) {
+-    case 0: /* Basic Control */
+-        if (val & 0x8000) {
++    case MII_BMCR:
++        if (val & MII_BMCR_RESET) {
+             lan9118_phy_reset(s);
+         } else {
+-            s->control = val & 0x7980;
++            s->control = val & (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |
++                                MII_BMCR_AUTOEN | MII_BMCR_PDOWN | MII_BMCR_FD |
++                                MII_BMCR_CTST);
+             /* Complete autonegotiation immediately. */
+-            if (val & 0x1000) {
+-                s->status |= 0x0020;
++            if (val & MII_BMCR_AUTOEN) {
++                s->status |= MII_BMSR_AN_COMP;
+             }
+         }
+         break;
+-    case 4: /* Auto-neg advertisement */
+-        s->advertise = (val & 0x2d7f) | 0x80;
++    case MII_ANAR:
++        s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
++                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
++                               MII_ANAR_SELECT))
++                     | MII_ANAR_TX;
+         break;
+     case 30: /* Interrupt mask */
+         s->int_mask = val & 0xff;
+@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
+     /* Autonegotiation status mirrors link status. */
+     if (link_down) {
+         trace_lan9118_phy_update_link("down");
+-        s->status &= ~0x0024;
++        s->status &= ~(MII_BMSR_AN_COMP | MII_BMSR_LINK_ST);
+         s->ints |= PHY_INT_DOWN;
+     } else {
+         trace_lan9118_phy_update_link("up");
+-        s->status |= 0x0024;
++        s->status |= MII_BMSR_AN_COMP | MII_BMSR_LINK_ST;
+         s->ints |= PHY_INT_ENERGYON;
+         s->ints |= PHY_INT_AUTONEG_COMPLETE;
+     }
+@@ -XXX,XX +XXX,XX @@ void lan9118_phy_reset(Lan9118PhyState *s)
+ {
+     trace_lan9118_phy_reset();
+-    s->control = 0x3000;
+-    s->status = 0x7809;
+-    s->advertise = 0x01e1;
++    s->control = MII_BMCR_AUTOEN | MII_BMCR_SPEED100;
++    s->status = MII_BMSR_100TX_FD
++                | MII_BMSR_100TX_HD
++                | MII_BMSR_10T_FD
++                | MII_BMSR_10T_HD
++                | MII_BMSR_AUTONEG
++                | MII_BMSR_EXTCAP;
++    s->advertise = MII_ANAR_TXFD
++                   | MII_ANAR_TX
++                   | MII_ANAR_10FD
++                   | MII_ANAR_10
++                   | MII_ANAR_CSMACD;
+     s->int_mask = 0;
+     s->ints = 0;
+     lan9118_phy_update_link(s, s->link_down);
+--
+.34.1

-New patch
+[PULL 05/72] hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement
+From: Bernhard Beschow <shentey@gmail.com>
+The real device advertises this mode and the device model already advertises
+mbps half duplex and 10 mbps full+half duplex. So advertise this mode to
+make the model more realistic.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Message-id: 20241102125724.532843-6-shentey@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/net/lan9118_phy.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/lan9118_phy.c
++++ b/hw/net/lan9118_phy.c
+@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
+         break;
+     case MII_ANAR:
+         s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
+-                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
+-                               MII_ANAR_SELECT))
++                               MII_ANAR_PAUSE | MII_ANAR_TXFD | MII_ANAR_10FD |
++                               MII_ANAR_10 | MII_ANAR_SELECT))
+                      | MII_ANAR_TX;
+         break;
+     case 30: /* Interrupt mask */
+--
+.34.1

-New patch
+[PULL 06/72] fpu: handle raising Invalid for infzero in pick_nan_muladd
+For IEEE fused multiply-add, the (0 * inf) + NaN case should raise
+Invalid for the multiplication of 0 by infinity.  Currently we handle
+this in the per-architecture ifdef ladder in pickNaNMulAdd().
+However, since this isn't really architecture specific we can hoist
+it up to the generic code.
+For the cases where the infzero test in pickNaNMulAdd was
+returning 2, we can delete the check entirely and allow the
+code to fall into the normal pick-a-NaN handling, because this
+will return 2 anyway (input 'c' being the only NaN in this case).
+For the cases where infzero was returning 3 to indicate "return
+the default NaN", we must retain that "return 3".
+For Arm, this looks like it might be a behaviour change because we
+used to set float_flag_invalid | float_flag_invalid_imz only if C is
+a quiet NaN.  However, it is not, because Arm target code never looks
+at float_flag_invalid_imz, and for the (0 * inf) + SNaN case we
+already raised float_flag_invalid via the "abc_mask &
+float_cmask_snan" check in pick_nan_muladd.
+For any target architecture using the "default implementation" at the
+bottom of the ifdef, this is a behaviour change but will be fixing a
+bug (where we failed to raise the Invalid exception for (0 * inf +
+QNaN).  The architectures using the default case are:
+ * hppa
+ * i386
+ * sh4
+ * tricore
+The x86, Tricore and SH4 CPU architecture manuals are clear that this
+should have raised Invalid; HPPA is a bit vaguer but still seems
+clear enough.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-2-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 13 +++++++------
+ fpu/softfloat-specialize.c.inc | 29 +----------------------------
+files changed, 8 insertions(+), 34 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+                                             int ab_mask, int abc_mask)
+ {
+     int which;
++    bool infzero = (ab_mask == float_cmask_infzero);
+     if (unlikely(abc_mask & float_cmask_snan)) {
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
+     }
+-    which = pickNaNMulAdd(a->cls, b->cls, c->cls,
+-                          ab_mask == float_cmask_infzero, s);
++    if (infzero) {
++        /* This is (0 * inf) + NaN or (inf * 0) + NaN */
++        float_raise(float_flag_invalid | float_flag_invalid_imz, s);
++    }
++
++    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+     if (s->default_nan_mode || which == 3) {
+-        /*
+-         * Note that this check is after pickNaNMulAdd so that function
+-         * has an opportunity to set the Invalid flag for infzero.
+-         */
+         parts_default_nan(a, s);
+         return a;
+     }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * the default NaN
+      */
+     if (infzero && is_qnan(c_cls)) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+         return 3;
+     }
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * case sets InvalidOp and returns the default NaN
+          */
+         if (infzero) {
+-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+             return 3;
+         }
+         /* Prefer sNaN over qNaN, in the a, b, c order. */
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+          */
+-        if (infzero) {
+-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-            return 2;
+-        }
+         /* Prefer sNaN over qNaN, in the c, a, b order. */
+         if (is_snan(c_cls)) {
+             return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+      * case sets InvalidOp and returns the input value 'c'
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
++
+     /* Prefer sNaN over qNaN, in the c, a, b order. */
+     if (is_snan(c_cls)) {
+         return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * to return an input NaN if we have one (ie c) rather than generating
+      * a default NaN
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         return 1;
+     }
+ #elif defined(TARGET_RISCV)
+-    /* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-    }
+     return 3; /* default NaN */
+ #elif defined(TARGET_S390X)
+     if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+         return 3;
+     }
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         return 2;
+     }
+ #elif defined(TARGET_SPARC)
+-    /* For (inf,0,nan) return c. */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     /* Prefer SNaN over QNaN, order C, B, A. */
+     if (is_snan(c_cls)) {
+         return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
+      * an input NaN if we have one (ie c).
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     if (status->use_first_nan) {
+         if (is_nan(a_cls)) {
+             return 0;
+--
+.34.1

-New patch
+[PULL 07/72] fpu: Check for default_nan_mode before calling pickNaNMulAdd
+If the target sets default_nan_mode then we're always going to return
+the default NaN, and pickNaNMulAdd() no longer has any side effects.
+For consistency with pickNaN(), check for default_nan_mode before
+calling pickNaNMulAdd().
+When we convert pickNaNMulAdd() to allow runtime selection of the NaN
+propagation rule, this means we won't have to make the targets which
+use default_nan_mode also set a propagation rule.
+Since RiscV always uses default_nan_mode, this allows us to remove
+its ifdef case from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-3-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 8 ++++++--
+ fpu/softfloat-specialize.c.inc | 9 +++++++--
+files changed, 13 insertions(+), 4 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+         float_raise(float_flag_invalid | float_flag_invalid_imz, s);
+     }
+-    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++    if (s->default_nan_mode) {
++        which = 3;
++    } else {
++        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++    }
+-    if (s->default_nan_mode || which == 3) {
++    if (which == 3) {
+         parts_default_nan(a, s);
+         return a;
+     }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+                          bool infzero, float_status *status)
+ {
++    /*
++     * We guarantee not to require the target to tell us how to
++     * pick a NaN if we're always returning the default NaN.
++     * But if we're not in default-NaN mode then the target must
++     * specify.
++     */
++    assert(!status->default_nan_mode);
+ #if defined(TARGET_ARM)
+     /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
+      * the default NaN
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     } else {
+         return 1;
+     }
+-#elif defined(TARGET_RISCV)
+-    return 3; /* default NaN */
+ #elif defined(TARGET_S390X)
+     if (infzero) {
+         return 3;
+--
+.34.1

-[Qemu-devel] [PULL 15/24] hw/arm/smmuv3: Wired IRQ and GERROR helpers
+[PULL 08/72] softfloat: Allow runtime choice of inf * 0 + NaN result
-From: Eric Auger <eric.auger@redhat.com>
+IEEE 758 does not define a fixed rule for what NaN to return in
+the case of a fused multiply-add of inf * 0 + NaN. Different
-We introduce some helpers to handle wired IRQs and especially
+architectures thus do different things:
-GERROR interrupt. SMMU writes GERROR register on GERROR event
+ * some return the default NaN
-and SW acks GERROR interrupts by setting GERRORn.
+ * some return the input NaN
+ * Arm returns the default NaN if the input NaN is quiet,
-The Wired interrupts are edge sensitive hence the pulse usage.
+   and the input NaN if it is signalling
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+We want to make this logic be runtime selected rather than
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+hardcoded into the binary, because:
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+ * this will let us have multiple targets in one QEMU binary
-Message-id: 1524665762-31355-6-git-send-email-eric.auger@redhat.com
+ * the Arm FEAT_AFP architectural feature includes letting
    the guest select a NaN propagation rule at runtime
 In this commit we add an enum for the propagation rule, the field in
 float_status, and the corresponding getters and setters.  We change
 pickNaNMulAdd to honour this, but because all targets still leave
 this field at its default 0 value, the fallback logic will pick the
 rule type with the old ifdef ladder.
 Note that four architectures both use the muladd softfloat functions
 and did not have a branch of the ifdef ladder to specify their
 behaviour (and so were ending up with the "default" case, probably
 wrongly): i386, HPPA, SH4 and Tricore.  SH4 and Tricore both set
 default_nan_mode, and so will never get into pickNaNMulAdd().  For
 HPPA and i386 we retain the same behaviour as the old default-case,
 which is to not ever return the default NaN.  This might not be
 correct but it is not a behaviour change.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-4-peter.maydell@linaro.org
 ---
- hw/arm/smmuv3-internal.h | 14 +++++++++
+ include/fpu/softfloat-helpers.h | 11 ++++
- hw/arm/smmuv3.c          | 64 ++++++++++++++++++++++++++++++++++++++++
+ include/fpu/softfloat-types.h   | 23 +++++++++
- hw/arm/trace-events      |  3 ++
+ fpu/softfloat-specialize.c.inc  | 91 ++++++++++++++++++++++-----------
-files changed, 81 insertions(+)
+files changed, 95 insertions(+), 30 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/include/fpu/softfloat-helpers.h
-+++ b/hw/arm/smmuv3-internal.h
++++ b/include/fpu/softfloat-helpers.h
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t smmuv3_idreg(int regoffset)
+@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
-     return smmuv3_ids[regoffset / 4];
+     status->float_2nan_prop_rule = rule;
  }
-+static inline bool smmuv3_eventq_irq_enabled(SMMUv3State *s)
++static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
 +                                             float_status *status)
 +{
-+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, EVENTQ_IRQEN);
++    status->float_infzeronan_rule = rule;
 +}
 +
-+static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+ static inline void set_flush_to_zero(bool val, float_status *status)
  {
      status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
      return status->float_2nan_prop_rule;
  }
 +static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
 +{
-+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
++    return status->float_infzeronan_rule;
 +}
 +
-+/* public until callers get introduced */
+ static inline bool get_flush_to_zero(float_status *status)
-+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+ {
-+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
+     return status->flush_to_zero;
-+
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/include/fpu/softfloat-types.h
-+++ b/hw/arm/smmuv3.c
++++ b/include/fpu/softfloat-types.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
- #include "hw/arm/smmuv3.h"
+     float_2nan_prop_x87,
- #include "smmuv3-internal.h"
+ } Float2NaNPropRule;
-+/**
++/*
-+ * smmuv3_trigger_irq - pulse @irq if enabled and update
++ * Rule for result of fused multiply-add 0 * Inf + NaN.
-+ * GERROR register in case of GERROR interrupt
++ * This must be a NaN, but implementations differ on whether this
 + * is the input NaN or the default NaN.
 + *
-+ * @irq: irq type
++ * You don't need to set this if default_nan_mode is enabled.
-+ * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
++ * When not in default-NaN mode, it is an error for the target
 + * not to set the rule in float_status if it uses muladd, and we
 + * will assert if we need to handle an input NaN and no rule was
 + * selected.
 + */
-+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
++typedef enum __attribute__((__packed__)) {
-+{
++    /* No propagation rule specified */
-+
++    float_infzeronan_none = 0,
-+    bool pulse = false;
++    /* Result is never the default NaN (so always the input NaN) */
-+
++    float_infzeronan_dnan_never,
-+    switch (irq) {
++    /* Result is always the default NaN */
-+    case SMMU_IRQ_EVTQ:
++    float_infzeronan_dnan_always,
-+        pulse = smmuv3_eventq_irq_enabled(s);
++    /* Result is the default NaN if the input NaN is quiet */
-+        break;
++    float_infzeronan_dnan_if_qnan,
-+    case SMMU_IRQ_PRIQ:
++} FloatInfZeroNaNRule;
-+        qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
++
-+        break;
+ /*
-+    case SMMU_IRQ_CMD_SYNC:
+  * Floating Point Status. Individual architectures may maintain
-+        pulse = true;
+  * several versions of float_status for different functions. The
-+        break;
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
-+    case SMMU_IRQ_GERROR:
+     FloatRoundMode float_rounding_mode;
-+    {
+     FloatX80RoundPrec floatx80_rounding_precision;
-+        uint32_t pending = s->gerror ^ s->gerrorn;
+     Float2NaNPropRule float_2nan_prop_rule;
-+        uint32_t new_gerrors = ~pending & gerror_mask;
++    FloatInfZeroNaNRule float_infzeronan_rule;
-+
+     bool tininess_before_rounding;
-+        if (!new_gerrors) {
+     /* should denormalised results go to zero and set the inexact flag? */
-+            /* only toggle non pending errors */
+     bool flush_to_zero;
-+            return;
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
  static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                           bool infzero, float_status *status)
  {
 +    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
 +
      /*
       * We guarantee not to require the target to tell us how to
       * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
       * specify.
       */
      assert(!status->default_nan_mode);
 +
 +    if (rule == float_infzeronan_none) {
 +        /*
 +         * Temporarily fall back to ifdef ladder
 +         */
  #if defined(TARGET_ARM)
 -    /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
 -     * the default NaN
 -     */
 -    if (infzero && is_qnan(c_cls)) {
 -        return 3;
 +        /*
 +         * For ARM, the (inf,zero,qnan) case returns the default NaN,
 +         * but (inf,zero,snan) returns the input NaN.
 +         */
 +        rule = float_infzeronan_dnan_if_qnan;
 +#elif defined(TARGET_MIPS)
 +        if (snan_bit_is_one(status)) {
 +            /*
 +             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
 +             * case sets InvalidOp and returns the default NaN
 +             */
 +            rule = float_infzeronan_dnan_always;
 +        } else {
 +            /*
 +             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
 +             * case sets InvalidOp and returns the input value 'c'
 +             */
 +            rule = float_infzeronan_dnan_never;
 +        }
-+        s->gerror ^= new_gerrors;
++#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
-+        trace_smmuv3_write_gerror(new_gerrors, s->gerror);
++    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
-+
++    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
-+        pulse = smmuv3_gerror_irq_enabled(s);
++        /*
-+        break;
++         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
 +         * case sets InvalidOp and returns the input value 'c'
 +         */
 +        /*
 +         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
 +         * to return an input NaN if we have one (ie c) rather than generating
 +         * a default NaN
 +         */
 +        rule = float_infzeronan_dnan_never;
 +#elif defined(TARGET_S390X)
 +        rule = float_infzeronan_dnan_always;
 +#endif
      }
 +    if (infzero) {
 +        /*
 +         * Inf * 0 + NaN -- some implementations return the default NaN here,
 +         * and some return the input NaN.
 +         */
 +        switch (rule) {
 +        case float_infzeronan_dnan_never:
 +            return 2;
 +        case float_infzeronan_dnan_always:
 +            return 3;
 +        case float_infzeronan_dnan_if_qnan:
 +            return is_qnan(c_cls) ? 3 : 2;
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
-+    }
++
-+    if (pulse) {
++#if defined(TARGET_ARM)
-+            trace_smmuv3_trigger_irq(irq);
++
-+            qemu_irq_pulse(s->irq[irq]);
+     /* This looks different from the ARM ARM pseudocode, because the ARM ARM
-+    }
+      * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
-+}
+      */
-+
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+     }
-+{
+ #elif defined(TARGET_MIPS)
-+    uint32_t pending = s->gerror ^ s->gerrorn;
+     if (snan_bit_is_one(status)) {
-+    uint32_t toggled = s->gerrorn ^ new_gerrorn;
+-        /*
-+
+-         * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-+    if (toggled & ~pending) {
+-         * case sets InvalidOp and returns the default NaN
-+        qemu_log_mask(LOG_GUEST_ERROR,
+-         */
-+                      "guest toggles non pending errors = 0x%x\n",
+-        if (infzero) {
-+                      toggled & ~pending);
+-            return 3;
-+    }
+-        }
-+
+         /* Prefer sNaN over qNaN, in the a, b, c order. */
-+    /*
+         if (is_snan(a_cls)) {
-+     * We do not raise any error in case guest toggles bits corresponding
+             return 0;
-+     * to not active IRQs (CONSTRAINED UNPREDICTABLE)
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-+     */
+             return 2;
-+    s->gerrorn = new_gerrorn;
+         }
-+
+     } else {
-+    trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
+-        /*
-+}
+-         * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
-+
+-         * case sets InvalidOp and returns the input value 'c'
- static void smmuv3_init_regs(SMMUv3State *s)
+-         */
- {
+         /* Prefer sNaN over qNaN, in the c, a, b order. */
-     /**
+         if (is_snan(c_cls)) {
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
+             return 2;
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
---- a/hw/arm/trace-events
+         }
-+++ b/hw/arm/trace-events
+     }
-@@ -XXX,XX +XXX,XX @@ smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "base
+ #elif defined(TARGET_LOONGARCH64)
+-    /*
- #hw/arm/smmuv3.c
+-     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
- smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+-     * case sets InvalidOp and returns the input value 'c'
-+smmuv3_trigger_irq(int irq) "irq=%d"
+-     */
-+smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
+-
-+smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
+     /* Prefer sNaN over qNaN, in the c, a, b order. */
      if (is_snan(c_cls)) {
          return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          return 1;
      }
  #elif defined(TARGET_PPC)
 -    /* For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
 -     * to return an input NaN if we have one (ie c) rather than generating
 -     * a default NaN
 -     */
 -
      /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
       * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
       */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          return 1;
      }
  #elif defined(TARGET_S390X)
 -    if (infzero) {
 -        return 3;
 -    }
 -
      if (is_snan(a_cls)) {
          return 0;
      } else if (is_snan(b_cls)) {
 --
-.17.0
+.34.1

-New patch
+[PULL 09/72] tests/fp: Explicitly set inf-zero-nan rule
+Explicitly set a rule in the softfloat tests for the inf-zero-nan
+muladd special case.  In meson.build we put -DTARGET_ARM in fpcflags,
+and so we should select here the Arm rule of
+float_infzeronan_dnan_if_qnan.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241202131347.498124-5-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c | 5 +++++
+ tests/fp/fp-test.c  | 5 +++++
+files changed, 10 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+ {
+     bench_func_t f;
++    /*
++     * These implementation-defined choices for various things IEEE
++     * doesn't specify match those used by the Arm architecture.
++     */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+     f = bench_funcs[operation][precision];
+     g_assert(f);
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+ {
+     unsigned int i;
++    /*
++     * These implementation-defined choices for various things IEEE
++     * doesn't specify match those used by the Arm architecture.
++     */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+     verCases_maxErrorCount = n_max_errors;
+--
+.34.1

-New patch
+[PULL 10/72] target/arm: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the Arm target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-6-peter.maydell@linaro.org
+---
+ target/arm/cpu.c               | 3 +++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 4 insertions(+), 7 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+  *  * tininess-before-rounding
+  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
+  *    operand A over operand B (see FPProcessNaNs() pseudocode)
++ *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
++ *    and the input NaN if it is signalling
+  */
+ static void arm_set_default_fp_behaviours(float_status *s)
+ {
+     set_float_detect_tininess(float_tininess_before_rounding, s);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+ }
+ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_ARM)
+-        /*
+-         * For ARM, the (inf,zero,qnan) case returns the default NaN,
+-         * but (inf,zero,snan) returns the input NaN.
+-         */
+-        rule = float_infzeronan_dnan_if_qnan;
+-#elif defined(TARGET_MIPS)
++#if defined(TARGET_MIPS)
+         if (snan_bit_is_one(status)) {
+             /*
+              * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 11/72] target/s390: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for s390, so we
+can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-7-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_detect_tininess(float_tininess_before_rounding,
+                                   &env->fpu_status);
+         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
++        set_float_infzeronan_rule(float_infzeronan_dnan_always,
++                                  &env->fpu_status);
+        /* fall through */
+     case RESET_TYPE_S390_CPU_NORMAL:
+         env->psw.mask &= ~PSW_MASK_RI;
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * a default NaN
+          */
+         rule = float_infzeronan_dnan_never;
+-#elif defined(TARGET_S390X)
+-        rule = float_infzeronan_dnan_always;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 12/72] target/ppc: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the PPC target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-8-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c          | 7 +++++++
+ fpu/softfloat-specialize.c.inc | 7 +------
+files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
++    /*
++     * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
++     * to return an input NaN if we have one (ie c) rather than generating
++     * a default NaN
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
+     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
+         ppc_spr_t *spr = &env->spr_cb[i];
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+              */
+             rule = float_infzeronan_dnan_never;
+         }
+-#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
++#elif defined(TARGET_SPARC) || \
+     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+          */
+-        /*
+-         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+-         * to return an input NaN if we have one (ie c) rather than generating
+-         * a default NaN
+-         */
+         rule = float_infzeronan_dnan_never;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 13/72] target/mips: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the MIPS target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-9-peter.maydell@linaro.org
+---
+ target/mips/fpu_helper.h       |  9 +++++++++
+ target/mips/msa.c              |  4 ++++
+ fpu/softfloat-specialize.c.inc | 16 +---------------
+files changed, 14 insertions(+), 15 deletions(-)
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/fpu_helper.h
++++ b/target/mips/fpu_helper.h
+@@ -XXX,XX +XXX,XX @@ static inline void restore_flush_mode(CPUMIPSState *env)
+ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+ {
+     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
++    FloatInfZeroNaNRule izn_rule;
+     /*
+      * With nan2008, SNaNs are silenced in the usual way.
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+      */
+     set_snan_bit_is_one(!nan2008, &env->active_fpu.fp_status);
+     set_default_nan_mode(!nan2008, &env->active_fpu.fp_status);
++    /*
++     * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
++     * case sets InvalidOp and returns the default NaN.
++     * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
++     * case sets InvalidOp and returns the input value 'c'.
++     */
++    izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
++    set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
+ }
+ static inline void restore_fp_status(CPUMIPSState *env)
+diff --git a/target/mips/msa.c b/target/mips/msa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/msa.c
++++ b/target/mips/msa.c
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
+     /* set proper signanling bit meaning ("1" means "quiet") */
+     set_snan_bit_is_one(0, &env->active_tc.msa_fp_status);
++
++    /* Inf * 0 + NaN returns the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never,
++                              &env->active_tc.msa_fp_status);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_MIPS)
+-        if (snan_bit_is_one(status)) {
+-            /*
+-             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+-             * case sets InvalidOp and returns the default NaN
+-             */
+-            rule = float_infzeronan_dnan_always;
+-        } else {
+-            /*
+-             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+-             * case sets InvalidOp and returns the input value 'c'
+-             */
+-            rule = float_infzeronan_dnan_never;
+-        }
+-#elif defined(TARGET_SPARC) || \
++#if defined(TARGET_SPARC) || \
+     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+--
+.34.1

-New patch
+[PULL 14/72] target/sparc: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the SPARC target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-10-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 +--
+files changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+      * the CPU state struct so it won't get zeroed on reset.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     cpu_exec_realizefn(cs, &local_err);
+     if (local_err != NULL) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_SPARC) || \
+-    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
++#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 15/72] target/xtensa: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the xtensa target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-11-peter.maydell@linaro.org
+---
+ target/xtensa/cpu.c            | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/cpu.c
++++ b/target/xtensa/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
+     reset_mmu(env);
+     cs->halted = env->runstall;
+ #endif
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_no_signaling_nans(!dfpu, &env->fp_status);
+     xtensa_use_first_nan(env, !dfpu);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
++#if defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 16/72] target/x86: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the x86 target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-12-peter.maydell@linaro.org
+---
+ target/i386/tcg/fpu_helper.c   | 7 +++++++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 8 insertions(+), 1 deletion(-)
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->mmx_status);
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->sse_status);
++    /*
++     * Only SSE has multiply-add instructions. In the SDM Section 14.5.2
++     * "Fused-Multiply-ADD (FMA) Numeric Behavior" the NaN handling is
++     * specified -- for 0 * inf + NaN the input NaN is selected, and if
++     * there are multiple input NaNs they are selected in the order a, b, c.
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
+ }
+ static inline uint8_t save_exception_flags(CPUX86State *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * Temporarily fall back to ifdef ladder
+          */
+ #if defined(TARGET_HPPA) || \
+-    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
++    defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+--
+.34.1

-New patch
+[PULL 17/72] target/loongarch: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the loongarch target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-13-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 5 +++++
+ fpu/softfloat-specialize.c.inc    | 7 +------
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+                             &env->fp_status);
+     set_flush_to_zero(0, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /*
++     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
++     * case sets InvalidOp and returns the input value 'c'
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_HPPA) || \
+-    defined(TARGET_LOONGARCH)
+-        /*
+-         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+-         * case sets InvalidOp and returns the input value 'c'
+-         */
++#if defined(TARGET_HPPA)
+         rule = float_infzeronan_dnan_never;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 18/72] target/hppa: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the HPPA target,
+so we can remove the ifdef from pickNaNMulAdd().
+As this is the last target to be converted to explicitly setting
+the rule, we can remove the fallback code in pickNaNMulAdd()
+entirely.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-14-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       |  2 ++
+ fpu/softfloat-specialize.c.inc | 13 +------------
+files changed, 3 insertions(+), 12 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+      * HPPA does note implement a CPU reset method at all...
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+ void cpu_hppa_loaded_fr0(CPUHPPAState *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+                          bool infzero, float_status *status)
+ {
+-    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
+-
+     /*
+      * We guarantee not to require the target to tell us how to
+      * pick a NaN if we're always returning the default NaN.
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      */
+     assert(!status->default_nan_mode);
+-    if (rule == float_infzeronan_none) {
+-        /*
+-         * Temporarily fall back to ifdef ladder
+-         */
+-#if defined(TARGET_HPPA)
+-        rule = float_infzeronan_dnan_never;
+-#endif
+-    }
+-
+     if (infzero) {
+         /*
+          * Inf * 0 + NaN -- some implementations return the default NaN here,
+          * and some return the input NaN.
+          */
+-        switch (rule) {
++        switch (status->float_infzeronan_rule) {
+         case float_infzeronan_dnan_never:
+             return 2;
+         case float_infzeronan_dnan_always:
+--
+.34.1

-New patch
+[PULL 19/72] softfloat: Pass have_snan to pickNaNMulAdd
+The new implementation of pickNaNMulAdd() will find it convenient
+to know whether at least one of the three arguments to the muladd
+was a signaling NaN. We already calculate that in the caller,
+so pass it in as a new bool have_snan.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-15-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 5 +++--
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 4 insertions(+), 3 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+ {
+     int which;
+     bool infzero = (ab_mask == float_cmask_infzero);
++    bool have_snan = (abc_mask & float_cmask_snan);
+-    if (unlikely(abc_mask & float_cmask_snan)) {
++    if (unlikely(have_snan)) {
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
+     }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+     if (s->default_nan_mode) {
+         which = 3;
+     } else {
+-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
+     }
+     if (which == 3) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ | Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
+ *----------------------------------------------------------------------------*/
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+-                         bool infzero, float_status *status)
++                         bool infzero, bool have_snan, float_status *status)
+ {
+     /*
+      * We guarantee not to require the target to tell us how to
+--
+.34.1

-[Qemu-devel] [PULL 16/24] hw/arm/smmuv3: Queue helpers
+[PULL 20/72] softfloat: Allow runtime choice of NaN propagation for muladd
-From: Eric Auger <eric.auger@redhat.com>
+IEEE 758 does not define a fixed rule for which NaN to pick as the
+result if both operands of a 3-operand fused multiply-add operation
-We introduce helpers to read/write into the command and event
+are NaNs.  As a result different architectures have ended up with
-circular queues.
+different rules for propagating NaNs.
-smmuv3_write_eventq and smmuv3_cmq_consume will become static
+QEMU currently hardcodes the NaN propagation logic into the binary
-in subsequent patches.
+because pickNaNMulAdd() has an ifdef ladder for different targets.
+We want to make the propagation rule instead be selectable at
-Invalidation commands are not yet dealt with. We do not cache
+runtime, because:
-data that need to be invalidated. This will change with vhost
+ * this will let us have multiple targets in one QEMU binary
-integration.
+ * the Arm FEAT_AFP architectural feature includes letting
+   the guest select a NaN propagation rule at runtime
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+In this commit we add an enum for the propagation rule, the field in
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+float_status, and the corresponding getters and setters.  We change
-Message-id: 1524665762-31355-7-git-send-email-eric.auger@redhat.com
+pickNaNMulAdd to honour this, but because all targets still leave
 this field at its default 0 value, the fallback logic will pick the
 rule type with the old ifdef ladder.
 It's valid not to set a propagation rule if default_nan_mode is
 enabled, because in that case there's no need to pick a NaN; all the
 callers of pickNaNMulAdd() catch this case and skip calling it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-16-peter.maydell@linaro.org
 ---
- hw/arm/smmuv3-internal.h | 163 +++++++++++++++++++++++++++++++++++++++
+ include/fpu/softfloat-helpers.h |  11 +++
- hw/arm/smmuv3.c          | 136 ++++++++++++++++++++++++++++++++
+ include/fpu/softfloat-types.h   |  55 +++++++++++
- hw/arm/trace-events      |   5 ++
+ fpu/softfloat-specialize.c.inc  | 167 ++++++++------------------------
-files changed, 304 insertions(+)
+files changed, 107 insertions(+), 126 deletions(-)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/include/fpu/softfloat-helpers.h
-+++ b/hw/arm/smmuv3-internal.h
++++ b/include/fpu/softfloat-helpers.h
-@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
- void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+     status->float_2nan_prop_rule = rule;
- void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
+ }
-+/* Queue Handling */
++static inline void set_float_3nan_prop_rule(Float3NaNPropRule rule,
-+
++                                            float_status *status)
 +#define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
 +#define WRAP_MASK(q)       (1 << (q)->log2size)
 +#define INDEX_MASK(q)      (((1 << (q)->log2size)) - 1)
 +#define WRAP_INDEX_MASK(q) ((1 << ((q)->log2size + 1)) - 1)
 +
 +#define Q_CONS(q) ((q)->cons & INDEX_MASK(q))
 +#define Q_PROD(q) ((q)->prod & INDEX_MASK(q))
 +
 +#define Q_CONS_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_CONS(q))
 +#define Q_PROD_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_PROD(q))
 +
 +#define Q_CONS_WRAP(q) (((q)->cons & WRAP_MASK(q)) >> (q)->log2size)
 +#define Q_PROD_WRAP(q) (((q)->prod & WRAP_MASK(q)) >> (q)->log2size)
 +
 +static inline bool smmuv3_q_full(SMMUQueue *q)
 +{
-+    return ((q->cons ^ q->prod) & WRAP_INDEX_MASK(q)) == WRAP_MASK(q);
++    status->float_3nan_prop_rule = rule;
 +}
 +
-+static inline bool smmuv3_q_empty(SMMUQueue *q)
+ static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
                                               float_status *status)
  {
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
      return status->float_2nan_prop_rule;
  }
 +static inline Float3NaNPropRule get_float_3nan_prop_rule(float_status *status)
 +{
-+    return (q->cons & WRAP_INDEX_MASK(q)) == (q->prod & WRAP_INDEX_MASK(q));
++    return status->float_3nan_prop_rule;
 +}
 +
-+static inline void queue_prod_incr(SMMUQueue *q)
+ static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
-+{
+ {
-+    q->prod = (q->prod + 1) & WRAP_INDEX_MASK(q);
+     return status->float_infzeronan_rule;
-+}
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
-+
+index XXXXXXX..XXXXXXX 100644
-+static inline void queue_cons_incr(SMMUQueue *q)
+--- a/include/fpu/softfloat-types.h
-+{
++++ b/include/fpu/softfloat-types.h
-+    /*
+@@ -XXX,XX +XXX,XX @@ this code that are retained.
-+     * We have to use deposit for the CONS registers to preserve
+ #ifndef SOFTFLOAT_TYPES_H
-+     * the ERR field in the high bits.
+ #define SOFTFLOAT_TYPES_H
-+     */
-+    q->cons = deposit32(q->cons, 0, q->log2size + 1, q->cons + 1);
++#include "hw/registerfields.h"
-+}
++
-+
+ /*
-+static inline bool smmuv3_cmdq_enabled(SMMUv3State *s)
+  * Software IEC/IEEE floating-point types.
-+{
+  */
-+    return FIELD_EX32(s->cr[0], CR0, CMDQEN);
+@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
-+}
+     float_2nan_prop_x87,
-+
+ } Float2NaNPropRule;
-+static inline bool smmuv3_eventq_enabled(SMMUv3State *s)
-+{
++/*
-+    return FIELD_EX32(s->cr[0], CR0, EVENTQEN);
++ * 3-input NaN propagation rule, for fused multiply-add. Individual
-+}
++ * architectures have different rules for which input NaN is
-+
++ * propagated to the output when there is more than one NaN on the
-+static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
++ * input.
-+{
++ *
-+    s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
++ * If default_nan_mode is enabled then it is valid not to set a NaN
-+}
++ * propagation rule, because the softfloat code guarantees not to try
-+
++ * to pick a NaN to propagate in default NaN mode.  When not in
-+void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
++ * default-NaN mode, it is an error for the target not to set the rule
-+
++ * in float_status if it uses a muladd, and we will assert if we need
-+/* Commands */
++ * to handle an input NaN and no rule was selected.
-+
++ *
-+typedef enum SMMUCommandType {
++ * The naming scheme for Float3NaNPropRule values is:
-+    SMMU_CMD_NONE            = 0x00,
++ *  float_3nan_prop_s_abc:
-+    SMMU_CMD_PREFETCH_CONFIG       ,
++ *    = "Prefer SNaN over QNaN, then operand A over B over C"
-+    SMMU_CMD_PREFETCH_ADDR,
++ *  float_3nan_prop_abc:
-+    SMMU_CMD_CFGI_STE,
++ *    = "Prefer A over B over C regardless of SNaN vs QNAN"
-+    SMMU_CMD_CFGI_STE_RANGE,
++ *
-+    SMMU_CMD_CFGI_CD,
++ * For QEMU, the multiply-add operation is A * B + C.
-+    SMMU_CMD_CFGI_CD_ALL,
++ */
-+    SMMU_CMD_CFGI_ALL,
++
-+    SMMU_CMD_TLBI_NH_ALL     = 0x10,
++/*
-+    SMMU_CMD_TLBI_NH_ASID,
++ * We set the Float3NaNPropRule enum values up so we can select the
-+    SMMU_CMD_TLBI_NH_VA,
++ * right value in pickNaNMulAdd in a data driven way.
-+    SMMU_CMD_TLBI_NH_VAA,
++ */
-+    SMMU_CMD_TLBI_EL3_ALL    = 0x18,
++FIELD(3NAN, 1ST, 0, 2)   /* which operand is most preferred ? */
-+    SMMU_CMD_TLBI_EL3_VA     = 0x1a,
++FIELD(3NAN, 2ND, 2, 2)   /* which operand is next most preferred ? */
-+    SMMU_CMD_TLBI_EL2_ALL    = 0x20,
++FIELD(3NAN, 3RD, 4, 2)   /* which operand is least preferred ? */
-+    SMMU_CMD_TLBI_EL2_ASID,
++FIELD(3NAN, SNAN, 6, 1)  /* do we prefer SNaN over QNaN ? */
-+    SMMU_CMD_TLBI_EL2_VA,
++
-+    SMMU_CMD_TLBI_EL2_VAA,
++#define PROPRULE(X, Y, Z) \
-+    SMMU_CMD_TLBI_S12_VMALL  = 0x28,
++    ((X << R_3NAN_1ST_SHIFT) | (Y << R_3NAN_2ND_SHIFT) | (Z << R_3NAN_3RD_SHIFT))
-+    SMMU_CMD_TLBI_S2_IPA     = 0x2a,
++
-+    SMMU_CMD_TLBI_NSNH_ALL   = 0x30,
++typedef enum __attribute__((__packed__)) {
-+    SMMU_CMD_ATC_INV         = 0x40,
++    float_3nan_prop_none = 0,     /* No propagation rule specified */
-+    SMMU_CMD_PRI_RESP,
++    float_3nan_prop_abc = PROPRULE(0, 1, 2),
-+    SMMU_CMD_RESUME          = 0x44,
++    float_3nan_prop_acb = PROPRULE(0, 2, 1),
-+    SMMU_CMD_STALL_TERM,
++    float_3nan_prop_bac = PROPRULE(1, 0, 2),
-+    SMMU_CMD_SYNC,
++    float_3nan_prop_bca = PROPRULE(1, 2, 0),
-+} SMMUCommandType;
++    float_3nan_prop_cab = PROPRULE(2, 0, 1),
-+
++    float_3nan_prop_cba = PROPRULE(2, 1, 0),
-+static const char *cmd_stringify[] = {
++    float_3nan_prop_s_abc = float_3nan_prop_abc | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_PREFETCH_CONFIG] = "SMMU_CMD_PREFETCH_CONFIG",
++    float_3nan_prop_s_acb = float_3nan_prop_acb | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_PREFETCH_ADDR]   = "SMMU_CMD_PREFETCH_ADDR",
++    float_3nan_prop_s_bac = float_3nan_prop_bac | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_CFGI_STE]        = "SMMU_CMD_CFGI_STE",
++    float_3nan_prop_s_bca = float_3nan_prop_bca | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_CFGI_STE_RANGE]  = "SMMU_CMD_CFGI_STE_RANGE",
++    float_3nan_prop_s_cab = float_3nan_prop_cab | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_CFGI_CD]         = "SMMU_CMD_CFGI_CD",
++    float_3nan_prop_s_cba = float_3nan_prop_cba | R_3NAN_SNAN_MASK,
-+    [SMMU_CMD_CFGI_CD_ALL]     = "SMMU_CMD_CFGI_CD_ALL",
++} Float3NaNPropRule;
-+    [SMMU_CMD_CFGI_ALL]        = "SMMU_CMD_CFGI_ALL",
++
-+    [SMMU_CMD_TLBI_NH_ALL]     = "SMMU_CMD_TLBI_NH_ALL",
++#undef PROPRULE
-+    [SMMU_CMD_TLBI_NH_ASID]    = "SMMU_CMD_TLBI_NH_ASID",
++
-+    [SMMU_CMD_TLBI_NH_VA]      = "SMMU_CMD_TLBI_NH_VA",
+ /*
-+    [SMMU_CMD_TLBI_NH_VAA]     = "SMMU_CMD_TLBI_NH_VAA",
+  * Rule for result of fused multiply-add 0 * Inf + NaN.
-+    [SMMU_CMD_TLBI_EL3_ALL]    = "SMMU_CMD_TLBI_EL3_ALL",
+  * This must be a NaN, but implementations differ on whether this
-+    [SMMU_CMD_TLBI_EL3_VA]     = "SMMU_CMD_TLBI_EL3_VA",
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
-+    [SMMU_CMD_TLBI_EL2_ALL]    = "SMMU_CMD_TLBI_EL2_ALL",
+     FloatRoundMode float_rounding_mode;
-+    [SMMU_CMD_TLBI_EL2_ASID]   = "SMMU_CMD_TLBI_EL2_ASID",
+     FloatX80RoundPrec floatx80_rounding_precision;
-+    [SMMU_CMD_TLBI_EL2_VA]     = "SMMU_CMD_TLBI_EL2_VA",
+     Float2NaNPropRule float_2nan_prop_rule;
-+    [SMMU_CMD_TLBI_EL2_VAA]    = "SMMU_CMD_TLBI_EL2_VAA",
++    Float3NaNPropRule float_3nan_prop_rule;
-+    [SMMU_CMD_TLBI_S12_VMALL]  = "SMMU_CMD_TLBI_S12_VMALL",
+     FloatInfZeroNaNRule float_infzeronan_rule;
-+    [SMMU_CMD_TLBI_S2_IPA]     = "SMMU_CMD_TLBI_S2_IPA",
+     bool tininess_before_rounding;
-+    [SMMU_CMD_TLBI_NSNH_ALL]   = "SMMU_CMD_TLBI_NSNH_ALL",
+     /* should denormalised results go to zero and set the inexact flag? */
-+    [SMMU_CMD_ATC_INV]         = "SMMU_CMD_ATC_INV",
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
-+    [SMMU_CMD_PRI_RESP]        = "SMMU_CMD_PRI_RESP",
+index XXXXXXX..XXXXXXX 100644
-+    [SMMU_CMD_RESUME]          = "SMMU_CMD_RESUME",
+--- a/fpu/softfloat-specialize.c.inc
-+    [SMMU_CMD_STALL_TERM]      = "SMMU_CMD_STALL_TERM",
++++ b/fpu/softfloat-specialize.c.inc
-+    [SMMU_CMD_SYNC]            = "SMMU_CMD_SYNC",
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
-+};
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-+
+                          bool infzero, bool have_snan, float_status *status)
-+static inline const char *smmu_cmd_string(SMMUCommandType type)
+ {
-+{
++    FloatClass cls[3] = { a_cls, b_cls, c_cls };
-+    if (type > SMMU_CMD_NONE && type < ARRAY_SIZE(cmd_stringify)) {
++    Float3NaNPropRule rule = status->float_3nan_prop_rule;
-+        return cmd_stringify[type] ? cmd_stringify[type] : "UNKNOWN";
++    int which;
 +
      /*
       * We guarantee not to require the target to tell us how to
       * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          }
      }
 +    if (rule == float_3nan_prop_none) {
  #if defined(TARGET_ARM)
 -
 -    /* This looks different from the ARM ARM pseudocode, because the ARM ARM
 -     * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
 -     */
 -    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else {
 -        return 1;
 -    }
 +        /*
 +         * This looks different from the ARM ARM pseudocode, because the ARM ARM
 +         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
 +         */
 +        rule = float_3nan_prop_s_cab;
  #elif defined(TARGET_MIPS)
 -    if (snan_bit_is_one(status)) {
 -        /* Prefer sNaN over qNaN, in the a, b, c order. */
 -        if (is_snan(a_cls)) {
 -            return 0;
 -        } else if (is_snan(b_cls)) {
 -            return 1;
 -        } else if (is_snan(c_cls)) {
 -            return 2;
 -        } else if (is_qnan(a_cls)) {
 -            return 0;
 -        } else if (is_qnan(b_cls)) {
 -            return 1;
 +        if (snan_bit_is_one(status)) {
 +            rule = float_3nan_prop_s_abc;
          } else {
 -            return 2;
 +            rule = float_3nan_prop_s_cab;
          }
 -    } else {
 -        /* Prefer sNaN over qNaN, in the c, a, b order. */
 -        if (is_snan(c_cls)) {
 -            return 2;
 -        } else if (is_snan(a_cls)) {
 -            return 0;
 -        } else if (is_snan(b_cls)) {
 -            return 1;
 -        } else if (is_qnan(c_cls)) {
 -            return 2;
 -        } else if (is_qnan(a_cls)) {
 -            return 0;
 -        } else {
 -            return 1;
 -        }
 -    }
  #elif defined(TARGET_LOONGARCH64)
 -    /* Prefer sNaN over qNaN, in the c, a, b order. */
 -    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else {
 -        return 1;
 -    }
 +        rule = float_3nan_prop_s_cab;
  #elif defined(TARGET_PPC)
 -    /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
 -     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
 -     */
 -    if (is_nan(a_cls)) {
 -        return 0;
 -    } else if (is_nan(c_cls)) {
 -        return 2;
 -    } else {
 -        return 1;
 -    }
 +        /*
 +         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
 +         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
 +         */
 +        rule = float_3nan_prop_acb;
  #elif defined(TARGET_S390X)
 -    if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else if (is_qnan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 2;
 -    }
 +        rule = float_3nan_prop_s_abc;
  #elif defined(TARGET_SPARC)
 -    /* Prefer SNaN over QNaN, order C, B, A. */
 -    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 0;
 -    }
 +        rule = float_3nan_prop_s_cba;
  #elif defined(TARGET_XTENSA)
 -    /*
 -     * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
 -     * an input NaN if we have one (ie c).
 -     */
 -    if (status->use_first_nan) {
 -        if (is_nan(a_cls)) {
 -            return 0;
 -        } else if (is_nan(b_cls)) {
 -            return 1;
 +        if (status->use_first_nan) {
 +            rule = float_3nan_prop_abc;
          } else {
 -            return 2;
 +            rule = float_3nan_prop_cba;
          }
 -    } else {
 -        if (is_nan(c_cls)) {
 -            return 2;
 -        } else if (is_nan(b_cls)) {
 -            return 1;
 -        } else {
 -            return 0;
 -        }
 -    }
  #else
 -    /* A default implementation: prefer a to b to c.
 -     * This is unlikely to actually match any real implementation.
 -     */
 -    if (is_nan(a_cls)) {
 -        return 0;
 -    } else if (is_nan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 2;
 -    }
 +        rule = float_3nan_prop_abc;
  #endif
 +    }
 +
 +    assert(rule != float_3nan_prop_none);
 +    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
 +        /* We have at least one SNaN input and should prefer it */
 +        do {
 +            which = rule & R_3NAN_1ST_MASK;
 +            rule >>= R_3NAN_1ST_LENGTH;
 +        } while (!is_snan(cls[which]));
 +    } else {
-+        return "INVALID";
++        do {
 +            which = rule & R_3NAN_1ST_MASK;
 +            rule >>= R_3NAN_1ST_LENGTH;
 +        } while (!is_nan(cls[which]));
 +    }
-+}
++    return which;
 +
 +/* CMDQ fields */
 +
 +typedef enum {
 +    SMMU_CERROR_NONE = 0,
 +    SMMU_CERROR_ILL,
 +    SMMU_CERROR_ABT,
 +    SMMU_CERROR_ATC_INV_SYNC,
 +} SMMUCmdError;
 +
 +enum { /* Command completion notification */
 +    CMD_SYNC_SIG_NONE,
 +    CMD_SYNC_SIG_IRQ,
 +    CMD_SYNC_SIG_SEV,
 +};
 +
 +#define CMD_TYPE(x)         extract32((x)->word[0], 0 , 8)
 +#define CMD_SSEC(x)         extract32((x)->word[0], 10, 1)
 +#define CMD_SSV(x)          extract32((x)->word[0], 11, 1)
 +#define CMD_RESUME_AC(x)    extract32((x)->word[0], 12, 1)
 +#define CMD_RESUME_AB(x)    extract32((x)->word[0], 13, 1)
 +#define CMD_SYNC_CS(x)      extract32((x)->word[0], 12, 2)
 +#define CMD_SSID(x)         extract32((x)->word[0], 12, 20)
 +#define CMD_SID(x)          ((x)->word[1])
 +#define CMD_VMID(x)         extract32((x)->word[1], 0 , 16)
 +#define CMD_ASID(x)         extract32((x)->word[1], 16, 16)
 +#define CMD_RESUME_STAG(x)  extract32((x)->word[2], 0 , 16)
 +#define CMD_RESP(x)         extract32((x)->word[2], 11, 2)
 +#define CMD_LEAF(x)         extract32((x)->word[2], 0 , 1)
 +#define CMD_STE_RANGE(x)    extract32((x)->word[2], 0 , 5)
 +#define CMD_ADDR(x) ({                                        \
 +            uint64_t high = (uint64_t)(x)->word[3];           \
 +            uint64_t low = extract32((x)->word[2], 12, 20);    \
 +            uint64_t addr = high << 32 | (low << 12);         \
 +            addr;                                             \
 +        })
 +
 +int smmuv3_cmdq_consume(SMMUv3State *s);
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
      trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
  }
-+static inline MemTxResult queue_read(SMMUQueue *q, void *data)
+ /*----------------------------------------------------------------------------
 +{
 +    dma_addr_t addr = Q_CONS_ENTRY(q);
 +
 +    return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
 +}
 +
 +static MemTxResult queue_write(SMMUQueue *q, void *data)
 +{
 +    dma_addr_t addr = Q_PROD_ENTRY(q);
 +    MemTxResult ret;
 +
 +    ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
 +    if (ret != MEMTX_OK) {
 +        return ret;
 +    }
 +
 +    queue_prod_incr(q);
 +    return MEMTX_OK;
 +}
 +
 +void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 +{
 +    SMMUQueue *q = &s->eventq;
 +
 +    if (!smmuv3_eventq_enabled(s)) {
 +        return;
 +    }
 +
 +    if (smmuv3_q_full(q)) {
 +        return;
 +    }
 +
 +    queue_write(q, evt);
 +
 +    if (smmuv3_q_empty(q)) {
 +        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 +    }
 +}
 +
  static void smmuv3_init_regs(SMMUv3State *s)
  {
      /**
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
      s->sid_split = 0;
  }
 +int smmuv3_cmdq_consume(SMMUv3State *s)
 +{
 +    SMMUCmdError cmd_error = SMMU_CERROR_NONE;
 +    SMMUQueue *q = &s->cmdq;
 +    SMMUCommandType type = 0;
 +
 +    if (!smmuv3_cmdq_enabled(s)) {
 +        return 0;
 +    }
 +    /*
 +     * some commands depend on register values, typically CR0. In case those
 +     * register values change while handling the command, spec says it
 +     * is UNPREDICTABLE whether the command is interpreted under the new
 +     * or old value.
 +     */
 +
 +    while (!smmuv3_q_empty(q)) {
 +        uint32_t pending = s->gerror ^ s->gerrorn;
 +        Cmd cmd;
 +
 +        trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
 +                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
 +
 +        if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
 +            break;
 +        }
 +
 +        if (queue_read(q, &cmd) != MEMTX_OK) {
 +            cmd_error = SMMU_CERROR_ABT;
 +            break;
 +        }
 +
 +        type = CMD_TYPE(&cmd);
 +
 +        trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
 +
 +        switch (type) {
 +        case SMMU_CMD_SYNC:
 +            if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
 +                smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
 +            }
 +            break;
 +        case SMMU_CMD_PREFETCH_CONFIG:
 +        case SMMU_CMD_PREFETCH_ADDR:
 +        case SMMU_CMD_CFGI_STE:
 +        case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
 +        case SMMU_CMD_CFGI_CD:
 +        case SMMU_CMD_CFGI_CD_ALL:
 +        case SMMU_CMD_TLBI_NH_ALL:
 +        case SMMU_CMD_TLBI_NH_ASID:
 +        case SMMU_CMD_TLBI_NH_VA:
 +        case SMMU_CMD_TLBI_NH_VAA:
 +        case SMMU_CMD_TLBI_EL3_ALL:
 +        case SMMU_CMD_TLBI_EL3_VA:
 +        case SMMU_CMD_TLBI_EL2_ALL:
 +        case SMMU_CMD_TLBI_EL2_ASID:
 +        case SMMU_CMD_TLBI_EL2_VA:
 +        case SMMU_CMD_TLBI_EL2_VAA:
 +        case SMMU_CMD_TLBI_S12_VMALL:
 +        case SMMU_CMD_TLBI_S2_IPA:
 +        case SMMU_CMD_TLBI_NSNH_ALL:
 +        case SMMU_CMD_ATC_INV:
 +        case SMMU_CMD_PRI_RESP:
 +        case SMMU_CMD_RESUME:
 +        case SMMU_CMD_STALL_TERM:
 +            trace_smmuv3_unhandled_cmd(type);
 +            break;
 +        default:
 +            cmd_error = SMMU_CERROR_ILL;
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
 +            break;
 +        }
 +        if (cmd_error) {
 +            break;
 +        }
 +        /*
 +         * We only increment the cons index after the completion of
 +         * the command. We do that because the SYNC returns immediately
 +         * and does not check the completion of previous commands
 +         */
 +        queue_cons_incr(q);
 +    }
 +
 +    if (cmd_error) {
 +        trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
 +        smmu_write_cmdq_err(s, cmd_error);
 +        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
 +    }
 +
 +    trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
 +                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
 +
 +    return 0;
 +}
 +
  static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                     unsigned size, MemTxAttrs attrs)
  {
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
  smmuv3_trigger_irq(int irq) "irq=%d"
  smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
  smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
 +smmuv3_unhandled_cmd(uint32_t type) "Unhandled command type=%d"
 +smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod=%d cons=%d prod.wrap=%d cons.wrap=%d"
 +smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
 +smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
 +smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
 --
-.17.0
+.34.1

-New patch
+[PULL 21/72] tests/fp: Explicitly set 3-NaN propagation rule
+Explicitly set a rule in the softfloat tests for propagating NaNs in
+the muladd case.  In meson.build we put -DTARGET_ARM in fpcflags, and
+so we should select here the Arm rule of float_3nan_prop_s_cab.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-17-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c | 1 +
+ tests/fp/fp-test.c  | 1 +
+files changed, 2 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+      * doesn't specify match those used by the Arm architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+     f = bench_funcs[operation][precision];
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+      * doesn't specify match those used by the Arm architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+--
+.34.1

-New patch
+[PULL 22/72] target/arm: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for Arm, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-18-peter.maydell@linaro.org
+---
+ target/arm/cpu.c               | 5 +++++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 6 insertions(+), 7 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+  *  * tininess-before-rounding
+  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
+  *    operand A over operand B (see FPProcessNaNs() pseudocode)
++ *  * 3-input NaN propagation prefers SNaN over QNaN, and then
++ *    operand C over A over B (see FPProcessNaNs3() pseudocode,
++ *    but note that for QEMU muladd is a * b + c, whereas for
++ *    the pseudocode function the arguments are in the order c, a, b.
+  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+  *    and the input NaN if it is signalling
+  */
+@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
+ {
+     set_float_detect_tininess(float_tininess_before_rounding, s);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     }
+     if (rule == float_3nan_prop_none) {
+-#if defined(TARGET_ARM)
+-        /*
+-         * This looks different from the ARM ARM pseudocode, because the ARM ARM
+-         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
+-         */
+-        rule = float_3nan_prop_s_cab;
+-#elif defined(TARGET_MIPS)
++#if defined(TARGET_MIPS)
+         if (snan_bit_is_one(status)) {
+             rule = float_3nan_prop_s_abc;
+         } else {
+--
+.34.1

-New patch
+[PULL 23/72] target/loongarch: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for loongarch, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-19-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 1 +
+ fpu/softfloat-specialize.c.inc    | 2 --
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+      * case sets InvalidOp and returns the input value 'c'
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_LOONGARCH64)
+-        rule = float_3nan_prop_s_cab;
+ #elif defined(TARGET_PPC)
+         /*
+          * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+--
+.34.1

-New patch
+[PULL 24/72] target/ppc: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for PPC, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-20-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c          | 8 ++++++++
+ fpu/softfloat-specialize.c.inc | 6 ------
+files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
++    /*
++     * NaN propagation for fused multiply-add:
++     * if fRA is a NaN return it; otherwise if fRB is a NaN return it;
++     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
++     * whereas QEMU labels the operands as (a * b) + c.
++     */
++    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->vec_status);
+     /*
+      * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+      * to return an input NaN if we have one (ie c) rather than generating
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_PPC)
+-        /*
+-         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+-         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+-         */
+-        rule = float_3nan_prop_acb;
+ #elif defined(TARGET_S390X)
+         rule = float_3nan_prop_s_abc;
+ #elif defined(TARGET_SPARC)
+--
+.34.1

-New patch
+[PULL 25/72] target/s390x: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for s390x, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-21-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c             | 1 +
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_detect_tininess(float_tininess_before_rounding,
+                                   &env->fpu_status);
+         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
++        set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
+         set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                   &env->fpu_status);
+        /* fall through */
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_S390X)
+-        rule = float_3nan_prop_s_abc;
+ #elif defined(TARGET_SPARC)
+         rule = float_3nan_prop_s_cba;
+ #elif defined(TARGET_XTENSA)
+--
+.34.1

-New patch
+[PULL 26/72] target/sparc: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for SPARC, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-22-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+      * the CPU state struct so it won't get zeroed on reset.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
++    /* For fused-multiply add, prefer SNaN over QNaN, then C->B->A */
++    set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_SPARC)
+-        rule = float_3nan_prop_s_cba;
+ #elif defined(TARGET_XTENSA)
+         if (status->use_first_nan) {
+             rule = float_3nan_prop_abc;
+--
+.34.1

-New patch
+[PULL 27/72] target/mips: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for Arm, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-23-peter.maydell@linaro.org
+---
+ target/mips/fpu_helper.h       | 4 ++++
+ target/mips/msa.c              | 3 +++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 8 insertions(+), 7 deletions(-)
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/fpu_helper.h
++++ b/target/mips/fpu_helper.h
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+ {
+     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
+     FloatInfZeroNaNRule izn_rule;
++    Float3NaNPropRule nan3_rule;
+     /*
+      * With nan2008, SNaNs are silenced in the usual way.
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+      */
+     izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
+     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
++    nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
++    set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
++
+ }
+ static inline void restore_fp_status(CPUMIPSState *env)
+diff --git a/target/mips/msa.c b/target/mips/msa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/msa.c
++++ b/target/mips/msa.c
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab,
+                              &env->active_tc.msa_fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab,
++                             &env->active_tc.msa_fp_status);
++
+     /* clear float_status exception flags */
+     set_float_exception_flags(0, &env->active_tc.msa_fp_status);
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     }
+     if (rule == float_3nan_prop_none) {
+-#if defined(TARGET_MIPS)
+-        if (snan_bit_is_one(status)) {
+-            rule = float_3nan_prop_s_abc;
+-        } else {
+-            rule = float_3nan_prop_s_cab;
+-        }
+-#elif defined(TARGET_XTENSA)
++#if defined(TARGET_XTENSA)
+         if (status->use_first_nan) {
+             rule = float_3nan_prop_abc;
+         } else {
+--
+.34.1

-[Qemu-devel] [PULL 18/24] hw/arm/smmuv3: Event queue recording helper
+[PULL 28/72] target/xtensa: Set Float3NaNPropRule explicitly
-From: Eric Auger <eric.auger@redhat.com>
+Set the Float3NaNPropRule explicitly for xtensa, and remove the
 ifdef from pickNaNMulAdd().
-Let's introduce a helper function aiming at recording an
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-event in the event queue.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20241202131347.498124-24-peter.maydell@linaro.org
 ---
  target/xtensa/fpu_helper.c     | 2 ++
  fpu/softfloat-specialize.c.inc | 8 --------
 files changed, 2 insertions(+), 8 deletions(-)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-9-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3-internal.h | 148 ++++++++++++++++++++++++++++++++++++++-
  hw/arm/smmuv3.c          | 108 ++++++++++++++++++++++++++--
  hw/arm/trace-events      |   1 +
 files changed, 249 insertions(+), 8 deletions(-)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/target/xtensa/fpu_helper.c
-+++ b/hw/arm/smmuv3-internal.h
++++ b/target/xtensa/fpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
+@@ -XXX,XX +XXX,XX @@ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
-     s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
+     set_use_first_nan(use_first, &env->fp_status);
      set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
                               &env->fp_status);
 +    set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
 +                             &env->fp_status);
  }
--void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
+ void HELPER(wur_fpu2k_fcr)(CPUXtensaState *env, uint32_t v)
--
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
  /* Commands */
  typedef enum SMMUCommandType {
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
  #define SMMU_FEATURE_2LVL_STE (1 << 0)
 +/* Events */
 +
 +typedef enum SMMUEventType {
 +    SMMU_EVT_OK                 = 0x00,
 +    SMMU_EVT_F_UUT                    ,
 +    SMMU_EVT_C_BAD_STREAMID           ,
 +    SMMU_EVT_F_STE_FETCH              ,
 +    SMMU_EVT_C_BAD_STE                ,
 +    SMMU_EVT_F_BAD_ATS_TREQ           ,
 +    SMMU_EVT_F_STREAM_DISABLED        ,
 +    SMMU_EVT_F_TRANS_FORBIDDEN        ,
 +    SMMU_EVT_C_BAD_SUBSTREAMID        ,
 +    SMMU_EVT_F_CD_FETCH               ,
 +    SMMU_EVT_C_BAD_CD                 ,
 +    SMMU_EVT_F_WALK_EABT              ,
 +    SMMU_EVT_F_TRANSLATION      = 0x10,
 +    SMMU_EVT_F_ADDR_SIZE              ,
 +    SMMU_EVT_F_ACCESS                 ,
 +    SMMU_EVT_F_PERMISSION             ,
 +    SMMU_EVT_F_TLB_CONFLICT     = 0x20,
 +    SMMU_EVT_F_CFG_CONFLICT           ,
 +    SMMU_EVT_E_PAGE_REQ         = 0x24,
 +} SMMUEventType;
 +
 +static const char *event_stringify[] = {
 +    [SMMU_EVT_OK]                       = "SMMU_EVT_OK",
 +    [SMMU_EVT_F_UUT]                    = "SMMU_EVT_F_UUT",
 +    [SMMU_EVT_C_BAD_STREAMID]           = "SMMU_EVT_C_BAD_STREAMID",
 +    [SMMU_EVT_F_STE_FETCH]              = "SMMU_EVT_F_STE_FETCH",
 +    [SMMU_EVT_C_BAD_STE]                = "SMMU_EVT_C_BAD_STE",
 +    [SMMU_EVT_F_BAD_ATS_TREQ]           = "SMMU_EVT_F_BAD_ATS_TREQ",
 +    [SMMU_EVT_F_STREAM_DISABLED]        = "SMMU_EVT_F_STREAM_DISABLED",
 +    [SMMU_EVT_F_TRANS_FORBIDDEN]        = "SMMU_EVT_F_TRANS_FORBIDDEN",
 +    [SMMU_EVT_C_BAD_SUBSTREAMID]        = "SMMU_EVT_C_BAD_SUBSTREAMID",
 +    [SMMU_EVT_F_CD_FETCH]               = "SMMU_EVT_F_CD_FETCH",
 +    [SMMU_EVT_C_BAD_CD]                 = "SMMU_EVT_C_BAD_CD",
 +    [SMMU_EVT_F_WALK_EABT]              = "SMMU_EVT_F_WALK_EABT",
 +    [SMMU_EVT_F_TRANSLATION]            = "SMMU_EVT_F_TRANSLATION",
 +    [SMMU_EVT_F_ADDR_SIZE]              = "SMMU_EVT_F_ADDR_SIZE",
 +    [SMMU_EVT_F_ACCESS]                 = "SMMU_EVT_F_ACCESS",
 +    [SMMU_EVT_F_PERMISSION]             = "SMMU_EVT_F_PERMISSION",
 +    [SMMU_EVT_F_TLB_CONFLICT]           = "SMMU_EVT_F_TLB_CONFLICT",
 +    [SMMU_EVT_F_CFG_CONFLICT]           = "SMMU_EVT_F_CFG_CONFLICT",
 +    [SMMU_EVT_E_PAGE_REQ]               = "SMMU_EVT_E_PAGE_REQ",
 +};
 +
 +static inline const char *smmu_event_string(SMMUEventType type)
 +{
 +    if (type < ARRAY_SIZE(event_stringify)) {
 +        return event_stringify[type] ? event_stringify[type] : "UNKNOWN";
 +    } else {
 +        return "INVALID";
 +    }
 +}
 +
 +/*  Encode an event record */
 +typedef struct SMMUEventInfo {
 +    SMMUEventType type;
 +    uint32_t sid;
 +    bool recorded;
 +    bool record_trans_faults;
 +    union {
 +        struct {
 +            uint32_t ssid;
 +            bool ssv;
 +            dma_addr_t addr;
 +            bool rnw;
 +            bool pnu;
 +            bool ind;
 +       } f_uut;
 +       struct SSIDInfo {
 +            uint32_t ssid;
 +            bool ssv;
 +       } c_bad_streamid;
 +       struct SSIDAddrInfo {
 +            uint32_t ssid;
 +            bool ssv;
 +            dma_addr_t addr;
 +       } f_ste_fetch;
 +       struct SSIDInfo c_bad_ste;
 +       struct {
 +            dma_addr_t addr;
 +            bool rnw;
 +       } f_transl_forbidden;
 +       struct {
 +            uint32_t ssid;
 +       } c_bad_substream;
 +       struct SSIDAddrInfo f_cd_fetch;
 +       struct SSIDInfo c_bad_cd;
 +       struct FullInfo {
 +            bool stall;
 +            uint16_t stag;
 +            uint32_t ssid;
 +            bool ssv;
 +            bool s2;
 +            dma_addr_t addr;
 +            bool rnw;
 +            bool pnu;
 +            bool ind;
 +            uint8_t class;
 +            dma_addr_t addr2;
 +       } f_walk_eabt;
 +       struct FullInfo f_translation;
 +       struct FullInfo f_addr_size;
 +       struct FullInfo f_access;
 +       struct FullInfo f_permission;
 +       struct SSIDInfo f_cfg_conflict;
 +       /**
 +        * not supported yet:
 +        * F_BAD_ATS_TREQ
 +        * F_BAD_ATS_TREQ
 +        * F_TLB_CONFLICT
 +        * E_PAGE_REQUEST
 +        * IMPDEF_EVENTn
 +        */
 +    } u;
 +} SMMUEventInfo;
 +
 +/* EVTQ fields */
 +
 +#define EVT_Q_OVERFLOW        (1 << 31)
 +
 +#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
 +#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
 +#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
 +#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
 +#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
 +#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
 +#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
 +#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
 +#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
 +#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
 +#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
 +#define EVT_SET_ADDR(x, addr)                             \
 +    do {                                                  \
 +            (x)->word[5] = (uint32_t)(addr >> 32);        \
 +            (x)->word[4] = (uint32_t)(addr & 0xffffffff); \
 +    } while (0)
 +#define EVT_SET_ADDR2(x, addr)                            \
 +    do {                                                  \
 +            deposit32((x)->word[7], 3, 29, addr >> 16);   \
 +            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
 +    } while (0)
 +
 +void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/hw/arm/smmuv3.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ static MemTxResult queue_write(SMMUQueue *q, void *data)
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      return MEMTX_OK;
  }
 -void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 +static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
  {
      SMMUQueue *q = &s->eventq;
 +    MemTxResult r;
 +
 +    if (!smmuv3_eventq_enabled(s)) {
 +        return MEMTX_ERROR;
 +    }
 +
 +    if (smmuv3_q_full(q)) {
 +        return MEMTX_ERROR;
 +    }
 +
 +    r = queue_write(q, evt);
 +    if (r != MEMTX_OK) {
 +        return r;
 +    }
 +
 +    if (smmuv3_q_empty(q)) {
 +        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 +    }
 +    return MEMTX_OK;
 +}
 +
 +void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 +{
 +    Evt evt;
 +    MemTxResult r;
      if (!smmuv3_eventq_enabled(s)) {
          return;
      }
--    if (smmuv3_q_full(q)) {
+     if (rule == float_3nan_prop_none) {
-+    EVT_SET_TYPE(&evt, info->type);
+-#if defined(TARGET_XTENSA)
-+    EVT_SET_SID(&evt, info->sid);
+-        if (status->use_first_nan) {
-+
+-            rule = float_3nan_prop_abc;
-+    switch (info->type) {
+-        } else {
-+    case SMMU_EVT_OK:
+-            rule = float_3nan_prop_cba;
-         return;
+-        }
-+    case SMMU_EVT_F_UUT:
+-#else
-+        EVT_SET_SSID(&evt, info->u.f_uut.ssid);
+         rule = float_3nan_prop_abc;
-+        EVT_SET_SSV(&evt,  info->u.f_uut.ssv);
+-#endif
 +        EVT_SET_ADDR(&evt, info->u.f_uut.addr);
 +        EVT_SET_RNW(&evt,  info->u.f_uut.rnw);
 +        EVT_SET_PNU(&evt,  info->u.f_uut.pnu);
 +        EVT_SET_IND(&evt,  info->u.f_uut.ind);
 +        break;
 +    case SMMU_EVT_C_BAD_STREAMID:
 +        EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_streamid.ssv);
 +        break;
 +    case SMMU_EVT_F_STE_FETCH:
 +        EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
 +        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
 +        break;
 +    case SMMU_EVT_C_BAD_STE:
 +        EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_ste.ssv);
 +        break;
 +    case SMMU_EVT_F_STREAM_DISABLED:
 +        break;
 +    case SMMU_EVT_F_TRANS_FORBIDDEN:
 +        EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
 +        EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
 +        break;
 +    case SMMU_EVT_C_BAD_SUBSTREAMID:
 +        EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
 +        break;
 +    case SMMU_EVT_F_CD_FETCH:
 +        EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_cd_fetch.ssv);
 +        EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
 +        break;
 +    case SMMU_EVT_C_BAD_CD:
 +        EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
 +        EVT_SET_SSV(&evt,  info->u.c_bad_cd.ssv);
 +        break;
 +    case SMMU_EVT_F_WALK_EABT:
 +    case SMMU_EVT_F_TRANSLATION:
 +    case SMMU_EVT_F_ADDR_SIZE:
 +    case SMMU_EVT_F_ACCESS:
 +    case SMMU_EVT_F_PERMISSION:
 +        EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
 +        EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
 +        EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
 +        EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
 +        EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
 +        EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
 +        EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
 +        EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
 +        EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
 +        EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
 +        EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
 +        break;
 +    case SMMU_EVT_F_CFG_CONFLICT:
 +        EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
 +        EVT_SET_SSV(&evt,  info->u.f_cfg_conflict.ssv);
 +        break;
 +    /* rest is not implemented */
 +    case SMMU_EVT_F_BAD_ATS_TREQ:
 +    case SMMU_EVT_F_TLB_CONFLICT:
 +    case SMMU_EVT_E_PAGE_REQ:
 +    default:
 +        g_assert_not_reached();
      }
--    queue_write(q, evt);
+     assert(rule != float_3nan_prop_none);
 -
 -    if (smmuv3_q_empty(q)) {
 -        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
 +    trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
 +    r = smmuv3_write_eventq(s, &evt);
 +    if (r != MEMTX_OK) {
 +        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
      }
 +    info->recorded = true;
  }
  static void smmuv3_init_regs(SMMUv3State *s)
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
  smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
  smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
  smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 +smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 03/24] hw/char/cmsdk-apb-uart.c: Accept more input after character read
+[PULL 29/72] target/i386: Set Float3NaNPropRule explicitly
-From: Patrick Oppenlander <patrick.oppenlander@gmail.com>
+Set the Float3NaNPropRule explicitly for i386.  We had no
 i386-specific behaviour in the old ifdef ladder, so we were using the
 default "prefer a then b then c" fallback; this is actually the
 correct per-the-spec handling for i386.
-The character frontend needs to be notified that the uart receive buffer
-is empty and ready to handle another character.
-Previously, the uart only worked correctly when receiving one character
-at a time.
-Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
-Message-id: CAEg67GkRTw=cXei3o9hvpxG_L4zSrNzR0bFyAgny+sSEUb_kPw@mail.gmail.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-25-peter.maydell@linaro.org
 ---
- hw/char/cmsdk-apb-uart.c | 1 +
+ target/i386/tcg/fpu_helper.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cmsdk-apb-uart.c
+--- a/target/i386/tcg/fpu_helper.c
-+++ b/hw/char/cmsdk-apb-uart.c
++++ b/target/i386/tcg/fpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
-         r = s->rxbuf;
+      * there are multiple input NaNs they are selected in the order a, b, c.
-         s->state &= ~R_STATE_RXFULL_MASK;
+      */
-         cmsdk_apb_uart_update(s);
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
-+        qemu_chr_fe_accept_input(&s->chr);
++    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
-         break;
+ }
-     case A_STATE:
-         r = s->state;
+ static inline uint8_t save_exception_flags(CPUX86State *env)
 --
-.17.0
+.34.1

-New patch
+[PULL 30/72] target/hppa: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for HPPA, and remove the
+ifdef from pickNaNMulAdd().
+HPPA is the only target that was using the default branch of the
+ifdef ladder (other targets either do not use muladd or set
+default_nan_mode), so we can remove the ifdef fallback entirely now
+(allowing the "rule not set" case to fall into the default of the
+switch statement and assert).
+We add a TODO note that the HPPA rule is probably wrong; this is
+not a behavioural change for this refactoring.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-26-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       | 8 ++++++++
+ fpu/softfloat-specialize.c.inc | 4 ----
+files changed, 8 insertions(+), 4 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+      * HPPA does note implement a CPU reset method at all...
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /*
++     * TODO: The HPPA architecture reference only documents its NaN
++     * propagation rule for 2-operand operations. Testing on real hardware
++     * might be necessary to confirm whether this order for muladd is correct.
++     * Not preferring the SNaN is almost certainly incorrect as it diverges
++     * from the documented rules for 2-operand operations.
++     */
++    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         }
+     }
+-    if (rule == float_3nan_prop_none) {
+-        rule = float_3nan_prop_abc;
+-    }
+-
+     assert(rule != float_3nan_prop_none);
+     if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+         /* We have at least one SNaN input and should prefer it */
+--
+.34.1

-New patch
+[PULL 31/72] fpu: Remove use_first_nan field from float_status
+The use_first_nan field in float_status was an xtensa-specific way to
+select at runtime from two different NaN propagation rules.  Now that
+xtensa is using the target-agnostic NaN propagation rule selection
+that we've just added, we can remove use_first_nan, because there is
+no longer any code that reads it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-27-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-helpers.h | 5 -----
+ include/fpu/softfloat-types.h   | 1 -
+ target/xtensa/fpu_helper.c      | 1 -
+files changed, 7 deletions(-)
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-helpers.h
++++ b/include/fpu/softfloat-helpers.h
+@@ -XXX,XX +XXX,XX @@ static inline void set_snan_bit_is_one(bool val, float_status *status)
+     status->snan_bit_is_one = val;
+ }
+-static inline void set_use_first_nan(bool val, float_status *status)
+-{
+-    status->use_first_nan = val;
+-}
+-
+ static inline void set_no_signaling_nans(bool val, float_status *status)
+ {
+     status->no_signaling_nans = val;
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
+      * softfloat-specialize.inc.c)
+      */
+     bool snan_bit_is_one;
+-    bool use_first_nan;
+     bool no_signaling_nans;
+     /* should overflowed results subtract re_bias to its exponent? */
+     bool rebias_overflow;
+diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/fpu_helper.c
++++ b/target/xtensa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static const struct {
+ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
+ {
+-    set_use_first_nan(use_first, &env->fp_status);
+     set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
+                              &env->fp_status);
+     set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
+--
+.34.1

-New patch
+[PULL 32/72] target/m68k: Don't pass NULL float_status to floatx80_default_nan()
+Currently m68k_cpu_reset_hold() calls floatx80_default_nan(NULL)
+to get the NaN bit pattern to reset the FPU registers. This
+works because it happens that our implementation of
+floatx80_default_nan() doesn't actually look at the float_status
+pointer except for TARGET_MIPS. However, this isn't guaranteed,
+and to be able to remove the ifdef in floatx80_default_nan()
+we're going to need a real float_status here.
+Rearrange m68k_cpu_reset_hold() so that we initialize env->fp_status
+earlier, and thus can pass it to floatx80_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-28-peter.maydell@linaro.org
+---
+ target/m68k/cpu.c | 12 +++++++-----
+file changed, 7 insertions(+), 5 deletions(-)
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.c
++++ b/target/m68k/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+     CPUState *cs = CPU(obj);
+     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(obj);
+     CPUM68KState *env = cpu_env(cs);
+-    floatx80 nan = floatx80_default_nan(NULL);
++    floatx80 nan;
+     int i;
+     if (mcc->parent_phases.hold) {
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+ #else
+     cpu_m68k_set_sr(env, SR_S | SR_I);
+ #endif
+-    for (i = 0; i < 8; i++) {
+-        env->fregs[i].d = nan;
+-    }
+-    cpu_m68k_set_fpcr(env, 0);
+     /*
+      * M68000 FAMILY PROGRAMMER'S REFERENCE MANUAL
+      * 3.4 FLOATING-POINT INSTRUCTION DETAILS
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+      * preceding paragraph for nonsignaling NaNs.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
++
++    nan = floatx80_default_nan(&env->fp_status);
++    for (i = 0; i < 8; i++) {
++        env->fregs[i].d = nan;
++    }
++    cpu_m68k_set_fpcr(env, 0);
+     env->fpsr = 0;
+     /* TODO: We should set PC from the interrupt vector.  */
+--
+.34.1

-New patch
+[PULL 33/72] softfloat: Create floatx80 default NaN from parts64_default_nan
+We create our 128-bit default NaN by calling parts64_default_nan()
+and then adjusting the result.  We can do the same trick for creating
+the floatx80 default NaN, which lets us drop a target ifdef.
+floatx80 is used only by:
+ i386
+ m68k
+ arm nwfpe old floating-point emulation emulation support
+    (which is essentially dead, especially the parts involving floatx80)
+ PPC (only in the xsrqpxp instruction, which just rounds an input
+    value by converting to floatx80 and back, so will never generate
+    the default NaN)
+The floatx80 default NaN as currently implemented is:
+ m68k: sign = 0, exp = 1...1, int = 1, frac = 1....1
+ i386: sign = 1, exp = 1...1, int = 1, frac = 10...0
+These are the same as the parts64_default_nan for these architectures.
+This is technically a possible behaviour change for arm linux-user
+nwfpe emulation emulation, because the default NaN will now have the
+sign bit clear.  But we were already generating a different floatx80
+default NaN from the real kernel emulation we are supposedly
+following, which appears to use an all-bits-1 value:
+ https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L267
+This won't affect the only "real" use of the nwfpe emulation, which
+is ancient binaries that used it as part of the old floating point
+calling convention; that only uses loads and stores of 32 and 64 bit
+floats, not any of the floatx80 behaviour the original hardware had.
+We also get the nwfpe float64 default NaN value wrong:
+ https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L166
+so if we ever cared about this obscure corner the right fix would be
+to correct that so nwfpe used its own default-NaN setting rather
+than the Arm VFP one.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-29-peter.maydell@linaro.org
+---
+ fpu/softfloat-specialize.c.inc | 20 ++++++++++----------
+file changed, 10 insertions(+), 10 deletions(-)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts128_silence_nan(FloatParts128 *p, float_status *status)
+ floatx80 floatx80_default_nan(float_status *status)
+ {
+     floatx80 r;
++    /*
++     * Extrapolate from the choices made by parts64_default_nan to fill
++     * in the floatx80 format. We assume that floatx80's explicit
++     * integer bit is always set (this is true for i386 and m68k,
++     * which are the only real users of this format).
++     */
++    FloatParts64 p64;
++    parts64_default_nan(&p64, status);
+-    /* None of the targets that have snan_bit_is_one use floatx80.  */
+-    assert(!snan_bit_is_one(status));
+-#if defined(TARGET_M68K)
+-    r.low = UINT64_C(0xFFFFFFFFFFFFFFFF);
+-    r.high = 0x7FFF;
+-#else
+-    /* X86 */
+-    r.low = UINT64_C(0xC000000000000000);
+-    r.high = 0xFFFF;
+-#endif
++    r.high = 0x7FFF | (p64.sign << 15);
++    r.low = (1ULL << DECOMPOSED_BINARY_POINT) | p64.frac;
+     return r;
+ }
+--
+.34.1

-New patch
+[PULL 34/72] target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
+In target/loongarch's helper_fclass_s() and helper_fclass_d() we pass
+a zero-initialized float_status struct to float32_is_quiet_nan() and
+float64_is_quiet_nan(), with the cryptic comment "for
+snan_bit_is_one".
+This pattern appears to have been copied from target/riscv, where it
+is used because the functions there do not have ready access to the
+CPU state struct. The comment presumably refers to the fact that the
+main reason the is_quiet_nan() functions want the float_state is
+because they want to know about the snan_bit_is_one config.
+In the loongarch helpers, though, we have the CPU state struct
+to hand. Use the usual env->fp_status here. This avoids our needing
+to track that we need to update the initializer of the local
+float_status structs when the core softfloat code adds new
+options for targets to configure their behaviour.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-30-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 6 ++----
+file changed, 2 insertions(+), 4 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_s(CPULoongArchState *env, uint64_t fj)
+     } else if (float32_is_zero_or_denormal(f)) {
+         return sign ? 1 << 4 : 1 << 8;
+     } else if (float32_is_any_nan(f)) {
+-        float_status s = { }; /* for snan_bit_is_one */
+-        return float32_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
++        return float32_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
+     } else {
+         return sign ? 1 << 3 : 1 << 7;
+     }
+@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_d(CPULoongArchState *env, uint64_t fj)
+     } else if (float64_is_zero_or_denormal(f)) {
+         return sign ? 1 << 4 : 1 << 8;
+     } else if (float64_is_any_nan(f)) {
+-        float_status s = { }; /* for snan_bit_is_one */
+-        return float64_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
++        return float64_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
+     } else {
+         return sign ? 1 << 3 : 1 << 7;
+     }
+--
+.34.1

-New patch
+[PULL 35/72] target/m68k: In frem helper, initialize local float_status from env->fp_status
+In the frem helper, we have a local float_status because we want to
+execute the floatx80_div() with a custom rounding mode.  Instead of
+zero-initializing the local float_status and then having to set it up
+with the m68k standard behaviour (including the NaN propagation rule
+and copying the rounding precision from env->fp_status), initialize
+it as a complete copy of env->fp_status. This will avoid our having
+to add new code in this function for every new config knob we add
+to fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-31-peter.maydell@linaro.org
+---
+ target/m68k/fpu_helper.c | 6 ++----
+file changed, 2 insertions(+), 4 deletions(-)
+diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/fpu_helper.c
++++ b/target/m68k/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(frem)(CPUM68KState *env, FPReg *res, FPReg *val0, FPReg *val1)
+     fp_rem = floatx80_rem(val1->d, val0->d, &env->fp_status);
+     if (!floatx80_is_any_nan(fp_rem)) {
+-        float_status fp_status = { };
++        /* Use local temporary fp_status to set different rounding mode */
++        float_status fp_status = env->fp_status;
+         uint32_t quotient;
+         int sign;
+         /* Calculate quotient directly using round to nearest mode */
+-        set_float_2nan_prop_rule(float_2nan_prop_ab, &fp_status);
+         set_float_rounding_mode(float_round_nearest_even, &fp_status);
+-        set_floatx80_rounding_precision(
+-            get_floatx80_rounding_precision(&env->fp_status), &fp_status);
+         fp_quot.d = floatx80_div(val1->d, val0->d, &fp_status);
+         sign = extractFloatx80Sign(fp_quot.d);
+--
+.34.1

-New patch
+[PULL 36/72] target/m68k: Init local float_status from env fp_status in gdb get/set reg
+In cf_fpu_gdb_get_reg() and cf_fpu_gdb_set_reg() we do the conversion
+from float64 to floatx80 using a scratch float_status, because we
+don't want the conversion to affect the CPU's floating point exception
+status. Currently we use a zero-initialized float_status. This will
+get steadily more awkward as we add config knobs to float_status
+that the target must initialize. Avoid having to add any of that
+configuration here by instead initializing our local float_status
+from the env->fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-32-peter.maydell@linaro.org
+---
+ target/m68k/helper.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/target/m68k/helper.c b/target/m68k/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/helper.c
++++ b/target/m68k/helper.c
+@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_get_reg(CPUState *cs, GByteArray *mem_buf, int n)
+     CPUM68KState *env = &cpu->env;
+     if (n < 8) {
+-        float_status s = {};
++        /* Use scratch float_status so any exceptions don't change CPU state */
++        float_status s = env->fp_status;
+         return gdb_get_reg64(mem_buf, floatx80_to_float64(env->fregs[n].d, &s));
+     }
+     switch (n) {
+@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_set_reg(CPUState *cs, uint8_t *mem_buf, int n)
+     CPUM68KState *env = &cpu->env;
+     if (n < 8) {
+-        float_status s = {};
++        /* Use scratch float_status so any exceptions don't change CPU state */
++        float_status s = env->fp_status;
+         env->fregs[n].d = float64_to_floatx80(ldq_be_p(mem_buf), &s);
+         return 8;
+     }
+--
+.34.1

-[Qemu-devel] [PULL 05/24] hw/net/smc91c111: Convert away from old_mmio
+[PULL 37/72] target/sparc: Initialize local scratch float_status from env->fp_status
-Convert the smc91c111 device away from using the old_mmio field of
+In the helper functions flcmps and flcmpd we use a scratch float_status
-MemoryRegionOps. This device is used by several Arm board models.
+so that we don't change the CPU state if the comparison raises any
 floating point exception flags. Instead of zero-initializing this
 scratch float_status, initialize it as a copy of env->fp_status. This
 avoids the need to explicitly initialize settings like the NaN
 propagation rule or others we might add to softfloat in future.
 To do this we need to pass the CPU env pointer in to the helper.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180427173611.10281-3-peter.maydell@linaro.org
+Message-id: 20241202131347.498124-33-peter.maydell@linaro.org
 ---
- hw/net/smc91c111.c | 54 +++++++++++++++++++++-------------------------
+ target/sparc/helper.h     | 4 ++--
-file changed, 25 insertions(+), 29 deletions(-)
+ target/sparc/fop_helper.c | 8 ++++----
  target/sparc/translate.c  | 4 ++--
 files changed, 8 insertions(+), 8 deletions(-)
-diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
+diff --git a/target/sparc/helper.h b/target/sparc/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/smc91c111.c
+--- a/target/sparc/helper.h
-+++ b/hw/net/smc91c111.c
++++ b/target/sparc/helper.h
-@@ -XXX,XX +XXX,XX @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fcmpd, TCG_CALL_NO_WG, i32, env, f64, f64)
-     return 0;
+ DEF_HELPER_FLAGS_3(fcmped, TCG_CALL_NO_WG, i32, env, f64, f64)
  DEF_HELPER_FLAGS_3(fcmpq, TCG_CALL_NO_WG, i32, env, i128, i128)
  DEF_HELPER_FLAGS_3(fcmpeq, TCG_CALL_NO_WG, i32, env, i128, i128)
 -DEF_HELPER_FLAGS_2(flcmps, TCG_CALL_NO_RWG_SE, i32, f32, f32)
 -DEF_HELPER_FLAGS_2(flcmpd, TCG_CALL_NO_RWG_SE, i32, f64, f64)
 +DEF_HELPER_FLAGS_3(flcmps, TCG_CALL_NO_RWG_SE, i32, env, f32, f32)
 +DEF_HELPER_FLAGS_3(flcmpd, TCG_CALL_NO_RWG_SE, i32, env, f64, f64)
  DEF_HELPER_2(raise_exception, noreturn, env, int)
  DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
 diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/fop_helper.c
 +++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t helper_fcmpeq(CPUSPARCState *env, Int128 src1, Int128 src2)
      return finish_fcmp(env, r, GETPC());
  }
--static void smc91c111_writew(void *opaque, hwaddr offset,
+-uint32_t helper_flcmps(float32 src1, float32 src2)
--                             uint32_t value)
++uint32_t helper_flcmps(CPUSPARCState *env, float32 src1, float32 src2)
 +static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
  {
--    smc91c111_writeb(opaque, offset, value & 0xff);
+     /*
--    smc91c111_writeb(opaque, offset + 1, value >> 8);
+      * FLCMP never raises an exception nor modifies any FSR fields.
-+    int i;
+      * Perform the comparison with a dummy fp environment.
-+    uint32_t val = 0;
+      */
-+
+-    float_status discard = { };
-+    for (i = 0; i < size; i++) {
++    float_status discard = env->fp_status;
-+        val |= smc91c111_readb(opaque, addr + i) << (i * 8);
+     FloatRelation r;
-+    }
-+    return val;
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
@@ -XXX,XX +XXX,XX @@ uint32_t helper_flcmps(float32 src1, float32 src2)
      g_assert_not_reached();
  }
--static void smc91c111_writel(void *opaque, hwaddr offset,
+-uint32_t helper_flcmpd(float64 src1, float64 src2)
--                             uint32_t value)
++uint32_t helper_flcmpd(CPUSPARCState *env, float64 src1, float64 src2)
 +static void smc91c111_writefn(void *opaque, hwaddr addr,
 +                               uint64_t value, unsigned size)
  {
-+    int i = 0;
+-    float_status discard = { };
-+
++    float_status discard = env->fp_status;
-     /* 32-bit writes to offset 0xc only actually write to the bank select
+     FloatRelation r;
--       register (offset 0xe)  */
--    if (offset != 0xc)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
--        smc91c111_writew(opaque, offset, value & 0xffff);
+diff --git a/target/sparc/translate.c b/target/sparc/translate.c
--    smc91c111_writew(opaque, offset + 2, value >> 16);
+index XXXXXXX..XXXXXXX 100644
--}
+--- a/target/sparc/translate.c
-+     * register (offset 0xe), so skip the first two bytes we would write.
++++ b/target/sparc/translate.c
-+     */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPs(DisasContext *dc, arg_FLCMPs *a)
-+    if (addr == 0xc && size == 4) {
-+        i += 2;
+     src1 = gen_load_fpr_F(dc, a->rs1);
-+    }
+     src2 = gen_load_fpr_F(dc, a->rs2);
+-    gen_helper_flcmps(cpu_fcc[a->cc], src1, src2);
--static uint32_t smc91c111_readw(void *opaque, hwaddr offset)
++    gen_helper_flcmps(cpu_fcc[a->cc], tcg_env, src1, src2);
--{
+     return advance_pc(dc);
 -    uint32_t val;
 -    val = smc91c111_readb(opaque, offset);
 -    val |= smc91c111_readb(opaque, offset + 1) << 8;
 -    return val;
 -}
 -
 -static uint32_t smc91c111_readl(void *opaque, hwaddr offset)
 -{
 -    uint32_t val;
 -    val = smc91c111_readw(opaque, offset);
 -    val |= smc91c111_readw(opaque, offset + 2) << 16;
 -    return val;
 +    for (; i < size; i++) {
 +        smc91c111_writeb(opaque, addr + i,
 +                         extract32(value, i * 8, 8));
 +    }
  }
- static int smc91c111_can_receive_nc(NetClientState *nc)
+@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPd(DisasContext *dc, arg_FLCMPd *a)
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps smc91c111_mem_ops = {
-     /* The special case for 32 bit writes to 0xc means we can't just
+     src1 = gen_load_fpr_D(dc, a->rs1);
-      * set .impl.min/max_access_size to 1, unfortunately
+     src2 = gen_load_fpr_D(dc, a->rs2);
-      */
+-    gen_helper_flcmpd(cpu_fcc[a->cc], src1, src2);
--    .old_mmio = {
++    gen_helper_flcmpd(cpu_fcc[a->cc], tcg_env, src1, src2);
--        .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },
+     return advance_pc(dc);
--        .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },
+ }
 -    },
 +    .read = smc91c111_readfn,
 +    .write = smc91c111_writefn,
 +    .valid.min_access_size = 1,
 +    .valid.max_access_size = 4,
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 --
-.17.0
+.34.1

-New patch
+[PULL 38/72] target/ppc: Use env->fp_status in helper_compute_fprf functions
+In the helper_compute_fprf functions, we pass a dummy float_status
+in to the is_signaling_nan() function. This is unnecessary, because
+we have convenient access to the CPU env pointer here and that
+is already set up with the correct values for the snan_bit_is_one
+and no_signaling_nans config settings. is_signaling_nan() doesn't
+ever update the fp_status with any exception flags, so there is
+no reason not to use env->fp_status here.
+Use env->fp_status instead of the dummy fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-34-peter.maydell@linaro.org
+---
+ target/ppc/fpu_helper.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/fpu_helper.c
++++ b/target/ppc/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void helper_compute_fprf_##tp(CPUPPCState *env, tp arg)           \
+     } else if (tp##_is_infinity(arg)) {                           \
+         fprf = neg ? 0x09 << FPSCR_FPRF : 0x05 << FPSCR_FPRF;     \
+     } else {                                                      \
+-        float_status dummy = { };  /* snan_bit_is_one = 0 */      \
+-        if (tp##_is_signaling_nan(arg, &dummy)) {                 \
++        if (tp##_is_signaling_nan(arg, &env->fp_status)) {        \
+             fprf = 0x00 << FPSCR_FPRF;                            \
+         } else {                                                  \
+             fprf = 0x11 << FPSCR_FPRF;                            \
+--
+.34.1

-[Qemu-devel] [PULL 08/24] target/arm: Tidy condition in disas_simd_two_reg_misc
+[PULL 39/72] target/arm: Copy entire float_status in is_ebf
 From: Richard Henderson <richard.henderson@linaro.org>
-Path analysis shows that size == 3 && !is_q has been eliminated.
+Now that float_status has a bunch of fp parameters,
 it is easier to copy an existing structure than create
 one from scratch.  Begin by copying the structure that
 corresponds to the FPSR and make only the adjustments
 required for BFloat16 semantics.
-Fixes: Coverity CID1385853
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20180501180455.11214-3-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20241203203949.483774-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 6 +++++-
+ target/arm/tcg/vec_helper.c | 20 +++++++-------------
-file changed, 5 insertions(+), 1 deletion(-)
+file changed, 7 insertions(+), 13 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/tcg/vec_helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/tcg/vec_helper.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
-         /* All 64-bit element operations can be shared with scalar 2misc */
+      * no effect on AArch32 instructions.
-         int pass;
+      */
+     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
--        for (pass = 0; pass < (is_q ? 2 : 1); pass++) {
+-    *statusp = (float_status){
-+        /* Coverity claims (size == 3 && !is_q) has been eliminated
+-        .tininess_before_rounding = float_tininess_before_rounding,
-+         * from all paths leading to here.
+-        .float_rounding_mode = float_round_to_odd_inf,
-+         */
+-        .flush_to_zero = true,
-+        tcg_debug_assert(is_q);
+-        .flush_inputs_to_zero = true,
-+        for (pass = 0; pass < 2; pass++) {
+-        .default_nan_mode = true,
-             TCGv_i64 tcg_op = tcg_temp_new_i64();
+-    };
-             TCGv_i64 tcg_res = tcg_temp_new_i64();
++
 +    *statusp = env->vfp.fp_status;
 +    set_default_nan_mode(true, statusp);
      if (ebf) {
 -        float_status *fpst = &env->vfp.fp_status;
 -        set_flush_to_zero(get_flush_to_zero(fpst), statusp);
 -        set_flush_inputs_to_zero(get_flush_inputs_to_zero(fpst), statusp);
 -        set_float_rounding_mode(get_float_rounding_mode(fpst), statusp);
 -
          /* EBF=1 needs to do a step with round-to-odd semantics */
          *oddstatusp = *statusp;
          set_float_rounding_mode(float_round_to_odd, oddstatusp);
 +    } else {
 +        set_flush_to_zero(true, statusp);
 +        set_flush_inputs_to_zero(true, statusp);
 +        set_float_rounding_mode(float_round_to_odd_inf, statusp);
      }
 -
      return ebf;
  }
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 04/24] hw/usb/tusb6010: Convert away from old_mmio
+[PULL 40/72] fpu: Allow runtime choice of default NaN value
-Convert the tusb6010 device away from using the old_mmio field
+Currently we hardcode the default NaN value in parts64_default_nan()
-of MemoryRegionOps. This device is used only in the n800 and n810
+using a compile-time ifdef ladder. This is awkward for two cases:
-boards.
+ * for single-QEMU-binary we can't hard-code target-specifics like this
  * for Arm FEAT_AFP the default NaN value depends on FPCR.AH
    (specifically the sign bit is different)
 Add a field to float_status to specify the default NaN value; fall
 back to the old ifdef behaviour if these are not set.
 The default NaN value is specified by setting a uint8_t to a
 pattern corresponding to the sign and upper fraction parts of
 the NaN; the lower bits of the fraction are set from bit 0 of
 the pattern.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180427173611.10281-2-peter.maydell@linaro.org
+Message-id: 20241202131347.498124-35-peter.maydell@linaro.org
 ---
- hw/usb/tusb6010.c | 40 ++++++++++++++++++++++++++++++++++++----
+ include/fpu/softfloat-helpers.h | 11 +++++++
-file changed, 36 insertions(+), 4 deletions(-)
+ include/fpu/softfloat-types.h   | 10 ++++++
  fpu/softfloat-specialize.c.inc  | 55 ++++++++++++++++++++-------------
 files changed, 54 insertions(+), 22 deletions(-)
-diff --git a/hw/usb/tusb6010.c b/hw/usb/tusb6010.c
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/usb/tusb6010.c
+--- a/include/fpu/softfloat-helpers.h
-+++ b/hw/usb/tusb6010.c
++++ b/include/fpu/softfloat-helpers.h
-@@ -XXX,XX +XXX,XX @@ static void tusb_async_writew(void *opaque, hwaddr addr,
+@@ -XXX,XX +XXX,XX @@ static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
-     }
+     status->float_infzeronan_rule = rule;
  }
-+static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)
++static inline void set_float_default_nan_pattern(uint8_t dnan_pattern,
 +                                                 float_status *status)
 +{
-+    switch (size) {
++    status->default_nan_pattern = dnan_pattern;
 +    case 1:
 +        return tusb_async_readb(opaque, addr);
 +    case 2:
 +        return tusb_async_readh(opaque, addr);
 +    case 4:
 +        return tusb_async_readw(opaque, addr);
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
-+static void tusb_async_writefn(void *opaque, hwaddr addr,
+ static inline void set_flush_to_zero(bool val, float_status *status)
-+                               uint64_t value, unsigned size)
+ {
      status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status
      return status->float_infzeronan_rule;
  }
 +static inline uint8_t get_float_default_nan_pattern(float_status *status)
 +{
-+    switch (size) {
++    return status->default_nan_pattern;
 +    case 1:
 +        tusb_async_writeb(opaque, addr, value);
 +        break;
 +    case 2:
 +        tusb_async_writeh(opaque, addr, value);
 +        break;
 +    case 4:
 +        tusb_async_writew(opaque, addr, value);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
- static const MemoryRegionOps tusb_async_ops = {
+ static inline bool get_flush_to_zero(float_status *status)
--    .old_mmio = {
+ {
--        .read = { tusb_async_readb, tusb_async_readh, tusb_async_readw, },
+     return status->flush_to_zero;
--        .write =  { tusb_async_writeb, tusb_async_writeh, tusb_async_writew, },
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
--    },
+index XXXXXXX..XXXXXXX 100644
-+    .read = tusb_async_readfn,
+--- a/include/fpu/softfloat-types.h
-+    .write = tusb_async_writefn,
++++ b/include/fpu/softfloat-types.h
-+    .valid.min_access_size = 1,
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
-+    .valid.max_access_size = 4,
+     /* should denormalised inputs go to zero and set the input_denormal flag? */
-     .endianness = DEVICE_NATIVE_ENDIAN,
+     bool flush_inputs_to_zero;
- };
+     bool default_nan_mode;
++    /*
 +     * The pattern to use for the default NaN. Here the high bit specifies
 +     * the default NaN's sign bit, and bits 6..0 specify the high bits of the
 +     * fractional part. The low bits of the fractional part are copies of bit 0.
 +     * The exponent of the default NaN is (as for any NaN) always all 1s.
 +     * Note that a value of 0 here is not a valid NaN. The target must set
 +     * this to the correct non-zero value, or we will assert when trying to
 +     * create a default NaN.
 +     */
 +    uint8_t default_nan_pattern;
      /*
       * The flags below are not used on all specializations and may
       * constant fold away (see snan_bit_is_one()/no_signalling_nans() in
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
  {
      bool sign = 0;
      uint64_t frac;
 +    uint8_t dnan_pattern = status->default_nan_pattern;
 +    if (dnan_pattern == 0) {
  #if defined(TARGET_SPARC) || defined(TARGET_M68K)
 -    /* !snan_bit_is_one, set all bits */
 -    frac = (1ULL << DECOMPOSED_BINARY_POINT) - 1;
 -#elif defined(TARGET_I386) || defined(TARGET_X86_64) \
 +        /* Sign bit clear, all frac bits set */
 +        dnan_pattern = 0b01111111;
 +#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
      || defined(TARGET_MICROBLAZE)
 -    /* !snan_bit_is_one, set sign and msb */
 -    frac = 1ULL << (DECOMPOSED_BINARY_POINT - 1);
 -    sign = 1;
 +        /* Sign bit set, most significant frac bit set */
 +        dnan_pattern = 0b11000000;
  #elif defined(TARGET_HPPA)
 -    /* snan_bit_is_one, set msb-1.  */
 -    frac = 1ULL << (DECOMPOSED_BINARY_POINT - 2);
 +        /* Sign bit clear, msb-1 frac bit set */
 +        dnan_pattern = 0b00100000;
  #elif defined(TARGET_HEXAGON)
 -    sign = 1;
 -    frac = ~0ULL;
 +        /* Sign bit set, all frac bits set. */
 +        dnan_pattern = 0b11111111;
  #else
 -    /*
 -     * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
 -     * S390, SH4, TriCore, and Xtensa.  Our other supported targets
 -     * do not have floating-point.
 -     */
 -    if (snan_bit_is_one(status)) {
 -        /* set all bits other than msb */
 -        frac = (1ULL << (DECOMPOSED_BINARY_POINT - 1)) - 1;
 -    } else {
 -        /* set msb */
 -        frac = 1ULL << (DECOMPOSED_BINARY_POINT - 1);
 -    }
 +        /*
 +         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
 +         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
 +         * do not have floating-point.
 +         */
 +        if (snan_bit_is_one(status)) {
 +            /* sign bit clear, set all frac bits other than msb */
 +            dnan_pattern = 0b00111111;
 +        } else {
 +            /* sign bit clear, set frac msb */
 +            dnan_pattern = 0b01000000;
 +        }
  #endif
 +    }
 +    assert(dnan_pattern != 0);
 +
 +    sign = dnan_pattern >> 7;
 +    /*
 +     * Place default_nan_pattern [6:0] into bits [62:56],
 +     * and replecate bit [0] down into [55:0]
 +     */
 +    frac = deposit64(0, DECOMPOSED_BINARY_POINT - 7, 7, dnan_pattern);
 +    frac = deposit64(frac, 0, DECOMPOSED_BINARY_POINT - 7, -(dnan_pattern & 1));
      *p = (FloatParts64) {
          .cls = float_class_qnan,
 --
-.17.0
+.34.1

-New patch
+[PULL 41/72] tests/fp: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for the tests/fp code.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-36-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c     | 1 +
+ tests/fp/fp-test-log2.c | 1 +
+ tests/fp/fp-test.c      | 1 +
+files changed, 3 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
++    set_float_default_nan_pattern(0b01000000, &soft_status);
+     f = bench_funcs[operation][precision];
+     g_assert(f);
+diff --git a/tests/fp/fp-test-log2.c b/tests/fp/fp-test-log2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test-log2.c
++++ b/tests/fp/fp-test-log2.c
+@@ -XXX,XX +XXX,XX @@ int main(int ac, char **av)
+     int i;
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_default_nan_pattern(0b01000000, &qsf);
+     set_float_rounding_mode(float_round_nearest_even, &qsf);
+     test.d = 0.0;
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
++    set_float_default_nan_pattern(0b01000000, &qsf);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+--
+.34.1

-New patch
+[PULL 42/72] target/microblaze: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-37-peter.maydell@linaro.org
+---
+ target/microblaze/cpu.c        | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 +--
+files changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/cpu.c
++++ b/target/microblaze/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_reset_hold(Object *obj, ResetType type)
+      * this architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN: sign bit set, most significant frac bit set */
++    set_float_default_nan_pattern(0b11000000, &env->fp_status);
+ #if defined(CONFIG_USER_ONLY)
+     /* start in user mode with interrupts enabled.  */
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
+-    || defined(TARGET_MICROBLAZE)
++#elif defined(TARGET_I386) || defined(TARGET_X86_64)
+         /* Sign bit set, most significant frac bit set */
+         dnan_pattern = 0b11000000;
+ #elif defined(TARGET_HPPA)
+--
+.34.1

-New patch
+[PULL 43/72] target/i386: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-38-peter.maydell@linaro.org
+---
+ target/i386/tcg/fpu_helper.c   | 4 ++++
+ fpu/softfloat-specialize.c.inc | 3 ---
+files changed, 4 insertions(+), 3 deletions(-)
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
+     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
++    /* Default NaN: sign bit set, most significant frac bit set */
++    set_float_default_nan_pattern(0b11000000, &env->fp_status);
++    set_float_default_nan_pattern(0b11000000, &env->mmx_status);
++    set_float_default_nan_pattern(0b11000000, &env->sse_status);
+ }
+ static inline uint8_t save_exception_flags(CPUX86State *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_I386) || defined(TARGET_X86_64)
+-        /* Sign bit set, most significant frac bit set */
+-        dnan_pattern = 0b11000000;
+ #elif defined(TARGET_HPPA)
+         /* Sign bit clear, msb-1 frac bit set */
+         dnan_pattern = 0b00100000;
+--
+.34.1

-New patch
+[PULL 44/72] target/hppa: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-39-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 ---
+files changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    /* Default NaN: sign bit clear, msb-1 frac bit set */
++    set_float_default_nan_pattern(0b00100000, &env->fp_status);
+ }
+ void cpu_hppa_loaded_fr0(CPUHPPAState *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_HPPA)
+-        /* Sign bit clear, msb-1 frac bit set */
+-        dnan_pattern = 0b00100000;
+ #elif defined(TARGET_HEXAGON)
+         /* Sign bit set, all frac bits set. */
+         dnan_pattern = 0b11111111;
+--
+.34.1

-New patch
+[PULL 45/72] target/alpha: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for the alpha target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-40-peter.maydell@linaro.org
+---
+ target/alpha/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/cpu.c
++++ b/target/alpha/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
+      * operand in Fa. That is float_2nan_prop_ba.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN: sign bit clear, msb frac bit set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ #if defined(CONFIG_USER_ONLY)
+     env->flags = ENV_FLAG_PS_USER | ENV_FLAG_FEN;
+     cpu_alpha_store_fpcr(env, (uint64_t)(FPCR_INVD | FPCR_DZED | FPCR_OVFD
+--
+.34.1

-[Qemu-devel] [PULL 20/24] hw/arm/smmuv3: Abort on vfio or vhost case
+[PULL 46/72] target/arm: Set default NaN pattern explicitly
-From: Eric Auger <eric.auger@redhat.com>
+Set the default NaN pattern explicitly for the arm target.
 This includes setting it for the old linux-user nwfpe emulation.
 For nwfpe, our default doesn't match the real kernel, but we
 avoid making a behaviour change in this commit.
-At the moment, the SMMUv3 does not support notification on
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-TLB invalidation. So let's log an error as soon as such notifier
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-gets enabled.
+Message-id: 20241202131347.498124-41-peter.maydell@linaro.org
 ---
  linux-user/arm/nwfpe/fpa11.c | 5 +++++
  target/arm/cpu.c             | 2 ++
 files changed, 7 insertions(+)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-11-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmuv3.c | 11 +++++++++++
 file changed, 11 insertions(+)
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/linux-user/arm/nwfpe/fpa11.c
-+++ b/hw/arm/smmuv3.c
++++ b/linux-user/arm/nwfpe/fpa11.c
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
+@@ -XXX,XX +XXX,XX @@ void resetFPA11(void)
-     dc->realize = smmu_realize;
+    * this late date.
     */
    set_float_2nan_prop_rule(float_2nan_prop_s_ab, &fpa11->fp_status);
 +  /*
 +   * Use the same default NaN value as Arm VFP. This doesn't match
 +   * the Linux kernel's nwfpe emulation, which uses an all-1s value.
 +   */
 +  set_float_default_nan_pattern(0b01000000, &fpa11->fp_status);
  }
-+static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
+ void SetRoundingMode(const unsigned int opcode)
-+                                       IOMMUNotifierFlag old,
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+                                       IOMMUNotifierFlag new)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/target/arm/cpu.c
-+    if (old == IOMMU_NOTIFIER_NONE) {
++++ b/target/arm/cpu.c
-+        warn_report("SMMUV3 does not support vhost/vfio integration yet: "
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
-+                    "devices of those types will not function properly");
+  *    the pseudocode function the arguments are in the order c, a, b.
-+    }
+  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
-+}
+  *    and the input NaN if it is signalling
-+
++ *  * Default NaN has sign bit clear, msb frac bit set
- static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
+  */
-                                                   void *data)
+ static void arm_set_default_fp_behaviours(float_status *s)
  {
-     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
-     imrc->translate = smmuv3_translate;
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
-+    imrc->notify_flag_changed = smmuv3_notify_flag_changed;
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 +    set_float_default_nan_pattern(0b01000000, s);
  }
- static const TypeInfo smmuv3_type_info = {
+ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
 --
-.17.0
+.34.1

-New patch
+[PULL 47/72] target/loongarch: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for loongarch.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-42-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
++    /* Default NaN: sign bit clear, msb frac bit set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+--
+.34.1

-New patch
+[PULL 48/72] target/m68k: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for m68k.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-43-peter.maydell@linaro.org
+---
+ target/m68k/cpu.c              | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.c
++++ b/target/m68k/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+      * preceding paragraph for nonsignaling NaNs.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
++    /* Default NaN: sign bit clear, all frac bits set */
++    set_float_default_nan_pattern(0b01111111, &env->fp_status);
+     nan = floatx80_default_nan(&env->fp_status);
+     for (i = 0; i < 8; i++) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_SPARC) || defined(TARGET_M68K)
++#if defined(TARGET_SPARC)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+ #elif defined(TARGET_HEXAGON)
+--
+.34.1

-[Qemu-devel] [PULL 24/24] hw/arm/virt: Introduce the iommu option
+[PULL 49/72] target/mips: Set default NaN pattern explicitly
-From: Eric Auger <eric.auger@redhat.com>
+Set the default NaN pattern explicitly for MIPS. Note that this
 is our only target which currently changes the default NaN
 at runtime (which it was previously doing indirectly when it
 changed the snan_bit_is_one setting).
-ARM virt machine now exposes a new "iommu" option.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-The SMMUv3 IOMMU is instantiated using -machine virt,iommu=smmuv3.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20241202131347.498124-44-peter.maydell@linaro.org
 ---
  target/mips/fpu_helper.h | 7 +++++++
  target/mips/msa.c        | 3 +++
 files changed, 10 insertions(+)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-15-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/virt.c | 36 ++++++++++++++++++++++++++++++++++++
 file changed, 36 insertions(+)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/target/mips/fpu_helper.h
-+++ b/hw/arm/virt.c
++++ b/target/mips/fpu_helper.h
-@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
-     }
+     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
      nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
      set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
 +    /*
 +     * With nan2008, the default NaN value has the sign bit clear and the
 +     * frac msb set; with the older mode, the sign bit is clear, and all
 +     * frac bits except the msb are set.
 +     */
 +    set_float_default_nan_pattern(nan2008 ? 0b01000000 : 0b00111111,
 +                                  &env->active_fpu.fp_status);
  }
-+static char *virt_get_iommu(Object *obj, Error **errp)
+diff --git a/target/mips/msa.c b/target/mips/msa.c
-+{
+index XXXXXXX..XXXXXXX 100644
-+    VirtMachineState *vms = VIRT_MACHINE(obj);
+--- a/target/mips/msa.c
-+
++++ b/target/mips/msa.c
-+    switch (vms->iommu) {
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
-+    case VIRT_IOMMU_NONE:
+     /* Inf * 0 + NaN returns the input NaN */
-+        return g_strdup("none");
+     set_float_infzeronan_rule(float_infzeronan_dnan_never,
-+    case VIRT_IOMMU_SMMUV3:
+                               &env->active_tc.msa_fp_status);
-+        return g_strdup("smmuv3");
++    /* Default NaN: sign bit clear, frac msb set */
-+    default:
++    set_float_default_nan_pattern(0b01000000,
-+        g_assert_not_reached();
++                                  &env->active_tc.msa_fp_status);
 +    }
 +}
 +
 +static void virt_set_iommu(Object *obj, const char *value, Error **errp)
 +{
 +    VirtMachineState *vms = VIRT_MACHINE(obj);
 +
 +    if (!strcmp(value, "smmuv3")) {
 +        vms->iommu = VIRT_IOMMU_SMMUV3;
 +    } else if (!strcmp(value, "none")) {
 +        vms->iommu = VIRT_IOMMU_NONE;
 +    } else {
 +        error_setg(errp, "Invalid iommu value");
 +        error_append_hint(errp, "Valid values are none, smmuv3.\n");
 +    }
 +}
 +
  static CpuInstanceProperties
  virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
  {
@@ -XXX,XX +XXX,XX @@ static void virt_2_12_instance_init(Object *obj)
                                          NULL);
      }
 +    /* Default disallows iommu instantiation */
 +    vms->iommu = VIRT_IOMMU_NONE;
 +    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu, NULL);
 +    object_property_set_description(obj, "iommu",
 +                                    "Set the IOMMU type. "
 +                                    "Valid values are none and smmuv3",
 +                                    NULL);
 +
      vms->memmap = a15memmap;
      vms->irqmap = a15irqmap;
  }
 --
-.17.0
+.34.1

-New patch
+[PULL 50/72] target/openrisc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for openrisc.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-45-peter.maydell@linaro.org
+---
+ target/openrisc/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/openrisc/cpu.c
++++ b/target/openrisc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &cpu->env.fp_status);
++    /* Default NaN: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &cpu->env.fp_status);
+ #ifndef CONFIG_USER_ONLY
+     cpu->env.picmr = 0x00000000;
+--
+.34.1

-New patch
+[PULL 51/72] target/ppc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for ppc.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-46-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
++    /* Default NaN: sign bit clear, set frac msb */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
++    set_float_default_nan_pattern(0b01000000, &env->vec_status);
++
+     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
+         ppc_spr_t *spr = &env->spr_cb[i];
+--
+.34.1

-New patch
+[PULL 52/72] target/sh4: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for sh4. Note that sh4
+is one of the only three targets (the others being HPPA and
+sometimes MIPS) that has snan_bit_is_one set.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-47-peter.maydell@linaro.org
+---
+ target/sh4/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/cpu.c
++++ b/target/sh4/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_reset_hold(Object *obj, ResetType type)
+     set_flush_to_zero(1, &env->fp_status);
+ #endif
+     set_default_nan_mode(1, &env->fp_status);
++    /* sign bit clear, set all frac bits other than msb */
++    set_float_default_nan_pattern(0b00111111, &env->fp_status);
+ }
+ static void superh_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
+--
+.34.1

-New patch
+[PULL 53/72] target/rx: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for rx.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-48-peter.maydell@linaro.org
+---
+ target/rx/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/cpu.c
++++ b/target/rx/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_reset_hold(Object *obj, ResetType type)
+      * then prefer dest over source", which is float_2nan_prop_s_ab.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN value: sign bit clear, set frac msb */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ static ObjectClass *rx_cpu_class_by_name(const char *cpu_model)
+--
+.34.1

-New patch
+[PULL 54/72] target/s390x: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for s390x.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-49-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
+         set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                   &env->fpu_status);
++        /* Default NaN value: sign bit clear, frac msb set */
++        set_float_default_nan_pattern(0b01000000, &env->fpu_status);
+        /* fall through */
+     case RESET_TYPE_S390_CPU_NORMAL:
+         env->psw.mask &= ~PSW_MASK_RI;
+--
+.34.1

-New patch
+[PULL 55/72] target/sparc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for SPARC, and remove
+the ifdef from parts64_default_nan.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-50-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 5 +----
+files changed, 3 insertions(+), 4 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+     set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    /* Default NaN value: sign bit clear, all frac bits set */
++    set_float_default_nan_pattern(0b01111111, &env->fp_status);
+     cpu_exec_realizefn(cs, &local_err);
+     if (local_err != NULL) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_SPARC)
+-        /* Sign bit clear, all frac bits set */
+-        dnan_pattern = 0b01111111;
+-#elif defined(TARGET_HEXAGON)
++#if defined(TARGET_HEXAGON)
+         /* Sign bit set, all frac bits set. */
+         dnan_pattern = 0b11111111;
+ #else
+--
+.34.1

-New patch
+[PULL 56/72] target/xtensa: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for xtensa.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-51-peter.maydell@linaro.org
+---
+ target/xtensa/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/cpu.c
++++ b/target/xtensa/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_no_signaling_nans(!dfpu, &env->fp_status);
++    /* Default NaN value: sign bit clear, set frac msb */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+     xtensa_use_first_nan(env, !dfpu);
+ }
+--
+.34.1

-New patch
+[PULL 57/72] target/hexagon: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for hexagon.
+Remove the ifdef from parts64_default_nan(); the only
+remaining unconverted targets all use the default case.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-52-peter.maydell@linaro.org
+---
+ target/hexagon/cpu.c           | 2 ++
+ fpu/softfloat-specialize.c.inc | 5 -----
+files changed, 2 insertions(+), 5 deletions(-)
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/cpu.c
++++ b/target/hexagon/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_reset_hold(Object *obj, ResetType type)
+     set_default_nan_mode(1, &env->fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
++    /* Default NaN value: sign bit set, all frac bits set */
++    set_float_default_nan_pattern(0b11111111, &env->fp_status);
+ }
+ static void hexagon_cpu_disas_set_info(CPUState *s, disassemble_info *info)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_HEXAGON)
+-        /* Sign bit set, all frac bits set. */
+-        dnan_pattern = 0b11111111;
+-#else
+         /*
+          * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
+          * S390, SH4, TriCore, and Xtensa.  Our other supported targets
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+             /* sign bit clear, set frac msb */
+             dnan_pattern = 0b01000000;
+         }
+-#endif
+     }
+     assert(dnan_pattern != 0);
+--
+.34.1

-New patch
+[PULL 58/72] target/riscv: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for riscv.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-53-peter.maydell@linaro.org
+---
+ target/riscv/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
+     cs->exception_index = RISCV_EXCP_NONE;
+     env->load_res = -1;
+     set_default_nan_mode(1, &env->fp_status);
++    /* Default NaN value: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+     env->vill = true;
+ #ifndef CONFIG_USER_ONLY
+--
+.34.1

-New patch
+[PULL 59/72] target/tricore: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for tricore.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-54-peter.maydell@linaro.org
+---
+ target/tricore/helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/tricore/helper.c b/target/tricore/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/helper.c
++++ b/target/tricore/helper.c
+@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env)
+     set_flush_to_zero(1, &env->fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
+     set_default_nan_mode(1, &env->fp_status);
++    /* Default NaN pattern: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ uint32_t psw_read(CPUTriCoreState *env)
+--
+.34.1

-[Qemu-devel] [PULL 10/24] target/arm: Implement v8M VLLDM and VLSTM
+[PULL 60/72] fpu: Remove default handling for dnan_pattern
-For v8M the instructions VLLDM and VLSTM support lazy saving
+Now that all our targets have bene converted to explicitly specify
-and restoring of the secure floating-point registers. Even
+their pattern for the default NaN value we can remove the remaining
-if the floating point extension is not implemented, these
+fallback code in parts64_default_nan().
 instructions must act as NOPs in Secure state, so they can
 be used as part of the secure-to-nonsecure call sequence.
-Fixes: https://bugs.launchpad.net/qemu/+bug/1768295
-Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180503105730.5958-1-peter.maydell@linaro.org
+Message-id: 20241202131347.498124-55-peter.maydell@linaro.org
 ---
- target/arm/translate.c | 17 ++++++++++++++++-
+ fpu/softfloat-specialize.c.inc | 14 --------------
-file changed, 16 insertions(+), 1 deletion(-)
+file changed, 14 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/target/arm/translate.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
-         /* Coprocessor.  */
+     uint64_t frac;
-         if (arm_dc_feature(s, ARM_FEATURE_M)) {
+     uint8_t dnan_pattern = status->default_nan_pattern;
-             /* We don't currently implement M profile FP support,
--             * so this entire space should give a NOCP fault.
+-    if (dnan_pattern == 0) {
-+             * so this entire space should give a NOCP fault, with
+-        /*
-+             * the exception of the v8M VLLDM and VLSTM insns, which
+-         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
-+             * must be NOPs in Secure state and UNDEF in Nonsecure state.
+-         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
-              */
+-         * do not have floating-point.
-+            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
+-         */
-+                (insn & 0xffa00f00) == 0xec200a00) {
+-        if (snan_bit_is_one(status)) {
-+                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
+-            /* sign bit clear, set all frac bits other than msb */
-+                 *  - VLLDM, VLSTM
+-            dnan_pattern = 0b00111111;
-+                 * We choose to UNDEF if the RAZ bits are non-zero.
+-        } else {
-+                 */
+-            /* sign bit clear, set frac msb */
-+                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+-            dnan_pattern = 0b01000000;
-+                    goto illegal_op;
+-        }
-+                }
+-    }
-+                /* Just NOP since FP support is not implemented */
+     assert(dnan_pattern != 0);
-+                break;
-+            }
+     sign = dnan_pattern >> 7;
 +            /* All other insns: NOCP */
              gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
                                 default_exception_el(s));
              break;
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 19/24] hw/arm/smmuv3: Implement translate callback
+[PULL 61/72] softfloat: Inline pickNaNMulAdd
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch implements the IOMMU Memory Region translate()
+Inline pickNaNMulAdd into its only caller.  This makes
-callback. Most of the code relates to the translation
+one assert redundant with the immediately preceding IF.
 configuration decoding and check (STE, CD).
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 1524665762-31355-10-git-send-email-eric.auger@redhat.com
+Message-id: 20241203203949.483774-3-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: keep comment from old code in new location]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h | 160 +++++++++++++++++
+ fpu/softfloat-parts.c.inc      | 41 +++++++++++++++++++++++++-
- hw/arm/smmuv3.c          | 358 +++++++++++++++++++++++++++++++++++++++
+ fpu/softfloat-specialize.c.inc | 54 ----------------------------------
- hw/arm/trace-events      |   9 +
+files changed, 40 insertions(+), 55 deletions(-)
 files changed, 527 insertions(+)
-diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/hw/arm/smmuv3-internal.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+     }
- void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
+     if (s->default_nan_mode) {
-+/* Configuration Data */
++        /*
-+
++         * We guarantee not to require the target to tell us how to
-+/* STE Level 1 Descriptor */
++         * pick a NaN if we're always returning the default NaN.
-+typedef struct STEDesc {
++         * But if we're not in default-NaN mode then the target must
-+    uint32_t word[2];
++         * specify.
-+} STEDesc;
++         */
-+
+         which = 3;
-+/* CD Level 1 Descriptor */
++    } else if (infzero) {
-+typedef struct CDDesc {
++        /*
-+    uint32_t word[2];
++         * Inf * 0 + NaN -- some implementations return the
-+} CDDesc;
++         * default NaN here, and some return the input NaN.
-+
++         */
-+/* Stream Table Entry(STE) */
++        switch (s->float_infzeronan_rule) {
-+typedef struct STE {
++        case float_infzeronan_dnan_never:
-+    uint32_t word[16];
++            which = 2;
 +} STE;
 +
 +/* Context Descriptor(CD) */
 +typedef struct CD {
 +    uint32_t word[16];
 +} CD;
 +
 +/* STE fields */
 +
 +#define STE_VALID(x)   extract32((x)->word[0], 0, 1)
 +
 +#define STE_CONFIG(x)  extract32((x)->word[0], 1, 3)
 +#define STE_CFG_S1_ENABLED(config) (config & 0x1)
 +#define STE_CFG_S2_ENABLED(config) (config & 0x2)
 +#define STE_CFG_ABORT(config)      (!(config & 0x4))
 +#define STE_CFG_BYPASS(config)     (config == 0x4)
 +
 +#define STE_S1FMT(x)       extract32((x)->word[0], 4 , 2)
 +#define STE_S1CDMAX(x)     extract32((x)->word[1], 27, 5)
 +#define STE_S1STALLD(x)    extract32((x)->word[2], 27, 1)
 +#define STE_EATS(x)        extract32((x)->word[2], 28, 2)
 +#define STE_STRW(x)        extract32((x)->word[2], 30, 2)
 +#define STE_S2VMID(x)      extract32((x)->word[4], 0 , 16)
 +#define STE_S2T0SZ(x)      extract32((x)->word[5], 0 , 6)
 +#define STE_S2SL0(x)       extract32((x)->word[5], 6 , 2)
 +#define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 +#define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 +#define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
 +#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
 +#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
 +#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
 +#define STE_CTXPTR(x)                                           \
 +    ({                                                          \
 +        unsigned long addr;                                     \
 +        addr = (uint64_t)extract32((x)->word[1], 0, 16) << 32;  \
 +        addr |= (uint64_t)((x)->word[0] & 0xffffffc0);          \
 +        addr;                                                   \
 +    })
 +
 +#define STE_S2TTB(x)                                            \
 +    ({                                                          \
 +        unsigned long addr;                                     \
 +        addr = (uint64_t)extract32((x)->word[7], 0, 16) << 32;  \
 +        addr |= (uint64_t)((x)->word[6] & 0xfffffff0);          \
 +        addr;                                                   \
 +    })
 +
 +static inline int oas2bits(int oas_field)
 +{
 +    switch (oas_field) {
 +    case 0:
 +        return 32;
 +    case 1:
 +        return 36;
 +    case 2:
 +        return 40;
 +    case 3:
 +        return 42;
 +    case 4:
 +        return 44;
 +    case 5:
 +        return 48;
 +    }
 +    return -1;
 +}
 +
 +static inline int pa_range(STE *ste)
 +{
 +    int oas_field = MIN(STE_S2PS(ste), SMMU_IDR5_OAS);
 +
 +    if (!STE_S2AA64(ste)) {
 +        return 40;
 +    }
 +
 +    return oas2bits(oas_field);
 +}
 +
 +#define MAX_PA(ste) ((1 << pa_range(ste)) - 1)
 +
 +/* CD fields */
 +
 +#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
 +#define CD_ASID(x)    extract32((x)->word[1], 16, 16)
 +#define CD_TTB(x, sel)                                      \
 +    ({                                                      \
 +        uint64_t hi, lo;                                    \
 +        hi = extract32((x)->word[(sel) * 2 + 3], 0, 19);    \
 +        hi <<= 32;                                          \
 +        lo = (x)->word[(sel) * 2 + 2] & ~0xfULL;            \
 +        hi | lo;                                            \
 +    })
 +
 +#define CD_TSZ(x, sel)   extract32((x)->word[0], (16 * (sel)) + 0, 6)
 +#define CD_TG(x, sel)    extract32((x)->word[0], (16 * (sel)) + 6, 2)
 +#define CD_EPD(x, sel)   extract32((x)->word[0], (16 * (sel)) + 14, 1)
 +#define CD_ENDI(x)       extract32((x)->word[0], 15, 1)
 +#define CD_IPS(x)        extract32((x)->word[1], 0 , 3)
 +#define CD_TBI(x)        extract32((x)->word[1], 6 , 2)
 +#define CD_HD(x)         extract32((x)->word[1], 10 , 1)
 +#define CD_HA(x)         extract32((x)->word[1], 11 , 1)
 +#define CD_S(x)          extract32((x)->word[1], 12, 1)
 +#define CD_R(x)          extract32((x)->word[1], 13, 1)
 +#define CD_A(x)          extract32((x)->word[1], 14, 1)
 +#define CD_AARCH64(x)    extract32((x)->word[1], 9 , 1)
 +
 +#define CDM_VALID(x)    ((x)->word[0] & 0x1)
 +
 +static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd)
 +{
 +    return CD_VALID(cd);
 +}
 +
 +/**
 + * tg2granule - Decodes the CD translation granule size field according
 + * to the ttbr in use
 + * @bits: TG0/1 fields
 + * @ttbr: ttbr index in use
 + */
 +static inline int tg2granule(int bits, int ttbr)
 +{
 +    switch (bits) {
 +    case 0:
 +        return ttbr ? 0  : 12;
 +    case 1:
 +        return ttbr ? 14 : 16;
 +    case 2:
 +        return ttbr ? 12 : 14;
 +    case 3:
 +        return ttbr ? 16 :  0;
 +    default:
 +        return 0;
 +    }
 +}
 +
 +static inline uint64_t l1std_l2ptr(STEDesc *desc)
 +{
 +    uint64_t hi, lo;
 +
 +    hi = desc->word[1];
 +    lo = desc->word[0] & ~0x1fULL;
 +    return hi << 32 | lo;
 +}
 +
 +#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
      s->sid_split = 0;
  }
 +static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
 +                        SMMUEventInfo *event)
 +{
 +    int ret;
 +
 +    trace_smmuv3_get_ste(addr);
 +    /* TODO: guarantee 64-bit single-copy atomicity */
 +    ret = dma_memory_read(&address_space_memory, addr,
 +                          (void *)buf, sizeof(*buf));
 +    if (ret != MEMTX_OK) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
 +        event->type = SMMU_EVT_F_STE_FETCH;
 +        event->u.f_ste_fetch.addr = addr;
 +        return -EINVAL;
 +    }
 +    return 0;
 +
 +}
 +
 +/* @ssid > 0 not supported yet */
 +static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
 +                       CD *buf, SMMUEventInfo *event)
 +{
 +    dma_addr_t addr = STE_CTXPTR(ste);
 +    int ret;
 +
 +    trace_smmuv3_get_cd(addr);
 +    /* TODO: guarantee 64-bit single-copy atomicity */
 +    ret = dma_memory_read(&address_space_memory, addr,
 +                           (void *)buf, sizeof(*buf));
 +    if (ret != MEMTX_OK) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
 +        event->type = SMMU_EVT_F_CD_FETCH;
 +        event->u.f_ste_fetch.addr = addr;
 +        return -EINVAL;
 +    }
 +    return 0;
 +}
 +
 +/* Returns <0 if the caller has no need to continue the translation */
 +static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
 +                      STE *ste, SMMUEventInfo *event)
 +{
 +    uint32_t config;
 +    int ret = -EINVAL;
 +
 +    if (!STE_VALID(ste)) {
 +        goto bad_ste;
 +    }
 +
 +    config = STE_CONFIG(ste);
 +
 +    if (STE_CFG_ABORT(config)) {
 +        cfg->aborted = true; /* abort but don't record any event */
 +        return ret;
 +    }
 +
 +    if (STE_CFG_BYPASS(config)) {
 +        cfg->bypassed = true;
 +        return ret;
 +    }
 +
 +    if (STE_CFG_S2_ENABLED(config)) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +        goto bad_ste;
 +    }
 +
 +    if (STE_S1CDMAX(ste) != 0) {
 +        qemu_log_mask(LOG_UNIMP,
 +                      "SMMUv3 does not support multiple context descriptors yet\n");
 +        goto bad_ste;
 +    }
 +
 +    if (STE_S1STALLD(ste)) {
 +        qemu_log_mask(LOG_UNIMP,
 +                      "SMMUv3 S1 stalling fault model not allowed yet\n");
 +        goto bad_ste;
 +    }
 +    return 0;
 +
 +bad_ste:
 +    event->type = SMMU_EVT_C_BAD_STE;
 +    return -EINVAL;
 +}
 +
 +/**
 + * smmu_find_ste - Return the stream table entry associated
 + * to the sid
 + *
 + * @s: smmuv3 handle
 + * @sid: stream ID
 + * @ste: returned stream table entry
 + * @event: handle to an event info
 + *
 + * Supports linear and 2-level stream table
 + * Return 0 on success, -EINVAL otherwise
 + */
 +static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
 +                         SMMUEventInfo *event)
 +{
 +    dma_addr_t addr;
 +    int ret;
 +
 +    trace_smmuv3_find_ste(sid, s->features, s->sid_split);
 +    /* Check SID range */
 +    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
 +        event->type = SMMU_EVT_C_BAD_STREAMID;
 +        return -EINVAL;
 +    }
 +    if (s->features & SMMU_FEATURE_2LVL_STE) {
 +        int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
 +        dma_addr_t strtab_base, l1ptr, l2ptr;
 +        STEDesc l1std;
 +
 +        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
 +        l1_ste_offset = sid >> s->sid_split;
 +        l2_ste_offset = sid & ((1 << s->sid_split) - 1);
 +        l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
 +        /* TODO: guarantee 64-bit single-copy atomicity */
 +        ret = dma_memory_read(&address_space_memory, l1ptr,
 +                              (uint8_t *)&l1std, sizeof(l1std));
 +        if (ret != MEMTX_OK) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
 +            event->type = SMMU_EVT_F_STE_FETCH;
 +            event->u.f_ste_fetch.addr = l1ptr;
 +            return -EINVAL;
 +        }
 +
 +        span = L1STD_SPAN(&l1std);
 +
 +        if (!span) {
 +            /* l2ptr is not valid */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "invalid sid=%d (L1STD span=0)\n", sid);
 +            event->type = SMMU_EVT_C_BAD_STREAMID;
 +            return -EINVAL;
 +        }
 +        max_l2_ste = (1 << span) - 1;
 +        l2ptr = l1std_l2ptr(&l1std);
 +        trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
 +                                   l2ptr, l2_ste_offset, max_l2_ste);
 +        if (l2_ste_offset > max_l2_ste) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "l2_ste_offset=%d > max_l2_ste=%d\n",
 +                          l2_ste_offset, max_l2_ste);
 +            event->type = SMMU_EVT_C_BAD_STE;
 +            return -EINVAL;
 +        }
 +        addr = l2ptr + l2_ste_offset * sizeof(*ste);
 +    } else {
 +        addr = s->strtab_base + sid * sizeof(*ste);
 +    }
 +
 +    if (smmu_get_ste(s, addr, ste, event)) {
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
 +{
 +    int ret = -EINVAL;
 +    int i;
 +
 +    if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
 +        goto bad_cd;
 +    }
 +    if (!CD_A(cd)) {
 +        goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
 +    }
 +    if (CD_S(cd)) {
 +        goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
 +    }
 +    if (CD_HA(cd) || CD_HD(cd)) {
 +        goto bad_cd; /* HTTU = 0 */
 +    }
 +
 +    /* we support only those at the moment */
 +    cfg->aa64 = true;
 +    cfg->stage = 1;
 +
 +    cfg->oas = oas2bits(CD_IPS(cd));
 +    cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
 +    cfg->tbi = CD_TBI(cd);
 +    cfg->asid = CD_ASID(cd);
 +
 +    trace_smmuv3_decode_cd(cfg->oas);
 +
 +    /* decode data dependent on TT */
 +    for (i = 0; i <= 1; i++) {
 +        int tg, tsz;
 +        SMMUTransTableInfo *tt = &cfg->tt[i];
 +
 +        cfg->tt[i].disabled = CD_EPD(cd, i);
 +        if (cfg->tt[i].disabled) {
 +            continue;
 +        }
 +
 +        tsz = CD_TSZ(cd, i);
 +        if (tsz < 16 || tsz > 39) {
 +            goto bad_cd;
 +        }
 +
 +        tg = CD_TG(cd, i);
 +        tt->granule_sz = tg2granule(tg, i);
 +        if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
 +            goto bad_cd;
 +        }
 +
 +        tt->tsz = tsz;
 +        tt->ttb = CD_TTB(cd, i);
 +        if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
 +            goto bad_cd;
 +        }
 +        trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);
 +    }
 +
 +    event->record_trans_faults = CD_R(cd);
 +
 +    return 0;
 +
 +bad_cd:
 +    event->type = SMMU_EVT_C_BAD_CD;
 +    return ret;
 +}
 +
 +/**
 + * smmuv3_decode_config - Prepare the translation configuration
 + * for the @mr iommu region
 + * @mr: iommu memory region the translation config must be prepared for
 + * @cfg: output translation configuration which is populated through
 + *       the different configuration decoding steps
 + * @event: must be zero'ed by the caller
 + *
 + * return < 0 if the translation needs to be aborted (@event is filled
 + * accordingly). Return 0 otherwise.
 + */
 +static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
 +                                SMMUEventInfo *event)
 +{
 +    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 +    uint32_t sid = smmu_get_sid(sdev);
 +    SMMUv3State *s = sdev->smmu;
 +    int ret = -EINVAL;
 +    STE ste;
 +    CD cd;
 +
 +    if (smmu_find_ste(s, sid, &ste, event)) {
 +        return ret;
 +    }
 +
 +    if (decode_ste(s, cfg, &ste, event)) {
 +        return ret;
 +    }
 +
 +    if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) {
 +        return ret;
 +    }
 +
 +    return decode_cd(cfg, &cd, event);
 +}
 +
 +static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
 +                                      IOMMUAccessFlags flag)
 +{
 +    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
 +    SMMUv3State *s = sdev->smmu;
 +    uint32_t sid = smmu_get_sid(sdev);
 +    SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid};
 +    SMMUPTWEventInfo ptw_info = {};
 +    SMMUTransCfg cfg = {};
 +    IOMMUTLBEntry entry = {
 +        .target_as = &address_space_memory,
 +        .iova = addr,
 +        .translated_addr = addr,
 +        .addr_mask = ~(hwaddr)0,
 +        .perm = IOMMU_NONE,
 +    };
 +    int ret = 0;
 +
 +    if (!smmu_enabled(s)) {
 +        goto out;
 +    }
 +
 +    ret = smmuv3_decode_config(mr, &cfg, &event);
 +    if (ret) {
 +        goto out;
 +    }
 +
 +    if (cfg.aborted) {
 +        goto out;
 +    }
 +
 +    ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info);
 +    if (ret) {
 +        switch (ptw_info.type) {
 +        case SMMU_PTW_ERR_WALK_EABT:
 +            event.type = SMMU_EVT_F_WALK_EABT;
 +            event.u.f_walk_eabt.addr = addr;
 +            event.u.f_walk_eabt.rnw = flag & 0x1;
 +            event.u.f_walk_eabt.class = 0x1;
 +            event.u.f_walk_eabt.addr2 = ptw_info.addr;
 +            break;
-+        case SMMU_PTW_ERR_TRANSLATION:
++        case float_infzeronan_dnan_always:
-+            if (event.record_trans_faults) {
++            which = 3;
 +                event.type = SMMU_EVT_F_TRANSLATION;
 +                event.u.f_translation.addr = addr;
 +                event.u.f_translation.rnw = flag & 0x1;
 +            }
 +            break;
-+        case SMMU_PTW_ERR_ADDR_SIZE:
++        case float_infzeronan_dnan_if_qnan:
-+            if (event.record_trans_faults) {
++            which = is_qnan(c->cls) ? 3 : 2;
 +                event.type = SMMU_EVT_F_ADDR_SIZE;
 +                event.u.f_addr_size.addr = addr;
 +                event.u.f_addr_size.rnw = flag & 0x1;
 +            }
 +            break;
 +        case SMMU_PTW_ERR_ACCESS:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_ACCESS;
 +                event.u.f_access.addr = addr;
 +                event.u.f_access.rnw = flag & 0x1;
 +            }
 +            break;
 +        case SMMU_PTW_ERR_PERMISSION:
 +            if (event.record_trans_faults) {
 +                event.type = SMMU_EVT_F_PERMISSION;
 +                event.u.f_permission.addr = addr;
 +                event.u.f_permission.rnw = flag & 0x1;
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
-+    }
+     } else {
-+out:
+-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
-+    if (ret) {
++        FloatClass cls[3] = { a->cls, b->cls, c->cls };
-+        qemu_log_mask(LOG_GUEST_ERROR,
++        Float3NaNPropRule rule = s->float_3nan_prop_rule;
 +                      "%s translation failed for iova=0x%"PRIx64"(%d)\n",
 +                      mr->parent_obj.name, addr, ret);
 +        entry.perm = IOMMU_NONE;
 +        smmuv3_record_event(s, &event);
 +    } else if (!cfg.aborted) {
 +        entry.perm = flag;
 +        trace_smmuv3_translate(mr->parent_obj.name, sid, addr,
 +                               entry.translated_addr, entry.perm);
 +    }
 +
-+    return entry;
++        assert(rule != float_3nan_prop_none);
-+}
++        if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
-+
++            /* We have at least one SNaN input and should prefer it */
- static int smmuv3_cmdq_consume(SMMUv3State *s)
++            do {
- {
++                which = rule & R_3NAN_1ST_MASK;
-     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
++                rule >>= R_3NAN_1ST_LENGTH;
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
++            } while (!is_snan(cls[which]));
- static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
++        } else {
-                                                   void *data)
++            do {
- {
++                which = rule & R_3NAN_1ST_MASK;
-+    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
++                rule >>= R_3NAN_1ST_LENGTH;
-+
++            } while (!is_nan(cls[which]));
-+    imrc->translate = smmuv3_translate;
++        }
      }
      if (which == 3) {
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
      }
  }
- static const TypeInfo smmuv3_type_info = {
+-/*----------------------------------------------------------------------------
-diff --git a/hw/arm/trace-events b/hw/arm/trace-events
+-| Select which NaN to propagate for a three-input operation.
-index XXXXXXX..XXXXXXX 100644
+-| For the moment we assume that no CPU needs the 'larger significand'
---- a/hw/arm/trace-events
+-| information.
-+++ b/hw/arm/trace-events
+-| Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
-@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx
+-*----------------------------------------------------------------------------*/
- smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+-static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
- smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+-                         bool infzero, bool have_snan, float_status *status)
- smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
+-{
-+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
+-    FloatClass cls[3] = { a_cls, b_cls, c_cls };
-+smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%lx l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
+-    Float3NaNPropRule rule = status->float_3nan_prop_rule;
-+smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
+-    int which;
-+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass iova:0x%"PRIx64" is_write=%d"
+-
-+smmuv3_translate_in(uint16_t sid, int pci_bus_num, uint64_t strtab_base) "SID:0x%x bus:%d strtab_base:0x%"PRIx64
+-    /*
-+smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
+-     * We guarantee not to require the target to tell us how to
-+smmuv3_translate(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
+-     * pick a NaN if we're always returning the default NaN.
-+smmuv3_decode_cd(uint32_t oas) "oas=%d"
+-     * But if we're not in default-NaN mode then the target must
-+smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d"
+-     * specify.
 -     */
 -    assert(!status->default_nan_mode);
 -
 -    if (infzero) {
 -        /*
 -         * Inf * 0 + NaN -- some implementations return the default NaN here,
 -         * and some return the input NaN.
 -         */
 -        switch (status->float_infzeronan_rule) {
 -        case float_infzeronan_dnan_never:
 -            return 2;
 -        case float_infzeronan_dnan_always:
 -            return 3;
 -        case float_infzeronan_dnan_if_qnan:
 -            return is_qnan(c_cls) ? 3 : 2;
 -        default:
 -            g_assert_not_reached();
 -        }
 -    }
 -
 -    assert(rule != float_3nan_prop_none);
 -    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
 -        /* We have at least one SNaN input and should prefer it */
 -        do {
 -            which = rule & R_3NAN_1ST_MASK;
 -            rule >>= R_3NAN_1ST_LENGTH;
 -        } while (!is_snan(cls[which]));
 -    } else {
 -        do {
 -            which = rule & R_3NAN_1ST_MASK;
 -            rule >>= R_3NAN_1ST_LENGTH;
 -        } while (!is_nan(cls[which]));
 -    }
 -    return which;
 -}
 -
  /*----------------------------------------------------------------------------
  | Returns 1 if the double-precision floating-point value `a' is a quiet
  | NaN; otherwise returns 0.
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 12/24] hw/arm/smmu-common: IOMMU memory region and address space setup
+[PULL 62/72] softfloat: Use goto for default nan case in pick_nan_muladd
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-We set up the infrastructure to enumerate all the PCI devices
+Remove "3" as a special case for which and simply
-attached to the SMMU and create an associated IOMMU memory
+branch to return the desired value.
 region and address space.
-Those info are stored in SMMUDevice objects. The devices are
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-grouped according to the PCIBus they belong to. A hash table
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-indexed by the PCIBus pointer is used. Also an array indexed by
+Message-id: 20241203203949.483774-4-richard.henderson@linaro.org
 the bus number allows to find the list of SMMUDevices.
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 1524665762-31355-3-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/smmu-common.h |  8 +++++
+ fpu/softfloat-parts.c.inc | 20 ++++++++++----------
- hw/arm/smmu-common.c         | 69 ++++++++++++++++++++++++++++++++++++
+file changed, 10 insertions(+), 10 deletions(-)
  hw/arm/trace-events          |  3 ++
 files changed, 80 insertions(+)
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/smmu-common.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/include/hw/arm/smmu-common.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
- #define ARM_SMMU_GET_CLASS(obj)                              \
+          * But if we're not in default-NaN mode then the target must
-     OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
+          * specify.
+          */
-+/* Return the SMMUPciBus handle associated to a PCI bus number */
+-        which = 3;
-+SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num);
++        goto default_nan;
      } else if (infzero) {
          /*
           * Inf * 0 + NaN -- some implementations return the
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
           */
          switch (s->float_infzeronan_rule) {
          case float_infzeronan_dnan_never:
 -            which = 2;
              break;
          case float_infzeronan_dnan_always:
 -            which = 3;
 -            break;
 +            goto default_nan;
          case float_infzeronan_dnan_if_qnan:
 -            which = is_qnan(c->cls) ? 3 : 2;
 +            if (is_qnan(c->cls)) {
 +                goto default_nan;
 +            }
              break;
          default:
              g_assert_not_reached();
          }
 +        which = 2;
      } else {
          FloatClass cls[3] = { a->cls, b->cls, c->cls };
          Float3NaNPropRule rule = s->float_3nan_prop_rule;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          }
      }
 -    if (which == 3) {
 -        parts_default_nan(a, s);
 -        return a;
 -    }
 -
      switch (which) {
      case 0:
          break;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          parts_silence_nan(a, s);
      }
      return a;
 +
-+/* Return the stream ID of an SMMU device */
++ default_nan:
-+static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
++    parts_default_nan(a, s);
-+{
++    return a;
 +    return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
 +}
  #endif  /* HW_ARM_SMMU_COMMON */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "hw/arm/smmu-common.h"
 +/**
 + * The bus number is used for lookup when SID based invalidation occurs.
 + * In that case we lazily populate the SMMUPciBus array from the bus hash
 + * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
 + * numbers may not be always initialized yet.
 + */
 +SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
 +{
 +    SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
 +
 +    if (!smmu_pci_bus) {
 +        GHashTableIter iter;
 +
 +        g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
 +        while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
 +            if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
 +                s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
 +                return smmu_pci_bus;
 +            }
 +        }
 +    }
 +    return smmu_pci_bus;
 +}
 +
 +static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
 +{
 +    SMMUState *s = opaque;
 +    SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
 +    SMMUDevice *sdev;
 +
 +    if (!sbus) {
 +        sbus = g_malloc0(sizeof(SMMUPciBus) +
 +                         sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
 +        sbus->bus = bus;
 +        g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
 +    }
 +
 +    sdev = sbus->pbdev[devfn];
 +    if (!sdev) {
 +        char *name = g_strdup_printf("%s-%d-%d",
 +                                     s->mrtypename,
 +                                     pci_bus_num(bus), devfn);
 +        sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
 +
 +        sdev->smmu = s;
 +        sdev->bus = bus;
 +        sdev->devfn = devfn;
 +
 +        memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
 +                                 s->mrtypename,
 +                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
 +        address_space_init(&sdev->as,
 +                           MEMORY_REGION(&sdev->iommu), name);
 +        trace_smmu_add_mr(name);
 +        g_free(name);
 +    }
 +
 +    return &sdev->as;
 +}
 +
  static void smmu_base_realize(DeviceState *dev, Error **errp)
  {
 +    SMMUState *s = ARM_SMMU(dev);
      SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
      Error *local_err = NULL;
@@ -XXX,XX +XXX,XX @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
          error_propagate(errp, local_err);
          return;
      }
 +
 +    s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
 +
 +    if (s->primary_bus) {
 +        pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
 +    } else {
 +        error_setg(errp, "SMMU is not attached to any PCI bus!");
 +    }
  }
- static void smmu_base_reset(DeviceState *dev)
+ /*
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
  # hw/arm/virt-acpi-build.c
  virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 +
 +# hw/arm/smmu-common.c
 +smmu_add_mr(const char *name) "%s"
 \ No newline at end of file
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 23/24] hw/arm/virt-acpi-build: Add smmuv3 node in IORT table
+[PULL 63/72] softfloat: Remove which from parts_pick_nan_muladd
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch builds the smmuv3 node in the ACPI IORT table.
+Assign the pointer return value to 'a' directly,
 rather than going through an intermediary index.
-The RID space of the root complex, which spans 0x0-0x10000
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-maps to streamid space 0x0-0x10000 in smmuv3, which in turn
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-maps to deviceid space 0x0-0x10000 in the ITS group.
+Message-id: 20241203203949.483774-5-richard.henderson@linaro.org
 The guest must feature the IOMMU probe deferral series
 (https://lkml.org/lkml/2017/4/10/214) which fixes streamid
 multiple lookup. This bug is not related to the SMMU emulation.
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
 Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/acpi/acpi-defs.h | 15 ++++++++++
+ fpu/softfloat-parts.c.inc | 32 ++++++++++----------------------
- hw/arm/virt-acpi-build.c    | 55 ++++++++++++++++++++++++++++++++-----
+file changed, 10 insertions(+), 22 deletions(-)
 files changed, 63 insertions(+), 7 deletions(-)
-diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/acpi/acpi-defs.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/include/hw/acpi/acpi-defs.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
- } QEMU_PACKED;
+                                             FloatPartsN *c, float_status *s,
- typedef struct AcpiIortItsGroup AcpiIortItsGroup;
+                                             int ab_mask, int abc_mask)
 +struct AcpiIortSmmu3 {
 +    ACPI_IORT_NODE_HEADER_DEF
 +    uint64_t base_address;
 +    uint32_t flags;
 +    uint32_t reserved2;
 +    uint64_t vatos_address;
 +    uint32_t model;
 +    uint32_t event_gsiv;
 +    uint32_t pri_gsiv;
 +    uint32_t gerr_gsiv;
 +    uint32_t sync_gsiv;
 +    AcpiIortIdMapping id_mapping_array[0];
 +} QEMU_PACKED;
 +typedef struct AcpiIortSmmu3 AcpiIortSmmu3;
 +
  struct AcpiIortRC {
      ACPI_IORT_NODE_HEADER_DEF
      AcpiIortMemoryAccess memory_properties;
 diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt-acpi-build.c
 +++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)
  }
  static void
 -build_iort(GArray *table_data, BIOSLinker *linker)
 +build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
  {
--    int iort_start = table_data->len;
+-    int which;
-+    int nb_nodes, iort_start = table_data->len;
+     bool infzero = (ab_mask == float_cmask_infzero);
-     AcpiIortIdMapping *idmap;
+     bool have_snan = (abc_mask & float_cmask_snan);
-     AcpiIortItsGroup *its;
++    FloatPartsN *ret;
-     AcpiIortTable *iort;
--    size_t node_size, iort_length;
+     if (unlikely(have_snan)) {
-+    AcpiIortSmmu3 *smmu;
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
-+    size_t node_size, iort_length, smmu_offset = 0;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-     AcpiIortRC *rc;
+         default:
+             g_assert_not_reached();
-     iort = acpi_data_push(table_data, sizeof(*iort));
+         }
+-        which = 2;
-+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
++        ret = c;
-+        nb_nodes = 3; /* RC, ITS, SMMUv3 */
+     } else {
-+    } else {
+-        FloatClass cls[3] = { a->cls, b->cls, c->cls };
-+        nb_nodes = 2; /* RC, ITS */
++        FloatPartsN *val[3] = { a, b, c };
-+    }
+         Float3NaNPropRule rule = s->float_3nan_prop_rule;
-+
-     iort_length = sizeof(*iort);
+         assert(rule != float_3nan_prop_none);
--    iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */
+         if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
-+    iort->node_count = cpu_to_le32(nb_nodes);
+             /* We have at least one SNaN input and should prefer it */
-     iort->node_offset = cpu_to_le32(sizeof(*iort));
+             do {
+-                which = rule & R_3NAN_1ST_MASK;
-     /* ITS group node */
++                ret = val[rule & R_3NAN_1ST_MASK];
-@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
+                 rule >>= R_3NAN_1ST_LENGTH;
-     its->its_count = cpu_to_le32(1);
+-            } while (!is_snan(cls[which]));
-     its->identifiers[0] = 0; /* MADT translation_id */
++            } while (!is_snan(ret->cls));
+         } else {
-+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+             do {
-+        int irq =  vms->irqmap[VIRT_SMMU];
+-                which = rule & R_3NAN_1ST_MASK;
-+
++                ret = val[rule & R_3NAN_1ST_MASK];
-+        /* SMMUv3 node */
+                 rule >>= R_3NAN_1ST_LENGTH;
-+        smmu_offset = iort->node_offset + node_size;
+-            } while (!is_nan(cls[which]));
-+        node_size = sizeof(*smmu) + sizeof(*idmap);
++            } while (!is_nan(ret->cls));
-+        iort_length += node_size;
+         }
 +        smmu = acpi_data_push(table_data, node_size);
 +
 +        smmu->type = ACPI_IORT_NODE_SMMU_V3;
 +        smmu->length = cpu_to_le16(node_size);
 +        smmu->mapping_count = cpu_to_le32(1);
 +        smmu->mapping_offset = cpu_to_le32(sizeof(*smmu));
 +        smmu->base_address = cpu_to_le64(vms->memmap[VIRT_SMMU].base);
 +        smmu->event_gsiv = cpu_to_le32(irq);
 +        smmu->pri_gsiv = cpu_to_le32(irq + 1);
 +        smmu->gerr_gsiv = cpu_to_le32(irq + 2);
 +        smmu->sync_gsiv = cpu_to_le32(irq + 3);
 +
 +        /* Identity RID mapping covering the whole input RID range */
 +        idmap = &smmu->id_mapping_array[0];
 +        idmap->input_base = 0;
 +        idmap->id_count = cpu_to_le32(0xFFFF);
 +        idmap->output_base = 0;
 +        /* output IORT node is the ITS group node (the first node) */
 +        idmap->output_reference = cpu_to_le32(iort->node_offset);
 +    }
 +
      /* Root Complex Node */
      node_size = sizeof(*rc) + sizeof(*idmap);
      iort_length += node_size;
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
      idmap->input_base = 0;
      idmap->id_count = cpu_to_le32(0xFFFF);
      idmap->output_base = 0;
 -    /* output IORT node is the ITS group node (the first node) */
 -    idmap->output_reference = cpu_to_le32(iort->node_offset);
 +
 +    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
 +        /* output IORT node is the smmuv3 node */
 +        idmap->output_reference = cpu_to_le32(smmu_offset);
 +    } else {
 +        /* output IORT node is the ITS group node (the first node) */
 +        idmap->output_reference = cpu_to_le32(iort->node_offset);
 +    }
      iort->length = cpu_to_le32(iort_length);
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
      if (its_class_name() && !vmc->no_its) {
          acpi_add_table(table_offsets, tables_blob);
 -        build_iort(tables_blob, tables->linker);
 +        build_iort(tables_blob, tables->linker, vms);
      }
-     /* XSDT is pointed to by RSDP */
+-    switch (which) {
 -    case 0:
 -        break;
 -    case 1:
 -        a = b;
 -        break;
 -    case 2:
 -        a = c;
 -        break;
 -    default:
 -        g_assert_not_reached();
 +    if (is_snan(ret->cls)) {
 +        parts_silence_nan(ret, s);
      }
 -    if (is_snan(a->cls)) {
 -        parts_silence_nan(a, s);
 -    }
 -    return a;
 +    return ret;
   default_nan:
      parts_default_nan(a, s);
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 02/24] target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case
+[PULL 64/72] softfloat: Pad array size in pick_nan_muladd
-From: Mathew Maidment <mathew1800@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The duplication of id_tlbtr_reginfo was unintentionally added within
+While all indices into val[] should be in [0-2], the mask
-af8114c6b8ead02f08b58e3c36895c1ea047 which should have been
+applied is two bits.  To help static analysis see there is
-id_mpuir_reginfo.
+no possibility of read beyond the end of the array, pad the
 array to 4 entries, with the final being (implicitly) NULL.
-The effect was that for OMAP and StrongARM CPUs we would
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-incorrectly UNDEF writes to MPUIR rather than NOPing them.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20241203203949.483774-6-richard.henderson@linaro.org
 Signed-off-by: Mathew Maidment <mathew1800@gmail.com>
 Message-id: 20180501184933.37609-2-mathew1800@gmail.com
 [PMM: tweak commit message]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ fpu/softfloat-parts.c.inc | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/helper.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
              for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
                  r->access = PL1_RW;
              }
 -            id_tlbtr_reginfo.access = PL1_RW;
 +            id_mpuir_reginfo.access = PL1_RW;
              id_tlbtr_reginfo.access = PL1_RW;
          }
-         if (arm_feature(env, ARM_FEATURE_V8)) {
+         ret = c;
      } else {
 -        FloatPartsN *val[3] = { a, b, c };
 +        FloatPartsN *val[R_3NAN_1ST_MASK + 1] = { a, b, c };
          Float3NaNPropRule rule = s->float_3nan_prop_rule;
          assert(rule != float_3nan_prop_none);
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 22/24] hw/arm/virt: Add SMMUv3 to the virt board
+[PULL 65/72] softfloat: Move propagateFloatx80NaN to softfloat.c
-From: Prem Mallappa <prem.mallappa@broadcom.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add code to instantiate an smmuv3 in virt machine. A new iommu
+This function is part of the public interface and
-integer member is introduced in VirtMachineState to store the type
+is not "specialized" to any target in any way.
 of the iommu in use.
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 1524665762-31355-13-git-send-email-eric.auger@redhat.com
+Message-id: 20241203203949.483774-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h | 10 +++++++
+ fpu/softfloat.c                | 52 ++++++++++++++++++++++++++++++++++
- hw/arm/virt.c         | 64 ++++++++++++++++++++++++++++++++++++++++++-
+ fpu/softfloat-specialize.c.inc | 52 ----------------------------------
-files changed, 73 insertions(+), 1 deletion(-)
+files changed, 52 insertions(+), 52 deletions(-)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/fpu/softfloat.c
-+++ b/include/hw/arm/virt.h
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
+     *zExpPtr = 1 - shiftCount;
- #define NUM_GICV2M_SPIS       64
+ }
- #define NUM_VIRTIO_TRANSPORTS 32
-+#define NUM_SMMU_IRQS          4
++/*----------------------------------------------------------------------------
++| Takes two extended double-precision floating-point values `a' and `b', one
- #define ARCH_GICV3_MAINT_IRQ  9
++| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
++| `b' is a signaling NaN, the invalid exception is raised.
-@@ -XXX,XX +XXX,XX @@ enum {
++*----------------------------------------------------------------------------*/
      VIRT_GIC_V2M,
      VIRT_GIC_ITS,
      VIRT_GIC_REDIST,
 +    VIRT_SMMU,
      VIRT_UART,
      VIRT_MMIO,
      VIRT_RTC,
@@ -XXX,XX +XXX,XX @@ enum {
      VIRT_SECURE_MEM,
  };
 +typedef enum VirtIOMMUType {
 +    VIRT_IOMMU_NONE,
 +    VIRT_IOMMU_SMMUV3,
 +    VIRT_IOMMU_VIRTIO,
 +} VirtIOMMUType;
 +
- typedef struct MemMapEntry {
++floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
      hwaddr base;
      hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      bool its;
      bool virt;
      int32_t gic_version;
 +    VirtIOMMUType iommu;
      struct arm_boot_info bootinfo;
      const MemMapEntry *memmap;
      const int *irqmap;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      uint32_t clock_phandle;
      uint32_t gic_phandle;
      uint32_t msi_phandle;
 +    uint32_t iommu_phandle;
      int psci_conduit;
  } VirtMachineState;
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/smbios/smbios.h"
  #include "qapi/visitor.h"
  #include "standard-headers/linux/input.h"
 +#include "hw/arm/smmuv3.h"
  #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
      static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry a15memmap[] = {
      [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
      [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
      [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
 +    [VIRT_SMMU] =               { 0x09050000, 0x00020000 },
      [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
      /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
      [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static const int a15irqmap[] = {
      [VIRT_SECURE_UART] = 8,
      [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
      [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
 +    [VIRT_SMMU] = 74,    /* ...to 74 + NUM_SMMU_IRQS - 1 */
      [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
  };
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(const VirtMachineState *vms,
 x7           /* PCI irq */);
  }
 -static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
 +static void create_smmu(const VirtMachineState *vms, qemu_irq *pic,
 +                        PCIBus *bus)
 +{
-+    char *node;
++    bool aIsLargerSignificand;
-+    const char compat[] = "arm,smmu-v3";
++    FloatClass a_cls, b_cls;
 +    int irq =  vms->irqmap[VIRT_SMMU];
 +    int i;
 +    hwaddr base = vms->memmap[VIRT_SMMU].base;
 +    hwaddr size = vms->memmap[VIRT_SMMU].size;
 +    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
 +    DeviceState *dev;
 +
-+    if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {
++    /* This is not complete, but is good enough for pickNaN.  */
-+        return;
++    a_cls = (!floatx80_is_any_nan(a)
 +             ? float_class_normal
 +             : floatx80_is_signaling_nan(a, status)
 +             ? float_class_snan
 +             : float_class_qnan);
 +    b_cls = (!floatx80_is_any_nan(b)
 +             ? float_class_normal
 +             : floatx80_is_signaling_nan(b, status)
 +             ? float_class_snan
 +             : float_class_qnan);
 +
 +    if (is_snan(a_cls) || is_snan(b_cls)) {
 +        float_raise(float_flag_invalid, status);
 +    }
 +
-+    dev = qdev_create(NULL, "arm-smmuv3");
++    if (status->default_nan_mode) {
-+
++        return floatx80_default_nan(status);
 +    object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",
 +                             &error_abort);
 +    qdev_init_nofail(dev);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 +    for (i = 0; i < NUM_SMMU_IRQS; i++) {
 +        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
 +    }
 +
-+    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
++    if (a.low < b.low) {
-+    qemu_fdt_add_subnode(vms->fdt, node);
++        aIsLargerSignificand = 0;
-+    qemu_fdt_setprop(vms->fdt, node, "compatible", compat, sizeof(compat));
++    } else if (b.low < a.low) {
-+    qemu_fdt_setprop_sized_cells(vms->fdt, node, "reg", 2, base, 2, size);
++        aIsLargerSignificand = 1;
 +    } else {
 +        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
 +    }
 +
-+    qemu_fdt_setprop_cells(vms->fdt, node, "interrupts",
++    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
-+            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
++        if (is_snan(b_cls)) {
-+            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
++            return floatx80_silence_nan(b, status);
-+            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
++        }
-+            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
++        return b;
-+
++    } else {
-+    qemu_fdt_setprop(vms->fdt, node, "interrupt-names", irq_names,
++        if (is_snan(a_cls)) {
-+                     sizeof(irq_names));
++            return floatx80_silence_nan(a, status);
-+
++        }
-+    qemu_fdt_setprop_cell(vms->fdt, node, "clocks", vms->clock_phandle);
++        return a;
-+    qemu_fdt_setprop_string(vms->fdt, node, "clock-names", "apb_pclk");
++    }
 +    qemu_fdt_setprop(vms->fdt, node, "dma-coherent", NULL, 0);
 +
 +    qemu_fdt_setprop_cell(vms->fdt, node, "#iommu-cells", 1);
 +
 +    qemu_fdt_setprop_cell(vms->fdt, node, "phandle", vms->iommu_phandle);
 +    g_free(node);
 +}
 +
-+static void create_pcie(VirtMachineState *vms, qemu_irq *pic)
+ /*----------------------------------------------------------------------------
- {
+ | Takes an abstract floating-point value having sign `zSign', exponent `zExp',
-     hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;
+ | and extended significand formed by the concatenation of `zSig0' and `zSig1',
-     hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+index XXXXXXX..XXXXXXX 100644
-     qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);
+--- a/fpu/softfloat-specialize.c.inc
-     create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ floatx80 floatx80_silence_nan(floatx80 a, float_status *status)
-+    if (vms->iommu) {
+     return a;
 +        vms->iommu_phandle = qemu_fdt_alloc_phandle(vms->fdt);
 +
 +        create_smmu(vms, pic, pci->bus);
 +
 +        qemu_fdt_setprop_cells(vms->fdt, nodename, "iommu-map",
 +                               0x0, vms->iommu_phandle, 0x0, 0x10000);
 +    }
 +
      g_free(nodename);
  }
+-/*----------------------------------------------------------------------------
+-| Takes two extended double-precision floating-point values `a' and `b', one
+-| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
+-| `b' is a signaling NaN, the invalid exception is raised.
+-*----------------------------------------------------------------------------*/
+-
+-floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
+-{
+-    bool aIsLargerSignificand;
+-    FloatClass a_cls, b_cls;
+-
+-    /* This is not complete, but is good enough for pickNaN.  */
+-    a_cls = (!floatx80_is_any_nan(a)
+-             ? float_class_normal
+-             : floatx80_is_signaling_nan(a, status)
+-             ? float_class_snan
+-             : float_class_qnan);
+-    b_cls = (!floatx80_is_any_nan(b)
+-             ? float_class_normal
+-             : floatx80_is_signaling_nan(b, status)
+-             ? float_class_snan
+-             : float_class_qnan);
+-
+-    if (is_snan(a_cls) || is_snan(b_cls)) {
+-        float_raise(float_flag_invalid, status);
+-    }
+-
+-    if (status->default_nan_mode) {
+-        return floatx80_default_nan(status);
+-    }
+-
+-    if (a.low < b.low) {
+-        aIsLargerSignificand = 0;
+-    } else if (b.low < a.low) {
+-        aIsLargerSignificand = 1;
+-    } else {
+-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
+-    }
+-
+-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
+-        if (is_snan(b_cls)) {
+-            return floatx80_silence_nan(b, status);
+-        }
+-        return b;
+-    } else {
+-        if (is_snan(a_cls)) {
+-            return floatx80_silence_nan(a, status);
+-        }
+-        return a;
+-    }
+-}
+-
+ /*----------------------------------------------------------------------------
+ | Returns 1 if the quadruple-precision floating-point value `a' is a quiet
+ | NaN; otherwise returns 0.
 --
-.17.0
+.34.1

-New patch
+[PULL 66/72] softfloat: Use parts_pick_nan in propagateFloatx80NaN
+From: Richard Henderson <richard.henderson@linaro.org>
+Unpacking and repacking the parts may be slightly more work
+than we did before, but we get to reuse more code.  For a
+code path handling exceptional values, this is an improvement.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-8-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ fpu/softfloat.c | 43 +++++--------------------------------------
+file changed, 5 insertions(+), 38 deletions(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
+ floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
+ {
+-    bool aIsLargerSignificand;
+-    FloatClass a_cls, b_cls;
++    FloatParts128 pa, pb, *pr;
+-    /* This is not complete, but is good enough for pickNaN.  */
+-    a_cls = (!floatx80_is_any_nan(a)
+-             ? float_class_normal
+-             : floatx80_is_signaling_nan(a, status)
+-             ? float_class_snan
+-             : float_class_qnan);
+-    b_cls = (!floatx80_is_any_nan(b)
+-             ? float_class_normal
+-             : floatx80_is_signaling_nan(b, status)
+-             ? float_class_snan
+-             : float_class_qnan);
+-
+-    if (is_snan(a_cls) || is_snan(b_cls)) {
+-        float_raise(float_flag_invalid, status);
+-    }
+-
+-    if (status->default_nan_mode) {
++    if (!floatx80_unpack_canonical(&pa, a, status) ||
++        !floatx80_unpack_canonical(&pb, b, status)) {
+         return floatx80_default_nan(status);
+     }
+-    if (a.low < b.low) {
+-        aIsLargerSignificand = 0;
+-    } else if (b.low < a.low) {
+-        aIsLargerSignificand = 1;
+-    } else {
+-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
+-    }
+-
+-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
+-        if (is_snan(b_cls)) {
+-            return floatx80_silence_nan(b, status);
+-        }
+-        return b;
+-    } else {
+-        if (is_snan(a_cls)) {
+-            return floatx80_silence_nan(a, status);
+-        }
+-        return a;
+-    }
++    pr = parts_pick_nan(&pa, &pb, status);
++    return floatx80_round_pack_canonical(pr, status);
+ }
+ /*----------------------------------------------------------------------------
+--
+.34.1

-[Qemu-devel] [PULL 17/24] hw/arm/smmuv3: Implement MMIO write operations
+[PULL 67/72] softfloat: Inline pickNaN
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Now we have relevant helpers for queue and irq
+Inline pickNaN into its only caller.  This makes one assert
-management, let's implement MMIO write operations.
+redundant with the immediately preceding IF.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241203203949.483774-9-richard.henderson@linaro.org
 Message-id: 1524665762-31355-8-git-send-email-eric.auger@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h |   8 +-
+ fpu/softfloat-parts.c.inc      | 82 +++++++++++++++++++++++++----
- hw/arm/smmuv3.c          | 170 +++++++++++++++++++++++++++++++++++++--
+ fpu/softfloat-specialize.c.inc | 96 ----------------------------------
- hw/arm/trace-events      |   6 ++
+files changed, 73 insertions(+), 105 deletions(-)
-files changed, 174 insertions(+), 10 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3-internal.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/hw/arm/smmuv3-internal.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ REG32(CR0,                 0x20)
+@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
-     FIELD(CR0, EVENTQEN,      2, 1)
+ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-     FIELD(CR0, CMDQEN,        3, 1)
+                                      float_status *s)
+ {
-+#define SMMU_CR0_RESERVED 0xFFFFFC20
++    int cmp, which;
 +
- REG32(CR0ACK,              0x24)
+     if (is_snan(a->cls) || is_snan(b->cls)) {
- REG32(CR1,                 0x28)
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
- REG32(CR2,                 0x2c)
+     }
-@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
-     return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
+     if (s->default_nan_mode) {
          parts_default_nan(a, s);
 -    } else {
 -        int cmp = frac_cmp(a, b);
 -        if (cmp == 0) {
 -            cmp = a->sign < b->sign;
 -        }
 +        return a;
 +    }
 -        if (pickNaN(a->cls, b->cls, cmp > 0, s)) {
 -            a = b;
 -        }
 +    cmp = frac_cmp(a, b);
 +    if (cmp == 0) {
 +        cmp = a->sign < b->sign;
 +    }
 +
 +    switch (s->float_2nan_prop_rule) {
 +    case float_2nan_prop_s_ab:
          if (is_snan(a->cls)) {
 -            parts_silence_nan(a, s);
 +            which = 0;
 +        } else if (is_snan(b->cls)) {
 +            which = 1;
 +        } else if (is_qnan(a->cls)) {
 +            which = 0;
 +        } else {
 +            which = 1;
          }
 +        break;
 +    case float_2nan_prop_s_ba:
 +        if (is_snan(b->cls)) {
 +            which = 1;
 +        } else if (is_snan(a->cls)) {
 +            which = 0;
 +        } else if (is_qnan(b->cls)) {
 +            which = 1;
 +        } else {
 +            which = 0;
 +        }
 +        break;
 +    case float_2nan_prop_ab:
 +        which = is_nan(a->cls) ? 0 : 1;
 +        break;
 +    case float_2nan_prop_ba:
 +        which = is_nan(b->cls) ? 1 : 0;
 +        break;
 +    case float_2nan_prop_x87:
 +        /*
 +         * This implements x87 NaN propagation rules:
 +         * SNaN + QNaN => return the QNaN
 +         * two SNaNs => return the one with the larger significand, silenced
 +         * two QNaNs => return the one with the larger significand
 +         * SNaN and a non-NaN => return the SNaN, silenced
 +         * QNaN and a non-NaN => return the QNaN
 +         *
 +         * If we get down to comparing significands and they are the same,
 +         * return the NaN with the positive sign bit (if any).
 +         */
 +        if (is_snan(a->cls)) {
 +            if (is_snan(b->cls)) {
 +                which = cmp > 0 ? 0 : 1;
 +            } else {
 +                which = is_qnan(b->cls) ? 1 : 0;
 +            }
 +        } else if (is_qnan(a->cls)) {
 +            if (is_snan(b->cls) || !is_qnan(b->cls)) {
 +                which = 0;
 +            } else {
 +                which = cmp > 0 ? 0 : 1;
 +            }
 +        } else {
 +            which = 1;
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    if (which) {
 +        a = b;
 +    }
 +    if (is_snan(a->cls)) {
 +        parts_silence_nan(a, s);
      }
      return a;
  }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 -/* public until callers get introduced */
 -void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
 -void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
 -
  /* Queue Handling */
  #define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
              addr;                                             \
          })
 -int smmuv3_cmdq_consume(SMMUv3State *s);
 +#define SMMU_FEATURE_2LVL_STE (1 << 0)
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/smmuv3.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/hw/arm/smmuv3.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool float32_is_signaling_nan(float32 a_, float_status *status)
   * @irq: irq type
   * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
   */
 -void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
 +static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
 +                               uint32_t gerror_mask)
  {
      bool pulse = false;
@@ -XXX,XX +XXX,XX @@ void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
      }
  }
--void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+-/*----------------------------------------------------------------------------
-+static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+-| Select which NaN to propagate for a two-input operation.
- {
+-| IEEE754 doesn't specify all the details of this, so the
-     uint32_t pending = s->gerror ^ s->gerrorn;
+-| algorithm is target-specific.
-     uint32_t toggled = s->gerrorn ^ new_gerrorn;
+-| The routine is passed various bits of information about the
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
+-| two NaNs and should return 0 to select NaN a and 1 for NaN b.
-     s->sid_split = 0;
+-| Note that signalling NaNs are always squashed to quiet NaNs
- }
+-| by the caller, by calling floatXX_silence_nan() before
+-| returning them.
--int smmuv3_cmdq_consume(SMMUv3State *s)
+-|
-+static int smmuv3_cmdq_consume(SMMUv3State *s)
+-| aIsLargerSignificand is only valid if both a and b are NaNs
- {
+-| of some kind, and is true if a has the larger significand,
-     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
+-| or if both a and b have the same significand but a is
-     SMMUQueue *q = &s->cmdq;
+-| positive but b is negative. It is only needed for the x87
-@@ -XXX,XX +XXX,XX @@ int smmuv3_cmdq_consume(SMMUv3State *s)
+-| tie-break rule.
-     return 0;
+-*----------------------------------------------------------------------------*/
- }
+-
+-static int pickNaN(FloatClass a_cls, FloatClass b_cls,
-+static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
+-                   bool aIsLargerSignificand, float_status *status)
-+                               uint64_t data, MemTxAttrs attrs)
+-{
-+{
+-    /*
-+    switch (offset) {
+-     * We guarantee not to require the target to tell us how to
-+    case A_GERROR_IRQ_CFG0:
+-     * pick a NaN if we're always returning the default NaN.
-+        s->gerror_irq_cfg0 = data;
+-     * But if we're not in default-NaN mode then the target must
-+        return MEMTX_OK;
+-     * specify via set_float_2nan_prop_rule().
-+    case A_STRTAB_BASE:
+-     */
-+        s->strtab_base = data;
+-    assert(!status->default_nan_mode);
-+        return MEMTX_OK;
+-
-+    case A_CMDQ_BASE:
+-    switch (status->float_2nan_prop_rule) {
-+        s->cmdq.base = data;
+-    case float_2nan_prop_s_ab:
-+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+-        if (is_snan(a_cls)) {
-+        if (s->cmdq.log2size > SMMU_CMDQS) {
+-            return 0;
-+            s->cmdq.log2size = SMMU_CMDQS;
+-        } else if (is_snan(b_cls)) {
-+        }
+-            return 1;
-+        return MEMTX_OK;
+-        } else if (is_qnan(a_cls)) {
-+    case A_EVENTQ_BASE:
+-            return 0;
-+        s->eventq.base = data;
+-        } else {
-+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
+-            return 1;
-+        if (s->eventq.log2size > SMMU_EVENTQS) {
+-        }
-+            s->eventq.log2size = SMMU_EVENTQS;
+-        break;
-+        }
+-    case float_2nan_prop_s_ba:
-+        return MEMTX_OK;
+-        if (is_snan(b_cls)) {
-+    case A_EVENTQ_IRQ_CFG0:
+-            return 1;
-+        s->eventq_irq_cfg0 = data;
+-        } else if (is_snan(a_cls)) {
-+        return MEMTX_OK;
+-            return 0;
-+    default:
+-        } else if (is_qnan(b_cls)) {
-+        qemu_log_mask(LOG_UNIMP,
+-            return 1;
-+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
+-        } else {
-+                      __func__, offset);
+-            return 0;
-+        return MEMTX_OK;
+-        }
-+    }
+-        break;
-+}
+-    case float_2nan_prop_ab:
-+
+-        if (is_nan(a_cls)) {
-+static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
+-            return 0;
-+                               uint64_t data, MemTxAttrs attrs)
+-        } else {
-+{
+-            return 1;
-+    switch (offset) {
+-        }
-+    case A_CR0:
+-        break;
-+        s->cr[0] = data;
+-    case float_2nan_prop_ba:
-+        s->cr0ack = data & ~SMMU_CR0_RESERVED;
+-        if (is_nan(b_cls)) {
-+        /* in case the command queue has been enabled */
+-            return 1;
-+        smmuv3_cmdq_consume(s);
+-        } else {
-+        return MEMTX_OK;
+-            return 0;
-+    case A_CR1:
+-        }
-+        s->cr[1] = data;
+-        break;
-+        return MEMTX_OK;
+-    case float_2nan_prop_x87:
-+    case A_CR2:
+-        /*
-+        s->cr[2] = data;
+-         * This implements x87 NaN propagation rules:
-+        return MEMTX_OK;
+-         * SNaN + QNaN => return the QNaN
-+    case A_IRQ_CTRL:
+-         * two SNaNs => return the one with the larger significand, silenced
-+        s->irq_ctrl = data;
+-         * two QNaNs => return the one with the larger significand
-+        return MEMTX_OK;
+-         * SNaN and a non-NaN => return the SNaN, silenced
-+    case A_GERRORN:
+-         * QNaN and a non-NaN => return the QNaN
-+        smmuv3_write_gerrorn(s, data);
+-         *
-+        /*
+-         * If we get down to comparing significands and they are the same,
-+         * By acknowledging the CMDQ_ERR, SW may notify cmds can
+-         * return the NaN with the positive sign bit (if any).
-+         * be processed again
+-         */
-+         */
+-        if (is_snan(a_cls)) {
-+        smmuv3_cmdq_consume(s);
+-            if (is_snan(b_cls)) {
-+        return MEMTX_OK;
+-                return aIsLargerSignificand ? 0 : 1;
-+    case A_GERROR_IRQ_CFG0: /* 64b */
+-            }
-+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
+-            return is_qnan(b_cls) ? 1 : 0;
-+        return MEMTX_OK;
+-        } else if (is_qnan(a_cls)) {
-+    case A_GERROR_IRQ_CFG0 + 4:
+-            if (is_snan(b_cls) || !is_qnan(b_cls)) {
-+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
+-                return 0;
-+        return MEMTX_OK;
+-            } else {
-+    case A_GERROR_IRQ_CFG1:
+-                return aIsLargerSignificand ? 0 : 1;
-+        s->gerror_irq_cfg1 = data;
+-            }
-+        return MEMTX_OK;
+-        } else {
-+    case A_GERROR_IRQ_CFG2:
+-            return 1;
-+        s->gerror_irq_cfg2 = data;
+-        }
-+        return MEMTX_OK;
+-    default:
-+    case A_STRTAB_BASE: /* 64b */
+-        g_assert_not_reached();
-+        s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
+-    }
-+        return MEMTX_OK;
+-}
-+    case A_STRTAB_BASE + 4:
+-
-+        s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
+ /*----------------------------------------------------------------------------
-+        return MEMTX_OK;
+ | Returns 1 if the double-precision floating-point value `a' is a quiet
-+    case A_STRTAB_BASE_CFG:
+ | NaN; otherwise returns 0.
 +        s->strtab_base_cfg = data;
 +        if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
 +            s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
 +            s->features |= SMMU_FEATURE_2LVL_STE;
 +        }
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE: /* 64b */
 +        s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
 +        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
 +        if (s->cmdq.log2size > SMMU_CMDQS) {
 +            s->cmdq.log2size = SMMU_CMDQS;
 +        }
 +        return MEMTX_OK;
 +    case A_CMDQ_BASE + 4: /* 64b */
 +        s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_CMDQ_PROD:
 +        s->cmdq.prod = data;
 +        smmuv3_cmdq_consume(s);
 +        return MEMTX_OK;
 +    case A_CMDQ_CONS:
 +        s->cmdq.cons = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE: /* 64b */
 +        s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
 +        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
 +        if (s->eventq.log2size > SMMU_EVENTQS) {
 +            s->eventq.log2size = SMMU_EVENTQS;
 +        }
 +        return MEMTX_OK;
 +    case A_EVENTQ_BASE + 4:
 +        s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_PROD:
 +        s->eventq.prod = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_CONS:
 +        s->eventq.cons = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG0: /* 64b */
 +        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG0 + 4:
 +        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG1:
 +        s->eventq_irq_cfg1 = data;
 +        return MEMTX_OK;
 +    case A_EVENTQ_IRQ_CFG2:
 +        s->eventq_irq_cfg2 = data;
 +        return MEMTX_OK;
 +    default:
 +        qemu_log_mask(LOG_UNIMP,
 +                      "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
 +                      __func__, offset);
 +        return MEMTX_OK;
 +    }
 +}
 +
  static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                     unsigned size, MemTxAttrs attrs)
  {
 -    /* not yet implemented */
 -    return MEMTX_ERROR;
 +    SMMUState *sys = opaque;
 +    SMMUv3State *s = ARM_SMMUV3(sys);
 +    MemTxResult r;
 +
 +    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
 +    offset &= ~0x10000;
 +
 +    switch (size) {
 +    case 8:
 +        r = smmu_writell(s, offset, data, attrs);
 +        break;
 +    case 4:
 +        r = smmu_writel(s, offset, data, attrs);
 +        break;
 +    default:
 +        r = MEMTX_ERROR;
 +        break;
 +    }
 +
 +    trace_smmuv3_write_mmio(offset, data, size, r);
 +    return r;
  }
  static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t con
  smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
  smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
  smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
 +smmuv3_update(bool is_empty, uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "q empty:%d prod:%d cons:%d p.wrap:%d p.cons:%d"
 +smmuv3_update_check_cmd(int error) "cmdq not enabled or error :0x%x"
 +smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
 +smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
 +smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 +smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 13/24] hw/arm/smmu-common: VMSAv8-64 page table walk
+[PULL 68/72] softfloat: Share code between parts_pick_nan cases
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-This patch implements the page table walk for VMSAv8-64.
+Remember if there was an SNaN, and use that to simplify
 float_2nan_prop_s_{ab,ba} to only the snan component.
 Then, fall through to the corresponding
 float_2nan_prop_{ab,ba} case to handle any remaining
 nans, which must be quiet.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
 Message-id: 1524665762-31355-4-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241203203949.483774-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmu-internal.h       |  99 ++++++++++++++++
+ fpu/softfloat-parts.c.inc | 32 ++++++++++++--------------------
- include/hw/arm/smmu-common.h |  14 +++
+file changed, 12 insertions(+), 20 deletions(-)
  hw/arm/smmu-common.c         | 222 +++++++++++++++++++++++++++++++++++
  hw/arm/trace-events          |   9 +-
 files changed, 343 insertions(+), 1 deletion(-)
  create mode 100644 hw/arm/smmu-internal.h
-diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * ARM SMMU support - Internal API
 + *
 + * Copyright (c) 2017 Red Hat, Inc.
 + * Copyright (C) 2014-2016 Broadcom Corporation
 + * Written by Prem Mallappa, Eric Auger
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License version 2 as
 + * published by the Free Software Foundation.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License along
 + * with this program; if not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#ifndef HW_ARM_SMMU_INTERNAL_H
 +#define HW_ARM_SMMU_INTERNAL_H
 +
 +#define TBI0(tbi) ((tbi) & 0x1)
 +#define TBI1(tbi) ((tbi) & 0x2 >> 1)
 +
 +/* PTE Manipulation */
 +
 +#define ARM_LPAE_PTE_TYPE_SHIFT         0
 +#define ARM_LPAE_PTE_TYPE_MASK          0x3
 +
 +#define ARM_LPAE_PTE_TYPE_BLOCK         1
 +#define ARM_LPAE_PTE_TYPE_TABLE         3
 +
 +#define ARM_LPAE_L3_PTE_TYPE_RESERVED   1
 +#define ARM_LPAE_L3_PTE_TYPE_PAGE       3
 +
 +#define ARM_LPAE_PTE_VALID              (1 << 0)
 +
 +#define PTE_ADDRESS(pte, shift) \
 +    (extract64(pte, shift, 47 - shift + 1) << shift)
 +
 +#define is_invalid_pte(pte) (!(pte & ARM_LPAE_PTE_VALID))
 +
 +#define is_reserved_pte(pte, level)                                      \
 +    ((level == 3) &&                                                     \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_RESERVED))
 +
 +#define is_block_pte(pte, level)                                         \
 +    ((level < 3) &&                                                      \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_BLOCK))
 +
 +#define is_table_pte(pte, level)                                        \
 +    ((level < 3) &&                                                     \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_TABLE))
 +
 +#define is_page_pte(pte, level)                                         \
 +    ((level == 3) &&                                                    \
 +     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_PAGE))
 +
 +/* access permissions */
 +
 +#define PTE_AP(pte) \
 +    (extract64(pte, 6, 2))
 +
 +#define PTE_APTABLE(pte) \
 +    (extract64(pte, 61, 2))
 +
 +/*
 + * TODO: At the moment all transactions are considered as privileged (EL1)
 + * as IOMMU translation callback does not pass user/priv attributes.
 + */
 +#define is_permission_fault(ap, perm) \
 +    (((perm) & IOMMU_WO) && ((ap) & 0x2))
 +
 +#define PTE_AP_TO_PERM(ap) \
 +    (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
 +
 +/* Level Indexing */
 +
 +static inline int level_shift(int level, int granule_sz)
 +{
 +    return granule_sz + (3 - level) * (granule_sz - 3);
 +}
 +
 +static inline uint64_t level_page_mask(int level, int granule_sz)
 +{
 +    return ~(MAKE_64BIT_MASK(0, level_shift(level, granule_sz)));
 +}
 +
 +static inline
 +uint64_t iova_level_offset(uint64_t iova, int inputsize,
 +                           int level, int gsz)
 +{
 +    return ((iova & MAKE_64BIT_MASK(0, inputsize)) >> level_shift(level, gsz)) &
 +            MAKE_64BIT_MASK(0, gsz - 3);
 +}
 +
 +#endif
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/smmu-common.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/include/hw/arm/smmu-common.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
+@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
  static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
                                       float_status *s)
  {
-     return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
++    bool have_snan = false;
- }
+     int cmp, which;
-+
-+/**
+     if (is_snan(a->cls) || is_snan(b->cls)) {
-+ * smmu_ptw - Perform the page table walk for a given iova / access flags
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
-+ * pair, according to @cfg translation config
++        have_snan = true;
-+ */
+     }
-+int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
-+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info);
+     if (s->default_nan_mode) {
-+
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-+/**
-+ * select_tt - compute which translation table shall be used according to
+     switch (s->float_2nan_prop_rule) {
-+ * the input iova and translation config and return the TT specific info
+     case float_2nan_prop_s_ab:
-+ */
+-        if (is_snan(a->cls)) {
-+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova);
+-            which = 0;
-+
+-        } else if (is_snan(b->cls)) {
- #endif  /* HW_ARM_SMMU_COMMON */
+-            which = 1;
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
+-        } else if (is_qnan(a->cls)) {
-index XXXXXXX..XXXXXXX 100644
+-            which = 0;
---- a/hw/arm/smmu-common.c
+-        } else {
-+++ b/hw/arm/smmu-common.c
+-            which = 1;
-@@ -XXX,XX +XXX,XX @@
++        if (have_snan) {
++            which = is_snan(a->cls) ? 0 : 1;
- #include "qemu/error-report.h"
++            break;
- #include "hw/arm/smmu-common.h"
+         }
-+#include "smmu-internal.h"
+-        break;
-+
+-    case float_2nan_prop_s_ba:
-+/* VMSAv8-64 Translation */
+-        if (is_snan(b->cls)) {
-+
+-            which = 1;
-+/**
+-        } else if (is_snan(a->cls)) {
-+ * get_pte - Get the content of a page table entry located at
+-            which = 0;
-+ * @base_addr[@index]
+-        } else if (is_qnan(b->cls)) {
-+ */
+-            which = 1;
-+static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
+-        } else {
-+                   SMMUPTWEventInfo *info)
+-            which = 0;
-+{
+-        }
-+    int ret;
+-        break;
-+    dma_addr_t addr = baseaddr + index * sizeof(*pte);
++        /* fall through */
-+
+     case float_2nan_prop_ab:
-+    /* TODO: guarantee 64-bit single-copy atomicity */
+         which = is_nan(a->cls) ? 0 : 1;
-+    ret = dma_memory_read(&address_space_memory, addr,
+         break;
-+                          (uint8_t *)pte, sizeof(*pte));
++    case float_2nan_prop_s_ba:
-+
++        if (have_snan) {
-+    if (ret != MEMTX_OK) {
++            which = is_snan(b->cls) ? 1 : 0;
-+        info->type = SMMU_PTW_ERR_WALK_EABT;
++            break;
 +        info->addr = addr;
 +        return -EINVAL;
 +    }
 +    trace_smmu_get_pte(baseaddr, index, addr, *pte);
 +    return 0;
 +}
 +
 +/* VMSAv8-64 Translation Table Format Descriptor Decoding */
 +
 +/**
 + * get_page_pte_address - returns the L3 descriptor output address,
 + * ie. the page frame
 + * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
 + */
 +static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
 +{
 +    return PTE_ADDRESS(pte, granule_sz);
 +}
 +
 +/**
 + * get_table_pte_address - return table descriptor output address,
 + * ie. address of next level table
 + * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
 + */
 +static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
 +{
 +    return PTE_ADDRESS(pte, granule_sz);
 +}
 +
 +/**
 + * get_block_pte_address - return block descriptor output address and block size
 + * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
 + */
 +static inline hwaddr get_block_pte_address(uint64_t pte, int level,
 +                                           int granule_sz, uint64_t *bsz)
 +{
 +    int n = (granule_sz - 3) * (4 - level) + 3;
 +
 +    *bsz = 1 << n;
 +    return PTE_ADDRESS(pte, n);
 +}
 +
 +SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
 +{
 +    bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
 +    uint8_t tbi_byte = tbi * 8;
 +
 +    if (cfg->tt[0].tsz &&
 +        !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
 +        /* there is a ttbr0 region and we are in it (high bits all zero) */
 +        return &cfg->tt[0];
 +    } else if (cfg->tt[1].tsz &&
 +           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
 +        /* there is a ttbr1 region and we are in it (high bits all one) */
 +        return &cfg->tt[1];
 +    } else if (!cfg->tt[0].tsz) {
 +        /* ttbr0 region is "everything not in the ttbr1 region" */
 +        return &cfg->tt[0];
 +    } else if (!cfg->tt[1].tsz) {
 +        /* ttbr1 region is "everything not in the ttbr0 region" */
 +        return &cfg->tt[1];
 +    }
 +    /* in the gap between the two regions, this is a Translation fault */
 +    return NULL;
 +}
 +
 +/**
 + * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
 + * @cfg: translation config
 + * @iova: iova to translate
 + * @perm: access type
 + * @tlbe: IOMMUTLBEntry (out)
 + * @info: handle to an error info
 + *
 + * Return 0 on success, < 0 on error. In case of error, @info is filled
 + * and tlbe->perm is set to IOMMU_NONE.
 + * Upon success, @tlbe is filled with translated_addr and entry
 + * permission rights.
 + */
 +static int smmu_ptw_64(SMMUTransCfg *cfg,
 +                       dma_addr_t iova, IOMMUAccessFlags perm,
 +                       IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    dma_addr_t baseaddr, indexmask;
 +    int stage = cfg->stage;
 +    SMMUTransTableInfo *tt = select_tt(cfg, iova);
 +    uint8_t level, granule_sz, inputsize, stride;
 +
 +    if (!tt || tt->disabled) {
 +        info->type = SMMU_PTW_ERR_TRANSLATION;
 +        goto error;
 +    }
 +
 +    granule_sz = tt->granule_sz;
 +    stride = granule_sz - 3;
 +    inputsize = 64 - tt->tsz;
 +    level = 4 - (inputsize - 4) / stride;
 +    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
 +    baseaddr = extract64(tt->ttb, 0, 48);
 +    baseaddr &= ~indexmask;
 +
 +    tlbe->iova = iova;
 +    tlbe->addr_mask = (1 << granule_sz) - 1;
 +
 +    while (level <= 3) {
 +        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
 +        uint64_t mask = subpage_size - 1;
 +        uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
 +        uint64_t pte;
 +        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
 +        uint8_t ap;
 +
 +        if (get_pte(baseaddr, offset, &pte, info)) {
 +                goto error;
 +        }
-+        trace_smmu_ptw_level(level, iova, subpage_size,
++        /* fall through */
-+                             baseaddr, offset, pte);
+     case float_2nan_prop_ba:
-+
+         which = is_nan(b->cls) ? 1 : 0;
-+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+         break;
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            info->type = SMMU_PTW_ERR_TRANSLATION;
 +            goto error;
 +        }
 +
 +        if (is_page_pte(pte, level)) {
 +            uint64_t gpa = get_page_pte_address(pte, granule_sz);
 +
 +            ap = PTE_AP(pte);
 +            if (is_permission_fault(ap, perm)) {
 +                info->type = SMMU_PTW_ERR_PERMISSION;
 +                goto error;
 +            }
 +
 +            tlbe->translated_addr = gpa + (iova & mask);
 +            tlbe->perm = PTE_AP_TO_PERM(ap);
 +            trace_smmu_ptw_page_pte(stage, level, iova,
 +                                    baseaddr, pte_addr, pte, gpa);
 +            return 0;
 +        }
 +        if (is_block_pte(pte, level)) {
 +            uint64_t block_size;
 +            hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
 +                                               &block_size);
 +
 +            ap = PTE_AP(pte);
 +            if (is_permission_fault(ap, perm)) {
 +                info->type = SMMU_PTW_ERR_PERMISSION;
 +                goto error;
 +            }
 +
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, iova, gpa,
 +                                     block_size >> 20);
 +
 +            tlbe->translated_addr = gpa + (iova & mask);
 +            tlbe->perm = PTE_AP_TO_PERM(ap);
 +            return 0;
 +        }
 +
 +        /* table pte */
 +        ap = PTE_APTABLE(pte);
 +
 +        if (is_permission_fault(ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +        baseaddr = get_table_pte_address(pte, granule_sz);
 +        level++;
 +    }
 +
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    tlbe->perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
 +/**
 + * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
 + *
 + * @cfg: translation configuration
 + * @iova: iova to translate
 + * @perm: tentative access type
 + * @tlbe: returned entry
 + * @info: ptw event handle
 + *
 + * return 0 on success
 + */
 +inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
 +             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    if (!cfg->aa64) {
 +        /*
 +         * This code path is not entered as we check this while decoding
 +         * the configuration data in the derived SMMU model.
 +         */
 +        g_assert_not_reached();
 +    }
 +
 +    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
 +}
  /**
   * The bus number is used for lookup when SID based invalidation occurs.
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
  virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
  # hw/arm/smmu-common.c
 -smmu_add_mr(const char *name) "%s"
 \ No newline at end of file
 +smmu_add_mr(const char *name) "%s"
 +smmu_page_walk(int stage, uint64_t baseaddr, int first_level, uint64_t start, uint64_t end) "stage=%d, baseaddr=0x%"PRIx64", first level=%d, start=0x%"PRIx64", end=0x%"PRIx64
 +smmu_lookup_table(int level, uint64_t baseaddr, int granule_sz, uint64_t start, uint64_t end, int flags, uint64_t subpage_size) "level=%d baseaddr=0x%"PRIx64" granule=%d, start=0x%"PRIx64" end=0x%"PRIx64" flags=%d subpage_size=0x%"PRIx64
 +smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%lx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 +smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 +smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 +smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 +smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 07/24] target/arm: Tidy conditions in handle_vec_simd_shri
+[PULL 69/72] softfloat: Sink frac_cmp in parts_pick_nan until needed
 From: Richard Henderson <richard.henderson@linaro.org>
-The (size > 3 && !is_q) condition is identical to the preceeding test
+Move the fractional comparison to the end of the
-of bit 3 in immh; eliminate it.  For the benefit of Coverity, assert
+float_2nan_prop_x87 case.  This is not required for
-that size is within the bounds we expect.
+any other 2nan propagation rule.  Reorganize the
 x87 case itself to break out of the switch when the
 fractional comparison is not required.
-Fixes: Coverity CID1385846
-Fixes: Coverity CID1385849
-Fixes: Coverity CID1385852
-Fixes: Coverity CID1385857
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180501180455.11214-2-richard.henderson@linaro.org
+Message-id: 20241203203949.483774-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 6 +-----
+ fpu/softfloat-parts.c.inc | 19 +++++++++----------
-file changed, 1 insertion(+), 5 deletions(-)
+file changed, 9 insertions(+), 10 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/translate-a64.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-         unallocated_encoding(s);
+         return a;
          return;
      }
+-    cmp = frac_cmp(a, b);
+-    if (cmp == 0) {
+-        cmp = a->sign < b->sign;
+-    }
 -
--    if (size > 3 && !is_q) {
+     switch (s->float_2nan_prop_rule) {
--        unallocated_encoding(s);
+     case float_2nan_prop_s_ab:
--        return;
+         if (have_snan) {
--    }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-+    tcg_debug_assert(size <= 3);
+          * return the NaN with the positive sign bit (if any).
+          */
-     if (!fp_access_check(s)) {
+         if (is_snan(a->cls)) {
-         return;
+-            if (is_snan(b->cls)) {
 -                which = cmp > 0 ? 0 : 1;
 -            } else {
 +            if (!is_snan(b->cls)) {
                  which = is_qnan(b->cls) ? 1 : 0;
 +                break;
              }
          } else if (is_qnan(a->cls)) {
              if (is_snan(b->cls) || !is_qnan(b->cls)) {
                  which = 0;
 -            } else {
 -                which = cmp > 0 ? 0 : 1;
 +                break;
              }
          } else {
              which = 1;
 +            break;
          }
 +        cmp = frac_cmp(a, b);
 +        if (cmp == 0) {
 +            cmp = a->sign < b->sign;
 +        }
 +        which = cmp > 0 ? 0 : 1;
          break;
      default:
          g_assert_not_reached();
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 21/24] target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
+[PULL 70/72] softfloat: Replace WHICH with RET in parts_pick_nan
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-In case the MSI is translated by an IOMMU we need to fixup the
+Replace the "index" selecting between A and B with a result variable
-MSI route with the translated address.
+of the proper type.  This improves clarity within the function.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Bharat Bhushan <Bharat.Bhushan@nxp.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 1524665762-31355-12-git-send-email-eric.auger@redhat.com
+Message-id: 20241203203949.483774-12-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm.c        | 38 +++++++++++++++++++++++++++++++++++++-
+ fpu/softfloat-parts.c.inc | 28 +++++++++++++---------------
- target/arm/trace-events |  3 +++
+file changed, 13 insertions(+), 15 deletions(-)
 files changed, 40 insertions(+), 1 deletion(-)
-diff --git a/target/arm/kvm.c b/target/arm/kvm.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/kvm.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
- #include "sysemu/kvm.h"
+                                      float_status *s)
  #include "kvm_arm.h"
  #include "cpu.h"
 +#include "trace.h"
  #include "internals.h"
  #include "hw/arm/arm.h"
 +#include "hw/pci/pci.h"
  #include "exec/memattrs.h"
  #include "exec/address-spaces.h"
  #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
  int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
                               uint64_t address, uint32_t data, PCIDevice *dev)
  {
--    return 0;
+     bool have_snan = false;
-+    AddressSpace *as = pci_device_iommu_address_space(dev);
+-    int cmp, which;
-+    hwaddr xlat, len, doorbell_gpa;
++    FloatPartsN *ret;
-+    MemoryRegionSection mrs;
++    int cmp;
-+    MemoryRegion *mr;
-+    int ret = 1;
+     if (is_snan(a->cls) || is_snan(b->cls)) {
-+
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
-+    if (as == &address_space_memory) {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-+        return 0;
+     switch (s->float_2nan_prop_rule) {
-+    }
+     case float_2nan_prop_s_ab:
-+
+         if (have_snan) {
-+    /* MSI doorbell address is translated by an IOMMU */
+-            which = is_snan(a->cls) ? 0 : 1;
-+
++            ret = is_snan(a->cls) ? a : b;
-+    rcu_read_lock();
+             break;
-+    mr = address_space_translate(as, address, &xlat, &len, true);
+         }
-+    if (!mr) {
+         /* fall through */
-+        goto unlock;
+     case float_2nan_prop_ab:
-+    }
+-        which = is_nan(a->cls) ? 0 : 1;
-+    mrs = memory_region_find(mr, xlat, 1);
++        ret = is_nan(a->cls) ? a : b;
-+    if (!mrs.mr) {
+         break;
-+        goto unlock;
+     case float_2nan_prop_s_ba:
-+    }
+         if (have_snan) {
-+
+-            which = is_snan(b->cls) ? 1 : 0;
-+    doorbell_gpa = mrs.offset_within_address_space;
++            ret = is_snan(b->cls) ? b : a;
-+    memory_region_unref(mrs.mr);
+             break;
-+
+         }
-+    route->u.msi.address_lo = doorbell_gpa;
+         /* fall through */
-+    route->u.msi.address_hi = doorbell_gpa >> 32;
+     case float_2nan_prop_ba:
-+
+-        which = is_nan(b->cls) ? 1 : 0;
-+    trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
++        ret = is_nan(b->cls) ? b : a;
-+
+         break;
-+    ret = 0;
+     case float_2nan_prop_x87:
-+
+         /*
-+unlock:
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-+    rcu_read_unlock();
+          */
          if (is_snan(a->cls)) {
              if (!is_snan(b->cls)) {
 -                which = is_qnan(b->cls) ? 1 : 0;
 +                ret = is_qnan(b->cls) ? b : a;
                  break;
              }
          } else if (is_qnan(a->cls)) {
              if (is_snan(b->cls) || !is_qnan(b->cls)) {
 -                which = 0;
 +                ret = a;
                  break;
              }
          } else {
 -            which = 1;
 +            ret = b;
              break;
          }
          cmp = frac_cmp(a, b);
          if (cmp == 0) {
              cmp = a->sign < b->sign;
          }
 -        which = cmp > 0 ? 0 : 1;
 +        ret = cmp > 0 ? a : b;
          break;
      default:
          g_assert_not_reached();
      }
 -    if (which) {
 -        a = b;
 +    if (is_snan(ret->cls)) {
 +        parts_silence_nan(ret, s);
      }
 -    if (is_snan(a->cls)) {
 -        parts_silence_nan(a, s);
 -    }
 -    return a;
 +    return ret;
  }
- int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
+ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
 diff --git a/target/arm/trace-events b/target/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/trace-events
 +++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
  arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
  arm_gt_imask_toggle(int timer, int irqstate) "gt_ctl_write: timer %d IMASK toggle, new irqstate %d"
  arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
 +
 +# target/arm/kvm.c
 +kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 09/24] hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
+[PULL 71/72] MAINTAINERS: update email address for Leif Lindholm
-From: Thomas Huth <thuth@redhat.com>
+From: Leif Lindholm <quic_llindhol@quicinc.com>
-When running omap1/2 or pxa2xx based ARM machines with -nodefaults,
+I'm migrating to Qualcomm's new open source email infrastructure, so
-they bail out immediately complaining about a "missing SecureDigital
+update my email address, and update the mailmap to match.
 device". That's not how the "default" devices in vl.c are meant to
 work - it should be possible for a board to also start up without
 default devices. So let's turn the error message and exit() into
 a warning instead.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
-Message-id: 1525326811-3233-1-git-send-email-thuth@redhat.com
+Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20241205114047.1125842-1-leif.lindholm@oss.qualcomm.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/omap1.c  |  8 ++++----
+ MAINTAINERS | 2 +-
- hw/arm/omap2.c  |  8 ++++----
+ .mailmap    | 5 +++--
- hw/arm/pxa2xx.c | 15 +++++++--------
+files changed, 4 insertions(+), 3 deletions(-)
 files changed, 15 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/omap1.c
+--- a/MAINTAINERS
-+++ b/hw/arm/omap1.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
- #include "hw/arm/soc_dma.h"
+ SBSA-REF
- #include "sysemu/block-backend.h"
+ M: Radoslaw Biernacki <rad@semihalf.com>
- #include "sysemu/blockdev.h"
+ M: Peter Maydell <peter.maydell@linaro.org>
-+#include "sysemu/qtest.h"
+-R: Leif Lindholm <quic_llindhol@quicinc.com>
- #include "qemu/range.h"
++R: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
- #include "hw/sysbus.h"
+ R: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
- #include "qemu/cutils.h"
+ L: qemu-arm@nongnu.org
-@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
+ S: Maintained
-                                 omap_findclk(s, "dpll3"));
+diff --git a/.mailmap b/.mailmap
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = omap_mmc_init(0xfffb7800, system_memory,
 -                           blk_by_legacy_dinfo(dinfo),
 +                           dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                             qdev_get_gpio_in(s->ih[1], OMAP_INT_OQN),
                             &s->drq[OMAP_DMA_MMC_TX],
                      omap_findclk(s, "mmc_ck"));
 diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/omap2.c
+--- a/.mailmap
-+++ b/hw/arm/omap2.c
++++ b/.mailmap
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
- #include "cpu.h"
+ Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
- #include "sysemu/block-backend.h"
+ James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
- #include "sysemu/blockdev.h"
+ Juan Quintela <quintela@trasno.org> <quintela@redhat.com>
-+#include "sysemu/qtest.h"
+-Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
- #include "hw/boards.h"
+-Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
- #include "hw/hw.h"
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <quic_llindhol@quicinc.com>
- #include "hw/arm/arm.h"
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif.lindholm@linaro.org>
-@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif@nuviainc.com>
-                              s->drq[OMAP24XX_DMA_GPMC]);
+ Luc Michel <luc@lmichel.fr> <luc.michel@git.antfield.fr>
+ Luc Michel <luc@lmichel.fr> <luc.michel@greensocs.com>
-     dinfo = drive_get(IF_SD, 0, 0);
+ Luc Michel <luc@lmichel.fr> <lmichel@kalray.eu>
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = omap2_mmc_init(omap_l4tao(s->l4, 9),
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->ih[0], OMAP_INT_24XX_MMC_IRQ),
                      &s->drq[OMAP24XX_DMA_MMC1_TX],
                      omap_findclk(s, "mmc_fclk"), omap_findclk(s, "mmc_iclk"));
 diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx.c
 +++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
  #include "chardev/char-fe.h"
  #include "sysemu/block-backend.h"
  #include "sysemu/blockdev.h"
 +#include "sysemu/qtest.h"
  #include "qemu/cutils.h"
  static struct {
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
      s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                      qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                      qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
      s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
      dinfo = drive_get(IF_SD, 0, 0);
 -    if (!dinfo) {
 -        error_report("missing SecureDigital device");
 -        exit(1);
 +    if (!dinfo && !qtest_enabled()) {
 +        warn_report("missing SecureDigital device");
      }
      s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
 -                    blk_by_legacy_dinfo(dinfo),
 +                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                      qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                      qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                      qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
 --
-.17.0
+.34.1

-[Qemu-devel] [PULL 01/24] hw/arm/virt: Add linux, pci-domain property
+[PULL 72/72] MAINTAINERS: Add correct email address for Vikram Garhwal
-From: Jan Kiszka <jan.kiszka@siemens.com>
+From: Vikram Garhwal <vikram.garhwal@bytedance.com>
-This allows to pin the host controller in the Linux PCI domain space.
+Previously, maintainer role was paused due to inactive email id. Commit id:
-Linux requires that property to be available consistently or not at all,
+c009d715721861984c4987bcc78b7ee183e86d75.
 in which case the domain number becomes unstable on additions/removals.
 Adding it here won't make a difference in practice for most setups as we
 only expose one controller.
-However, enabling Jailhouse on top may introduce another controller, and
+Signed-off-by: Vikram Garhwal <vikram.garhwal@bytedance.com>
-that one would like to have stable address as well. So the property is
+Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
-needed for the first controller as well.
+Message-id: 20241204184205.12952-1-vikram.garhwal@bytedance.com
 Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
 Message-id: 3301c5bc-7b47-1b0e-8ce4-30435057a276@web.de
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 1 +
+ MAINTAINERS | 2 ++
-file changed, 1 insertion(+)
+file changed, 2 insertions(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/MAINTAINERS
-+++ b/hw/arm/virt.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@ F: tests/qtest/fuzz-sb16-test.c
-     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "pci");
-     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 3);
+ Xilinx CAN
-     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 2);
+ M: Francisco Iglesias <francisco.iglesias@amd.com>
-+    qemu_fdt_setprop_cell(vms->fdt, nodename, "linux,pci-domain", 0);
++M: Vikram Garhwal <vikram.garhwal@bytedance.com>
-     qemu_fdt_setprop_cells(vms->fdt, nodename, "bus-range", 0,
+ S: Maintained
-                            nr_pcie_buses - 1);
+ F: hw/net/can/xlnx-*
-     qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
+ F: include/hw/net/xlnx-*
@@ -XXX,XX +XXX,XX @@ F: include/hw/rx/
  CAN bus subsystem and hardware
  M: Pavel Pisa <pisa@cmp.felk.cvut.cz>
  M: Francisco Iglesias <francisco.iglesias@amd.com>
 +M: Vikram Garhwal <vikram.garhwal@bytedance.com>
  S: Maintained
  W: https://canbus.pages.fel.cvut.cz/
  F: net/can/*
 --
-.17.0
+.34.1

target-arm queue: Eric's SMMUv3 patchset, and an array
of minor bugfixes and improvements from various others.

thanks
-- PMM

The following changes since commit c8b7e627b4269a3bc3ae41d9f420547a47e6d9b9:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2018-05-04' into staging (2018-05-04 14:42:46 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180504

for you to fetch changes up to 5680740c92993e9b3f3e011f2a2c394070e33f56:

hw/arm/virt: Introduce the iommu option (2018-05-04 18:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * Emulate the SMMUv3 (IOMMU); one will be created in the 'virt' board
   if the commandline includes "-machine iommu=smmuv3"
 * target/arm: Implement v8M VLLDM and VLSTM
 * hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode
 * Some fixes to silence Coverity false-positives
 * arm: boot: set boot_info starting from first_cpu
   (fixes a technical bug not visible in practice)
 * hw/net/smc91c111: Convert away from old_mmio
 * hw/usb/tusb6010: Convert away from old_mmio
 * hw/char/cmsdk-apb-uart.c: Accept more input after character read
 * target/arm: Make MPUIR write-ignored on OMAP, StrongARM
 * hw/arm/virt: Add linux,pci-domain property

----------------------------------------------------------------
Eric Auger (11):
      hw/arm/smmu-common: smmu base device and datatypes
      hw/arm/smmu-common: IOMMU memory region and address space setup
      hw/arm/smmu-common: VMSAv8-64 page table walk
      hw/arm/smmuv3: Wired IRQ and GERROR helpers
      hw/arm/smmuv3: Queue helpers
      hw/arm/smmuv3: Implement MMIO write operations
      hw/arm/smmuv3: Event queue recording helper
      hw/arm/smmuv3: Implement translate callback
      hw/arm/smmuv3: Abort on vfio or vhost case
      target/arm/kvm: Translate the MSI doorbell in kvm_arch_fixup_msi_route
      hw/arm/virt: Introduce the iommu option

Igor Mammedov (1):
      arm: boot: set boot_info starting from first_cpu

Jan Kiszka (1):
      hw/arm/virt: Add linux,pci-domain property

Mathew Maidment (1):
      target/arm: Correct MPUIR privilege level in register_cp_regs_for_features() conditional case

Patrick Oppenlander (1):
      hw/char/cmsdk-apb-uart.c: Accept more input after character read

Peter Maydell (3):
      hw/usb/tusb6010: Convert away from old_mmio
      hw/net/smc91c111: Convert away from old_mmio
      target/arm: Implement v8M VLLDM and VLSTM

Prem Mallappa (3):
      hw/arm/smmuv3: Skeleton
      hw/arm/virt: Add SMMUv3 to the virt board
      hw/arm/virt-acpi-build: Add smmuv3 node in IORT table

Richard Henderson (2):
      target/arm: Tidy conditions in handle_vec_simd_shri
      target/arm: Tidy condition in disas_simd_two_reg_misc

Thomas Huth (1):
      hw/arm: Don't fail qtest due to missing SD card in -nodefaults mode

From: Jan Kiszka <jan.kiszka@siemens.com>

This allows to pin the host controller in the Linux PCI domain space.
Linux requires that property to be available consistently or not at all,
in which case the domain number becomes unstable on additions/removals.
Adding it here won't make a difference in practice for most setups as we
only expose one controller.

However, enabling Jailhouse on top may introduce another controller, and
that one would like to have stable address as well. So the property is
needed for the first controller as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 3301c5bc-7b47-1b0e-8ce4-30435057a276@web.de
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
     qemu_fdt_setprop_string(vms->fdt, nodename, "device_type", "pci");
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#address-cells", 3);
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#size-cells", 2);
+    qemu_fdt_setprop_cell(vms->fdt, nodename, "linux,pci-domain", 0);
     qemu_fdt_setprop_cells(vms->fdt, nodename, "bus-range", 0,
                            nr_pcie_buses - 1);
     qemu_fdt_setprop(vms->fdt, nodename, "dma-coherent", NULL, 0);
-- 
2.17.0

From: Mathew Maidment <mathew1800@gmail.com>

The duplication of id_tlbtr_reginfo was unintentionally added within
3281af8114c6b8ead02f08b58e3c36895c1ea047 which should have been
id_mpuir_reginfo.

The effect was that for OMAP and StrongARM CPUs we would
incorrectly UNDEF writes to MPUIR rather than NOPing them.

Signed-off-by: Mathew Maidment <mathew1800@gmail.com>
Message-id: 20180501184933.37609-2-mathew1800@gmail.com
[PMM: tweak commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             for (r = id_cp_reginfo; r->type != ARM_CP_SENTINEL; r++) {
                 r->access = PL1_RW;
             }
-            id_tlbtr_reginfo.access = PL1_RW;
+            id_mpuir_reginfo.access = PL1_RW;
             id_tlbtr_reginfo.access = PL1_RW;
         }
         if (arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.17.0

From: Patrick Oppenlander <patrick.oppenlander@gmail.com>

The character frontend needs to be notified that the uart receive buffer
is empty and ready to handle another character.

Previously, the uart only worked correctly when receiving one character
at a time.

Signed-off-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
Message-id: CAEg67GkRTw=cXei3o9hvpxG_L4zSrNzR0bFyAgny+sSEUb_kPw@mail.gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cmsdk-apb-uart.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/char/cmsdk-apb-uart.c b/hw/char/cmsdk-apb-uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cmsdk-apb-uart.c
+++ b/hw/char/cmsdk-apb-uart.c
@@ -XXX,XX +XXX,XX @@ static uint64_t uart_read(void *opaque, hwaddr offset, unsigned size)
         r = s->rxbuf;
         s->state &= ~R_STATE_RXFULL_MASK;
         cmsdk_apb_uart_update(s);
+        qemu_chr_fe_accept_input(&s->chr);
         break;
     case A_STATE:
         r = s->state;
-- 
2.17.0

Convert the tusb6010 device away from using the old_mmio field
of MemoryRegionOps. This device is used only in the n800 and n810
boards.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180427173611.10281-2-peter.maydell@linaro.org
---
 hw/usb/tusb6010.c | 40 ++++++++++++++++++++++++++++++++++++----
 1 file changed, 36 insertions(+), 4 deletions(-)

diff --git a/hw/usb/tusb6010.c b/hw/usb/tusb6010.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/tusb6010.c
+++ b/hw/usb/tusb6010.c
@@ -XXX,XX +XXX,XX @@ static void tusb_async_writew(void *opaque, hwaddr addr,
     }
 }
 
+static uint64_t tusb_async_readfn(void *opaque, hwaddr addr, unsigned size)
+{
+    switch (size) {
+    case 1:
+        return tusb_async_readb(opaque, addr);
+    case 2:
+        return tusb_async_readh(opaque, addr);
+    case 4:
+        return tusb_async_readw(opaque, addr);
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void tusb_async_writefn(void *opaque, hwaddr addr,
+                               uint64_t value, unsigned size)
+{
+    switch (size) {
+    case 1:
+        tusb_async_writeb(opaque, addr, value);
+        break;
+    case 2:
+        tusb_async_writeh(opaque, addr, value);
+        break;
+    case 4:
+        tusb_async_writew(opaque, addr, value);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 static const MemoryRegionOps tusb_async_ops = {
-    .old_mmio = {
-        .read = { tusb_async_readb, tusb_async_readh, tusb_async_readw, },
-        .write =  { tusb_async_writeb, tusb_async_writeh, tusb_async_writew, },
-    },
+    .read = tusb_async_readfn,
+    .write = tusb_async_writefn,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.17.0

Convert the smc91c111 device away from using the old_mmio field of
MemoryRegionOps. This device is used by several Arm board models.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180427173611.10281-3-peter.maydell@linaro.org
---
 hw/net/smc91c111.c | 54 +++++++++++++++++++++-------------------------
 1 file changed, 25 insertions(+), 29 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -XXX,XX +XXX,XX @@ static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
     return 0;
 }
 
-static void smc91c111_writew(void *opaque, hwaddr offset,
-                             uint32_t value)
+static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
 {
-    smc91c111_writeb(opaque, offset, value & 0xff);
-    smc91c111_writeb(opaque, offset + 1, value >> 8);
+    int i;
+    uint32_t val = 0;
+
+    for (i = 0; i < size; i++) {
+        val |= smc91c111_readb(opaque, addr + i) << (i * 8);
+    }
+    return val;
 }
 
-static void smc91c111_writel(void *opaque, hwaddr offset,
-                             uint32_t value)
+static void smc91c111_writefn(void *opaque, hwaddr addr,
+                               uint64_t value, unsigned size)
 {
+    int i = 0;
+
     /* 32-bit writes to offset 0xc only actually write to the bank select
-       register (offset 0xe)  */
-    if (offset != 0xc)
-        smc91c111_writew(opaque, offset, value & 0xffff);
-    smc91c111_writew(opaque, offset + 2, value >> 16);
-}
+     * register (offset 0xe), so skip the first two bytes we would write.
+     */
+    if (addr == 0xc && size == 4) {
+        i += 2;
+    }
 
-static uint32_t smc91c111_readw(void *opaque, hwaddr offset)
-{
-    uint32_t val;
-    val = smc91c111_readb(opaque, offset);
-    val |= smc91c111_readb(opaque, offset + 1) << 8;
-    return val;
-}
-
-static uint32_t smc91c111_readl(void *opaque, hwaddr offset)
-{
-    uint32_t val;
-    val = smc91c111_readw(opaque, offset);
-    val |= smc91c111_readw(opaque, offset + 2) << 16;
-    return val;
+    for (; i < size; i++) {
+        smc91c111_writeb(opaque, addr + i,
+                         extract32(value, i * 8, 8));
+    }
 }
 
 static int smc91c111_can_receive_nc(NetClientState *nc)
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps smc91c111_mem_ops = {
     /* The special case for 32 bit writes to 0xc means we can't just
      * set .impl.min/max_access_size to 1, unfortunately
      */
-    .old_mmio = {
-        .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },
-        .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },
-    },
+    .read = smc91c111_readfn,
+    .write = smc91c111_writefn,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.17.0

From: Igor Mammedov <imammedo@redhat.com>

Even though nothing is currently broken (since all boards
use first_cpu as boot cpu), make sure that boot_info is set
on all CPUs.
If some board would like support heterogenuos setup (i.e.
init boot_info on subset of CPUs) in future, it should add
a reasonable API to do it, instead of starting assigning
boot_info from some CPU and till the end of present CPUs
list.

Ref:
"Message-ID: <CAFEAcA_NMWuA8WSs3cNeY6xX1kerO_uAcN_3=fK02BEhHJW86g@mail.gmail.com>"

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1525176522-200354-5-git-send-email-imammedo@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void arm_load_kernel_notify(Notifier *notifier, void *data)
     }
     info->is_linux = is_linux;
 
-    for (cs = CPU(cpu); cs; cs = CPU_NEXT(cs)) {
+    for (cs = first_cpu; cs; cs = CPU_NEXT(cs)) {
         ARM_CPU(cs)->env.boot_info = info;
     }
 }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

The (size > 3 && !is_q) condition is identical to the preceeding test
of bit 3 in immh; eliminate it.  For the benefit of Coverity, assert
that size is within the bounds we expect.

Fixes: Coverity CID1385846
Fixes: Coverity CID1385849
Fixes: Coverity CID1385852
Fixes: Coverity CID1385857
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180501180455.11214-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_vec_simd_shri(DisasContext *s, bool is_q, bool is_u,
         unallocated_encoding(s);
         return;
     }
-
-    if (size > 3 && !is_q) {
-        unallocated_encoding(s);
-        return;
-    }
+    tcg_debug_assert(size <= 3);
 
     if (!fp_access_check(s)) {
         return;
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Path analysis shows that size == 3 && !is_q has been eliminated.

Fixes: Coverity CID1385853
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180501180455.11214-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc(DisasContext *s, uint32_t insn)
         /* All 64-bit element operations can be shared with scalar 2misc */
         int pass;
 
-        for (pass = 0; pass < (is_q ? 2 : 1); pass++) {
+        /* Coverity claims (size == 3 && !is_q) has been eliminated
+         * from all paths leading to here.
+         */
+        tcg_debug_assert(is_q);
+        for (pass = 0; pass < 2; pass++) {
             TCGv_i64 tcg_op = tcg_temp_new_i64();
             TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-- 
2.17.0

From: Thomas Huth <thuth@redhat.com>

When running omap1/2 or pxa2xx based ARM machines with -nodefaults,
they bail out immediately complaining about a "missing SecureDigital
device". That's not how the "default" devices in vl.c are meant to
work - it should be possible for a board to also start up without
default devices. So let's turn the error message and exit() into
a warning instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-id: 1525326811-3233-1-git-send-email-thuth@redhat.com
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/omap1.c  |  8 ++++----
 hw/arm/omap2.c  |  8 ++++----
 hw/arm/pxa2xx.c | 15 +++++++--------
 3 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/soc_dma.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "qemu/range.h"
 #include "hw/sysbus.h"
 #include "qemu/cutils.h"
@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap310_mpu_init(MemoryRegion *system_memory,
                                 omap_findclk(s, "dpll3"));
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = omap_mmc_init(0xfffb7800, system_memory,
-                           blk_by_legacy_dinfo(dinfo),
+                           dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                            qdev_get_gpio_in(s->ih[1], OMAP_INT_OQN),
                            &s->drq[OMAP_DMA_MMC_TX],
                     omap_findclk(s, "mmc_ck"));
diff --git a/hw/arm/omap2.c b/hw/arm/omap2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap2.c
+++ b/hw/arm/omap2.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "hw/boards.h"
 #include "hw/hw.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ struct omap_mpu_state_s *omap2420_mpu_init(MemoryRegion *sysmem,
                              s->drq[OMAP24XX_DMA_GPMC]);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = omap2_mmc_init(omap_l4tao(s->l4, 9),
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->ih[0], OMAP_INT_24XX_MMC_IRQ),
                     &s->drq[OMAP24XX_DMA_MMC1_TX],
                     omap_findclk(s, "mmc_fclk"), omap_findclk(s, "mmc_iclk"));
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/qtest.h"
 #include "qemu/cutils.h"
 
 static struct {
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa270_init(MemoryRegion *address_space,
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 121);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
@@ -XXX,XX +XXX,XX @@ PXA2xxState *pxa255_init(MemoryRegion *address_space, unsigned int sdram_size)
     s->gpio = pxa2xx_gpio_init(0x40e00000, s->cpu, s->pic, 85);
 
     dinfo = drive_get(IF_SD, 0, 0);
-    if (!dinfo) {
-        error_report("missing SecureDigital device");
-        exit(1);
+    if (!dinfo && !qtest_enabled()) {
+        warn_report("missing SecureDigital device");
     }
     s->mmc = pxa2xx_mmci_init(address_space, 0x41100000,
-                    blk_by_legacy_dinfo(dinfo),
+                    dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,
                     qdev_get_gpio_in(s->pic, PXA2XX_PIC_MMC),
                     qdev_get_gpio_in(s->dma, PXA2XX_RX_RQ_MMCI),
                     qdev_get_gpio_in(s->dma, PXA2XX_TX_RQ_MMCI));
-- 
2.17.0

For v8M the instructions VLLDM and VLSTM support lazy saving
and restoring of the secure floating-point registers. Even
if the floating point extension is not implemented, these
instructions must act as NOPs in Secure state, so they can
be used as part of the secure-to-nonsecure call sequence.

Fixes: https://bugs.launchpad.net/qemu/+bug/1768295
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180503105730.5958-1-peter.maydell@linaro.org
---
 target/arm/translate.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_thumb2_insn(DisasContext *s, uint32_t insn)
         /* Coprocessor.  */
         if (arm_dc_feature(s, ARM_FEATURE_M)) {
             /* We don't currently implement M profile FP support,
-             * so this entire space should give a NOCP fault.
+             * so this entire space should give a NOCP fault, with
+             * the exception of the v8M VLLDM and VLSTM insns, which
+             * must be NOPs in Secure state and UNDEF in Nonsecure state.
              */
+            if (arm_dc_feature(s, ARM_FEATURE_V8) &&
+                (insn & 0xffa00f00) == 0xec200a00) {
+                /* 0b1110_1100_0x1x_xxxx_xxxx_1010_xxxx_xxxx
+                 *  - VLLDM, VLSTM
+                 * We choose to UNDEF if the RAZ bits are non-zero.
+                 */
+                if (!s->v8m_secure || (insn & 0x0040f0ff)) {
+                    goto illegal_op;
+                }
+                /* Just NOP since FP support is not implemented */
+                break;
+            }
+            /* All other insns: NOCP */
             gen_exception_insn(s, 4, EXCP_NOCP, syn_uncategorized(),
                                default_exception_el(s));
             break;
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

The patch introduces the smmu base device and class for the ARM
smmu. Devices for specific versions will be derived from this
base device.

We also introduce some important datatypes.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-2-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs                |   1 +
 include/hw/arm/smmu-common.h        | 123 ++++++++++++++++++++++++++++
 hw/arm/smmu-common.c                |  81 ++++++++++++++++++
 default-configs/aarch64-softmmu.mak |   1 +
 4 files changed, 206 insertions(+)
 create mode 100644 include/hw/arm/smmu-common.h
 create mode 100644 hw/arm/smmu-common.c

From: Eric Auger <eric.auger@redhat.com>

We set up the infrastructure to enumerate all the PCI devices
attached to the SMMU and create an associated IOMMU memory
region and address space.

Those info are stored in SMMUDevice objects. The devices are
grouped according to the PCIBus they belong to. A hash table
indexed by the PCIBus pointer is used. Also an array indexed by
the bus number allows to find the list of SMMUDevices.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-3-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  8 +++++
 hw/arm/smmu-common.c         | 69 ++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events          |  3 ++
 3 files changed, 80 insertions(+)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 #define ARM_SMMU_GET_CLASS(obj)                              \
     OBJECT_GET_CLASS(SMMUBaseClass, (obj), TYPE_ARM_SMMU)
 
+/* Return the SMMUPciBus handle associated to a PCI bus number */
+SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num);
+
+/* Return the stream ID of an SMMU device */
+static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
+{
+    return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
+}
 #endif  /* HW_ARM_SMMU_COMMON */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "hw/arm/smmu-common.h"
 
+/**
+ * The bus number is used for lookup when SID based invalidation occurs.
+ * In that case we lazily populate the SMMUPciBus array from the bus hash
+ * table. At the time the SMMUPciBus is created (smmu_find_add_as), the bus
+ * numbers may not be always initialized yet.
+ */
+SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)
+{
+    SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];
+
+    if (!smmu_pci_bus) {
+        GHashTableIter iter;
+
+        g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);
+        while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {
+            if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {
+                s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;
+                return smmu_pci_bus;
+            }
+        }
+    }
+    return smmu_pci_bus;
+}
+
+static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
+{
+    SMMUState *s = opaque;
+    SMMUPciBus *sbus = g_hash_table_lookup(s->smmu_pcibus_by_busptr, bus);
+    SMMUDevice *sdev;
+
+    if (!sbus) {
+        sbus = g_malloc0(sizeof(SMMUPciBus) +
+                         sizeof(SMMUDevice *) * SMMU_PCI_DEVFN_MAX);
+        sbus->bus = bus;
+        g_hash_table_insert(s->smmu_pcibus_by_busptr, bus, sbus);
+    }
+
+    sdev = sbus->pbdev[devfn];
+    if (!sdev) {
+        char *name = g_strdup_printf("%s-%d-%d",
+                                     s->mrtypename,
+                                     pci_bus_num(bus), devfn);
+        sdev = sbus->pbdev[devfn] = g_new0(SMMUDevice, 1);
+
+        sdev->smmu = s;
+        sdev->bus = bus;
+        sdev->devfn = devfn;
+
+        memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
+                                 s->mrtypename,
+                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
+        address_space_init(&sdev->as,
+                           MEMORY_REGION(&sdev->iommu), name);
+        trace_smmu_add_mr(name);
+        g_free(name);
+    }
+
+    return &sdev->as;
+}
+
 static void smmu_base_realize(DeviceState *dev, Error **errp)
 {
+    SMMUState *s = ARM_SMMU(dev);
     SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
     Error *local_err = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
         error_propagate(errp, local_err);
         return;
     }
+
+    s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
+
+    if (s->primary_bus) {
+        pci_setup_iommu(s->primary_bus, smmu_find_add_as, s);
+    } else {
+        error_setg(errp, "SMMU is not attached to any PCI bus!");
+    }
 }
 
 static void smmu_base_reset(DeviceState *dev)
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
 
 # hw/arm/virt-acpi-build.c
 virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
+
+# hw/arm/smmu-common.c
+smmu_add_mr(const char *name) "%s"
\ No newline at end of file
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

This patch implements the page table walk for VMSAv8-64.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Message-id: 1524665762-31355-4-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  99 ++++++++++++++++
 include/hw/arm/smmu-common.h |  14 +++
 hw/arm/smmu-common.c         | 222 +++++++++++++++++++++++++++++++++++
 hw/arm/trace-events          |   9 +-
 4 files changed, 343 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/smmu-internal.h

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SMMU support - Internal API
+ *
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMU_INTERNAL_H
+#define HW_ARM_SMMU_INTERNAL_H
+
+#define TBI0(tbi) ((tbi) & 0x1)
+#define TBI1(tbi) ((tbi) & 0x2 >> 1)
+
+/* PTE Manipulation */
+
+#define ARM_LPAE_PTE_TYPE_SHIFT         0
+#define ARM_LPAE_PTE_TYPE_MASK          0x3
+
+#define ARM_LPAE_PTE_TYPE_BLOCK         1
+#define ARM_LPAE_PTE_TYPE_TABLE         3
+
+#define ARM_LPAE_L3_PTE_TYPE_RESERVED   1
+#define ARM_LPAE_L3_PTE_TYPE_PAGE       3
+
+#define ARM_LPAE_PTE_VALID              (1 << 0)
+
+#define PTE_ADDRESS(pte, shift) \
+    (extract64(pte, shift, 47 - shift + 1) << shift)
+
+#define is_invalid_pte(pte) (!(pte & ARM_LPAE_PTE_VALID))
+
+#define is_reserved_pte(pte, level)                                      \
+    ((level == 3) &&                                                     \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_RESERVED))
+
+#define is_block_pte(pte, level)                                         \
+    ((level < 3) &&                                                      \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_BLOCK))
+
+#define is_table_pte(pte, level)                                        \
+    ((level < 3) &&                                                     \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_PTE_TYPE_TABLE))
+
+#define is_page_pte(pte, level)                                         \
+    ((level == 3) &&                                                    \
+     ((pte & ARM_LPAE_PTE_TYPE_MASK) == ARM_LPAE_L3_PTE_TYPE_PAGE))
+
+/* access permissions */
+
+#define PTE_AP(pte) \
+    (extract64(pte, 6, 2))
+
+#define PTE_APTABLE(pte) \
+    (extract64(pte, 61, 2))
+
+/*
+ * TODO: At the moment all transactions are considered as privileged (EL1)
+ * as IOMMU translation callback does not pass user/priv attributes.
+ */
+#define is_permission_fault(ap, perm) \
+    (((perm) & IOMMU_WO) && ((ap) & 0x2))
+
+#define PTE_AP_TO_PERM(ap) \
+    (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
+
+/* Level Indexing */
+
+static inline int level_shift(int level, int granule_sz)
+{
+    return granule_sz + (3 - level) * (granule_sz - 3);
+}
+
+static inline uint64_t level_page_mask(int level, int granule_sz)
+{
+    return ~(MAKE_64BIT_MASK(0, level_shift(level, granule_sz)));
+}
+
+static inline
+uint64_t iova_level_offset(uint64_t iova, int inputsize,
+                           int level, int gsz)
+{
+    return ((iova & MAKE_64BIT_MASK(0, inputsize)) >> level_shift(level, gsz)) &
+            MAKE_64BIT_MASK(0, gsz - 3);
+}
+
+#endif
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ static inline uint16_t smmu_get_sid(SMMUDevice *sdev)
 {
     return PCI_BUILD_BDF(pci_bus_num(sdev->bus), sdev->devfn);
 }
+
+/**
+ * smmu_ptw - Perform the page table walk for a given iova / access flags
+ * pair, according to @cfg translation config
+ */
+int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info);
+
+/**
+ * select_tt - compute which translation table shall be used according to
+ * the input iova and translation config and return the TT specific info
+ */
+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova);
+
 #endif  /* HW_ARM_SMMU_COMMON */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/error-report.h"
 #include "hw/arm/smmu-common.h"
+#include "smmu-internal.h"
+
+/* VMSAv8-64 Translation */
+
+/**
+ * get_pte - Get the content of a page table entry located at
+ * @base_addr[@index]
+ */
+static int get_pte(dma_addr_t baseaddr, uint32_t index, uint64_t *pte,
+                   SMMUPTWEventInfo *info)
+{
+    int ret;
+    dma_addr_t addr = baseaddr + index * sizeof(*pte);
+
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                          (uint8_t *)pte, sizeof(*pte));
+
+    if (ret != MEMTX_OK) {
+        info->type = SMMU_PTW_ERR_WALK_EABT;
+        info->addr = addr;
+        return -EINVAL;
+    }
+    trace_smmu_get_pte(baseaddr, index, addr, *pte);
+    return 0;
+}
+
+/* VMSAv8-64 Translation Table Format Descriptor Decoding */
+
+/**
+ * get_page_pte_address - returns the L3 descriptor output address,
+ * ie. the page frame
+ * ARM ARM spec: Figure D4-17 VMSAv8-64 level 3 descriptor format
+ */
+static inline hwaddr get_page_pte_address(uint64_t pte, int granule_sz)
+{
+    return PTE_ADDRESS(pte, granule_sz);
+}
+
+/**
+ * get_table_pte_address - return table descriptor output address,
+ * ie. address of next level table
+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+ */
+static inline hwaddr get_table_pte_address(uint64_t pte, int granule_sz)
+{
+    return PTE_ADDRESS(pte, granule_sz);
+}
+
+/**
+ * get_block_pte_address - return block descriptor output address and block size
+ * ARM ARM Figure D4-16 VMSAv8-64 level0, level1, and level 2 descriptor formats
+ */
+static inline hwaddr get_block_pte_address(uint64_t pte, int level,
+                                           int granule_sz, uint64_t *bsz)
+{
+    int n = (granule_sz - 3) * (4 - level) + 3;
+
+    *bsz = 1 << n;
+    return PTE_ADDRESS(pte, n);
+}
+
+SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
+{
+    bool tbi = extract64(iova, 55, 1) ? TBI1(cfg->tbi) : TBI0(cfg->tbi);
+    uint8_t tbi_byte = tbi * 8;
+
+    if (cfg->tt[0].tsz &&
+        !extract64(iova, 64 - cfg->tt[0].tsz, cfg->tt[0].tsz - tbi_byte)) {
+        /* there is a ttbr0 region and we are in it (high bits all zero) */
+        return &cfg->tt[0];
+    } else if (cfg->tt[1].tsz &&
+           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
+        /* there is a ttbr1 region and we are in it (high bits all one) */
+        return &cfg->tt[1];
+    } else if (!cfg->tt[0].tsz) {
+        /* ttbr0 region is "everything not in the ttbr1 region" */
+        return &cfg->tt[0];
+    } else if (!cfg->tt[1].tsz) {
+        /* ttbr1 region is "everything not in the ttbr0 region" */
+        return &cfg->tt[1];
+    }
+    /* in the gap between the two regions, this is a Translation fault */
+    return NULL;
+}
+
+/**
+ * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * @cfg: translation config
+ * @iova: iova to translate
+ * @perm: access type
+ * @tlbe: IOMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64(SMMUTransCfg *cfg,
+                       dma_addr_t iova, IOMMUAccessFlags perm,
+                       IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    dma_addr_t baseaddr, indexmask;
+    int stage = cfg->stage;
+    SMMUTransTableInfo *tt = select_tt(cfg, iova);
+    uint8_t level, granule_sz, inputsize, stride;
+
+    if (!tt || tt->disabled) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    granule_sz = tt->granule_sz;
+    stride = granule_sz - 3;
+    inputsize = 64 - tt->tsz;
+    level = 4 - (inputsize - 4) / stride;
+    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    baseaddr = extract64(tt->ttb, 0, 48);
+    baseaddr &= ~indexmask;
+
+    tlbe->iova = iova;
+    tlbe->addr_mask = (1 << granule_sz) - 1;
+
+    while (level <= 3) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
+        uint64_t pte;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(level, iova, subpage_size,
+                             baseaddr, offset, pte);
+
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            info->type = SMMU_PTW_ERR_TRANSLATION;
+            goto error;
+        }
+
+        if (is_page_pte(pte, level)) {
+            uint64_t gpa = get_page_pte_address(pte, granule_sz);
+
+            ap = PTE_AP(pte);
+            if (is_permission_fault(ap, perm)) {
+                info->type = SMMU_PTW_ERR_PERMISSION;
+                goto error;
+            }
+
+            tlbe->translated_addr = gpa + (iova & mask);
+            tlbe->perm = PTE_AP_TO_PERM(ap);
+            trace_smmu_ptw_page_pte(stage, level, iova,
+                                    baseaddr, pte_addr, pte, gpa);
+            return 0;
+        }
+        if (is_block_pte(pte, level)) {
+            uint64_t block_size;
+            hwaddr gpa = get_block_pte_address(pte, level, granule_sz,
+                                               &block_size);
+
+            ap = PTE_AP(pte);
+            if (is_permission_fault(ap, perm)) {
+                info->type = SMMU_PTW_ERR_PERMISSION;
+                goto error;
+            }
+
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, iova, gpa,
+                                     block_size >> 20);
+
+            tlbe->translated_addr = gpa + (iova & mask);
+            tlbe->perm = PTE_AP_TO_PERM(ap);
+            return 0;
+        }
+
+        /* table pte */
+        ap = PTE_APTABLE(pte);
+
+        if (is_permission_fault(ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+        baseaddr = get_table_pte_address(pte, granule_sz);
+        level++;
+    }
+
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    tlbe->perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
+/**
+ * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
+ *
+ * @cfg: translation configuration
+ * @iova: iova to translate
+ * @perm: tentative access type
+ * @tlbe: returned entry
+ * @info: ptw event handle
+ *
+ * return 0 on success
+ */
+inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
+             IOMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    if (!cfg->aa64) {
+        /*
+         * This code path is not entered as we check this while decoding
+         * the configuration data in the derived SMMU model.
+         */
+        g_assert_not_reached();
+    }
+
+    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+}
 
 /**
  * The bus number is used for lookup when SID based invalidation occurs.
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@
 virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # hw/arm/smmu-common.c
-smmu_add_mr(const char *name) "%s"
\ No newline at end of file
+smmu_add_mr(const char *name) "%s"
+smmu_page_walk(int stage, uint64_t baseaddr, int first_level, uint64_t start, uint64_t end) "stage=%d, baseaddr=0x%"PRIx64", first level=%d, start=0x%"PRIx64", end=0x%"PRIx64
+smmu_lookup_table(int level, uint64_t baseaddr, int granule_sz, uint64_t start, uint64_t end, int flags, uint64_t subpage_size) "level=%d baseaddr=0x%"PRIx64" granule=%d, start=0x%"PRIx64" end=0x%"PRIx64" flags=%d subpage_size=0x%"PRIx64
+smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%lx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
+smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
+smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
+smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch implements a skeleton for the smmuv3 device.
Datatypes and register definitions are introduced. The MMIO
region, the interrupts and the queue are initialized.

Only the MMIO read operation is implemented here.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-5-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Makefile.objs     |   2 +-
 hw/arm/smmuv3-internal.h | 142 +++++++++++++++
 include/hw/arm/smmuv3.h  |  87 ++++++++++
 hw/arm/smmuv3.c          | 366 +++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   3 +
 5 files changed, 599 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/smmuv3-internal.h
 create mode 100644 include/hw/arm/smmuv3.h
 create mode 100644 hw/arm/smmuv3.c

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MPS2) += mps2-tz.o
 obj-$(CONFIG_MSF2) += msf2-soc.o msf2-som.o
 obj-$(CONFIG_IOTKIT) += iotkit.o
 obj-$(CONFIG_FSL_IMX7) += fsl-imx7.o mcimx7d-sabre.o
-obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o
+obj-$(CONFIG_ARM_SMMUV3) += smmu-common.o smmuv3.o
diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SMMUv3 support - Internal API
+ *
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMU_V3_INTERNAL_H
+#define HW_ARM_SMMU_V3_INTERNAL_H
+
+#include "hw/arm/smmu-common.h"
+
+/* MMIO Registers */
+
+REG32(IDR0,                0x0)
+    FIELD(IDR0, S1P,         1 , 1)
+    FIELD(IDR0, TTF,         2 , 2)
+    FIELD(IDR0, COHACC,      4 , 1)
+    FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, TTENDIAN,    21, 2)
+    FIELD(IDR0, STALL_MODEL, 24, 2)
+    FIELD(IDR0, TERM_MODEL,  26, 1)
+    FIELD(IDR0, STLEVEL,     27, 2)
+
+REG32(IDR1,                0x4)
+    FIELD(IDR1, SIDSIZE,      0 , 6)
+    FIELD(IDR1, EVENTQS,      16, 5)
+    FIELD(IDR1, CMDQS,        21, 5)
+
+#define SMMU_IDR1_SIDSIZE 16
+#define SMMU_CMDQS   19
+#define SMMU_EVENTQS 19
+
+REG32(IDR2,                0x8)
+REG32(IDR3,                0xc)
+REG32(IDR4,                0x10)
+REG32(IDR5,                0x14)
+     FIELD(IDR5, OAS,         0, 3);
+     FIELD(IDR5, GRAN4K,      4, 1);
+     FIELD(IDR5, GRAN16K,     5, 1);
+     FIELD(IDR5, GRAN64K,     6, 1);
+
+#define SMMU_IDR5_OAS 4
+
+REG32(IIDR,                0x1c)
+REG32(CR0,                 0x20)
+    FIELD(CR0, SMMU_ENABLE,   0, 1)
+    FIELD(CR0, EVENTQEN,      2, 1)
+    FIELD(CR0, CMDQEN,        3, 1)
+
+REG32(CR0ACK,              0x24)
+REG32(CR1,                 0x28)
+REG32(CR2,                 0x2c)
+REG32(STATUSR,             0x40)
+REG32(IRQ_CTRL,            0x50)
+    FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
+    FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
+    FIELD(IRQ_CTRL, EVENTQ_IRQEN,        2, 1)
+
+REG32(IRQ_CTRL_ACK,        0x54)
+REG32(GERROR,              0x60)
+    FIELD(GERROR, CMDQ_ERR,           0, 1)
+    FIELD(GERROR, EVENTQ_ABT_ERR,     2, 1)
+    FIELD(GERROR, PRIQ_ABT_ERR,       3, 1)
+    FIELD(GERROR, MSI_CMDQ_ABT_ERR,   4, 1)
+    FIELD(GERROR, MSI_EVENTQ_ABT_ERR, 5, 1)
+    FIELD(GERROR, MSI_PRIQ_ABT_ERR,   6, 1)
+    FIELD(GERROR, MSI_GERROR_ABT_ERR, 7, 1)
+    FIELD(GERROR, MSI_SFM_ERR,        8, 1)
+
+REG32(GERRORN,             0x64)
+
+#define A_GERROR_IRQ_CFG0  0x68 /* 64b */
+REG32(GERROR_IRQ_CFG1, 0x70)
+REG32(GERROR_IRQ_CFG2, 0x74)
+
+#define A_STRTAB_BASE      0x80 /* 64b */
+
+#define SMMU_BASE_ADDR_MASK 0xffffffffffe0
+
+REG32(STRTAB_BASE_CFG,     0x88)
+    FIELD(STRTAB_BASE_CFG, FMT,      16, 2)
+    FIELD(STRTAB_BASE_CFG, SPLIT,    6 , 5)
+    FIELD(STRTAB_BASE_CFG, LOG2SIZE, 0 , 6)
+
+#define A_CMDQ_BASE        0x90 /* 64b */
+REG32(CMDQ_PROD,           0x98)
+REG32(CMDQ_CONS,           0x9c)
+    FIELD(CMDQ_CONS, ERR, 24, 7)
+
+#define A_EVENTQ_BASE      0xa0 /* 64b */
+REG32(EVENTQ_PROD,         0xa8)
+REG32(EVENTQ_CONS,         0xac)
+
+#define A_EVENTQ_IRQ_CFG0  0xb0 /* 64b */
+REG32(EVENTQ_IRQ_CFG1,     0xb8)
+REG32(EVENTQ_IRQ_CFG2,     0xbc)
+
+#define A_IDREGS           0xfd0
+
+static inline int smmu_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, SMMU_ENABLE);
+}
+
+/* Command Queue Entry */
+typedef struct Cmd {
+    uint32_t word[4];
+} Cmd;
+
+/* Event Queue Entry */
+typedef struct Evt  {
+    uint32_t word[8];
+} Evt;
+
+static inline uint32_t smmuv3_idreg(int regoffset)
+{
+    /*
+     * Return the value of the Primecell/Corelink ID registers at the
+     * specified offset from the first ID register.
+     * These value indicate an ARM implementation of MMU600 p1
+     */
+    static const uint8_t smmuv3_ids[] = {
+        0x04, 0, 0, 0, 0x84, 0xB4, 0xF0, 0x10, 0x0D, 0xF0, 0x05, 0xB1
+    };
+    return smmuv3_ids[regoffset / 4];
+}
+
+#endif
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef HW_ARM_SMMUV3_H
+#define HW_ARM_SMMUV3_H
+
+#include "hw/arm/smmu-common.h"
+#include "hw/registerfields.h"
+
+#define TYPE_SMMUV3_IOMMU_MEMORY_REGION "smmuv3-iommu-memory-region"
+
+typedef struct SMMUQueue {
+     uint64_t base; /* base register */
+     uint32_t prod;
+     uint32_t cons;
+     uint8_t entry_size;
+     uint8_t log2size;
+} SMMUQueue;
+
+typedef struct SMMUv3State {
+    SMMUState     smmu_state;
+
+    uint32_t features;
+    uint8_t sid_size;
+    uint8_t sid_split;
+
+    uint32_t idr[6];
+    uint32_t iidr;
+    uint32_t cr[3];
+    uint32_t cr0ack;
+    uint32_t statusr;
+    uint32_t irq_ctrl;
+    uint32_t gerror;
+    uint32_t gerrorn;
+    uint64_t gerror_irq_cfg0;
+    uint32_t gerror_irq_cfg1;
+    uint32_t gerror_irq_cfg2;
+    uint64_t strtab_base;
+    uint32_t strtab_base_cfg;
+    uint64_t eventq_irq_cfg0;
+    uint32_t eventq_irq_cfg1;
+    uint32_t eventq_irq_cfg2;
+
+    SMMUQueue eventq, cmdq;
+
+    qemu_irq     irq[4];
+} SMMUv3State;
+
+typedef enum {
+    SMMU_IRQ_EVTQ,
+    SMMU_IRQ_PRIQ,
+    SMMU_IRQ_CMD_SYNC,
+    SMMU_IRQ_GERROR,
+} SMMUIrq;
+
+typedef struct {
+    /*< private >*/
+    SMMUBaseClass smmu_base_class;
+    /*< public >*/
+
+    DeviceRealize parent_realize;
+    DeviceReset   parent_reset;
+} SMMUv3Class;
+
+#define TYPE_ARM_SMMUV3   "arm-smmuv3"
+#define ARM_SMMUV3(obj) OBJECT_CHECK(SMMUv3State, (obj), TYPE_ARM_SMMUV3)
+#define ARM_SMMUV3_CLASS(klass)                              \
+    OBJECT_CLASS_CHECK(SMMUv3Class, (klass), TYPE_ARM_SMMUV3)
+#define ARM_SMMUV3_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(SMMUv3Class, (obj), TYPE_ARM_SMMUV3)
+
+#endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright (C) 2014-2016 Broadcom Corporation
+ * Copyright (c) 2017 Red Hat, Inc.
+ * Written by Prem Mallappa, Eric Auger
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License along
+ * with this program; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/boards.h"
+#include "sysemu/sysemu.h"
+#include "hw/sysbus.h"
+#include "hw/qdev-core.h"
+#include "hw/pci/pci.h"
+#include "exec/address-spaces.h"
+#include "trace.h"
+#include "qemu/log.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include "hw/arm/smmuv3.h"
+#include "smmuv3-internal.h"
+
+static void smmuv3_init_regs(SMMUv3State *s)
+{
+    /**
+     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
+     *       multi-level stream table
+     */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
+    /* terminated transaction will always be aborted/error returned */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TERM_MODEL, 1);
+    /* 2-level stream table supported */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STLEVEL, 1);
+
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, SIDSIZE, SMMU_IDR1_SIDSIZE);
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, EVENTQS, SMMU_EVENTQS);
+    s->idr[1] = FIELD_DP32(s->idr[1], IDR1, CMDQS,   SMMU_CMDQS);
+
+   /* 4K and 64K granule support */
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN4K, 1);
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, GRAN64K, 1);
+    s->idr[5] = FIELD_DP32(s->idr[5], IDR5, OAS, SMMU_IDR5_OAS); /* 44 bits */
+
+    s->cmdq.base = deposit64(s->cmdq.base, 0, 5, SMMU_CMDQS);
+    s->cmdq.prod = 0;
+    s->cmdq.cons = 0;
+    s->cmdq.entry_size = sizeof(struct Cmd);
+    s->eventq.base = deposit64(s->eventq.base, 0, 5, SMMU_EVENTQS);
+    s->eventq.prod = 0;
+    s->eventq.cons = 0;
+    s->eventq.entry_size = sizeof(struct Evt);
+
+    s->features = 0;
+    s->sid_split = 0;
+}
+
+static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
+                                   unsigned size, MemTxAttrs attrs)
+{
+    /* not yet implemented */
+    return MEMTX_ERROR;
+}
+
+static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
+                               uint64_t *data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_GERROR_IRQ_CFG0:
+        *data = s->gerror_irq_cfg0;
+        return MEMTX_OK;
+    case A_STRTAB_BASE:
+        *data = s->strtab_base;
+        return MEMTX_OK;
+    case A_CMDQ_BASE:
+        *data = s->cmdq.base;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE:
+        *data = s->eventq.base;
+        return MEMTX_OK;
+    default:
+        *data = 0;
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (RAZ)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
+                              uint64_t *data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_IDREGS ... A_IDREGS + 0x1f:
+        *data = smmuv3_idreg(offset - A_IDREGS);
+        return MEMTX_OK;
+    case A_IDR0 ... A_IDR5:
+        *data = s->idr[(offset - A_IDR0) / 4];
+        return MEMTX_OK;
+    case A_IIDR:
+        *data = s->iidr;
+        return MEMTX_OK;
+    case A_CR0:
+        *data = s->cr[0];
+        return MEMTX_OK;
+    case A_CR0ACK:
+        *data = s->cr0ack;
+        return MEMTX_OK;
+    case A_CR1:
+        *data = s->cr[1];
+        return MEMTX_OK;
+    case A_CR2:
+        *data = s->cr[2];
+        return MEMTX_OK;
+    case A_STATUSR:
+        *data = s->statusr;
+        return MEMTX_OK;
+    case A_IRQ_CTRL:
+    case A_IRQ_CTRL_ACK:
+        *data = s->irq_ctrl;
+        return MEMTX_OK;
+    case A_GERROR:
+        *data = s->gerror;
+        return MEMTX_OK;
+    case A_GERRORN:
+        *data = s->gerrorn;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0: /* 64b */
+        *data = extract64(s->gerror_irq_cfg0, 0, 32);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0 + 4:
+        *data = extract64(s->gerror_irq_cfg0, 32, 32);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG1:
+        *data = s->gerror_irq_cfg1;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG2:
+        *data = s->gerror_irq_cfg2;
+        return MEMTX_OK;
+    case A_STRTAB_BASE: /* 64b */
+        *data = extract64(s->strtab_base, 0, 32);
+        return MEMTX_OK;
+    case A_STRTAB_BASE + 4: /* 64b */
+        *data = extract64(s->strtab_base, 32, 32);
+        return MEMTX_OK;
+    case A_STRTAB_BASE_CFG:
+        *data = s->strtab_base_cfg;
+        return MEMTX_OK;
+    case A_CMDQ_BASE: /* 64b */
+        *data = extract64(s->cmdq.base, 0, 32);
+        return MEMTX_OK;
+    case A_CMDQ_BASE + 4:
+        *data = extract64(s->cmdq.base, 32, 32);
+        return MEMTX_OK;
+    case A_CMDQ_PROD:
+        *data = s->cmdq.prod;
+        return MEMTX_OK;
+    case A_CMDQ_CONS:
+        *data = s->cmdq.cons;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE: /* 64b */
+        *data = extract64(s->eventq.base, 0, 32);
+        return MEMTX_OK;
+    case A_EVENTQ_BASE + 4: /* 64b */
+        *data = extract64(s->eventq.base, 32, 32);
+        return MEMTX_OK;
+    case A_EVENTQ_PROD:
+        *data = s->eventq.prod;
+        return MEMTX_OK;
+    case A_EVENTQ_CONS:
+        *data = s->eventq.cons;
+        return MEMTX_OK;
+    default:
+        *data = 0;
+        qemu_log_mask(LOG_UNIMP,
+                      "%s unhandled 32-bit access at 0x%"PRIx64" (RAZ)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_read_mmio(void *opaque, hwaddr offset, uint64_t *data,
+                                  unsigned size, MemTxAttrs attrs)
+{
+    SMMUState *sys = opaque;
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    MemTxResult r;
+
+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
+    offset &= ~0x10000;
+
+    switch (size) {
+    case 8:
+        r = smmu_readll(s, offset, data, attrs);
+        break;
+    case 4:
+        r = smmu_readl(s, offset, data, attrs);
+        break;
+    default:
+        r = MEMTX_ERROR;
+        break;
+    }
+
+    trace_smmuv3_read_mmio(offset, *data, size, r);
+    return r;
+}
+
+static const MemoryRegionOps smmu_mem_ops = {
+    .read_with_attrs = smmu_read_mmio,
+    .write_with_attrs = smmu_write_mmio,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 8,
+    },
+};
+
+static void smmu_init_irq(SMMUv3State *s, SysBusDevice *dev)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->irq); i++) {
+        sysbus_init_irq(dev, &s->irq[i]);
+    }
+}
+
+static void smmu_reset(DeviceState *dev)
+{
+    SMMUv3State *s = ARM_SMMUV3(dev);
+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
+
+    c->parent_reset(dev);
+
+    smmuv3_init_regs(s);
+}
+
+static void smmu_realize(DeviceState *d, Error **errp)
+{
+    SMMUState *sys = ARM_SMMU(d);
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    SMMUv3Class *c = ARM_SMMUV3_GET_CLASS(s);
+    SysBusDevice *dev = SYS_BUS_DEVICE(d);
+    Error *local_err = NULL;
+
+    c->parent_realize(d, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    memory_region_init_io(&sys->iomem, OBJECT(s),
+                          &smmu_mem_ops, sys, TYPE_ARM_SMMUV3, 0x20000);
+
+    sys->mrtypename = TYPE_SMMUV3_IOMMU_MEMORY_REGION;
+
+    sysbus_init_mmio(dev, &sys->iomem);
+
+    smmu_init_irq(s, dev);
+}
+
+static const VMStateDescription vmstate_smmuv3_queue = {
+    .name = "smmuv3_queue",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64(base, SMMUQueue),
+        VMSTATE_UINT32(prod, SMMUQueue),
+        VMSTATE_UINT32(cons, SMMUQueue),
+        VMSTATE_UINT8(log2size, SMMUQueue),
+    },
+};
+
+static const VMStateDescription vmstate_smmuv3 = {
+    .name = "smmuv3",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(features, SMMUv3State),
+        VMSTATE_UINT8(sid_size, SMMUv3State),
+        VMSTATE_UINT8(sid_split, SMMUv3State),
+
+        VMSTATE_UINT32_ARRAY(cr, SMMUv3State, 3),
+        VMSTATE_UINT32(cr0ack, SMMUv3State),
+        VMSTATE_UINT32(statusr, SMMUv3State),
+        VMSTATE_UINT32(irq_ctrl, SMMUv3State),
+        VMSTATE_UINT32(gerror, SMMUv3State),
+        VMSTATE_UINT32(gerrorn, SMMUv3State),
+        VMSTATE_UINT64(gerror_irq_cfg0, SMMUv3State),
+        VMSTATE_UINT32(gerror_irq_cfg1, SMMUv3State),
+        VMSTATE_UINT32(gerror_irq_cfg2, SMMUv3State),
+        VMSTATE_UINT64(strtab_base, SMMUv3State),
+        VMSTATE_UINT32(strtab_base_cfg, SMMUv3State),
+        VMSTATE_UINT64(eventq_irq_cfg0, SMMUv3State),
+        VMSTATE_UINT32(eventq_irq_cfg1, SMMUv3State),
+        VMSTATE_UINT32(eventq_irq_cfg2, SMMUv3State),
+
+        VMSTATE_STRUCT(cmdq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
+        VMSTATE_STRUCT(eventq, SMMUv3State, 0, vmstate_smmuv3_queue, SMMUQueue),
+
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+static void smmuv3_instance_init(Object *obj)
+{
+    /* Nothing much to do here as of now */
+}
+
+static void smmuv3_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    SMMUv3Class *c = ARM_SMMUV3_CLASS(klass);
+
+    dc->vmsd = &vmstate_smmuv3;
+    device_class_set_parent_reset(dc, smmu_reset, &c->parent_reset);
+    c->parent_realize = dc->realize;
+    dc->realize = smmu_realize;
+}
+
+static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
+                                                  void *data)
+{
+}
+
+static const TypeInfo smmuv3_type_info = {
+    .name          = TYPE_ARM_SMMUV3,
+    .parent        = TYPE_ARM_SMMU,
+    .instance_size = sizeof(SMMUv3State),
+    .instance_init = smmuv3_instance_init,
+    .class_size    = sizeof(SMMUv3Class),
+    .class_init    = smmuv3_class_init,
+};
+
+static const TypeInfo smmuv3_iommu_memory_region_info = {
+    .parent = TYPE_IOMMU_MEMORY_REGION,
+    .name = TYPE_SMMUV3_IOMMU_MEMORY_REGION,
+    .class_init = smmuv3_iommu_memory_region_class_init,
+};
+
+static void smmuv3_register_types(void)
+{
+    type_register(&smmuv3_type_info);
+    type_register(&smmuv3_iommu_memory_region_info);
+}
+
+type_init(smmuv3_register_types)
+
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr,
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
+
+#hw/arm/smmuv3.c
+smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

We introduce some helpers to handle wired IRQs and especially
GERROR interrupt. SMMU writes GERROR register on GERROR event
and SW acks GERROR interrupts by setting GERRORn.

The Wired interrupts are edge sensitive hence the pulse usage.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-6-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 14 +++++++++
 hw/arm/smmuv3.c          | 64 ++++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |  3 ++
 3 files changed, 81 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t smmuv3_idreg(int regoffset)
     return smmuv3_ids[regoffset / 4];
 }
 
+static inline bool smmuv3_eventq_irq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, EVENTQ_IRQEN);
+}
+
+static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
+}
+
+/* public until callers get introduced */
+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/smmuv3.h"
 #include "smmuv3-internal.h"
 
+/**
+ * smmuv3_trigger_irq - pulse @irq if enabled and update
+ * GERROR register in case of GERROR interrupt
+ *
+ * @irq: irq type
+ * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
+ */
+void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
+{
+
+    bool pulse = false;
+
+    switch (irq) {
+    case SMMU_IRQ_EVTQ:
+        pulse = smmuv3_eventq_irq_enabled(s);
+        break;
+    case SMMU_IRQ_PRIQ:
+        qemu_log_mask(LOG_UNIMP, "PRI not yet supported\n");
+        break;
+    case SMMU_IRQ_CMD_SYNC:
+        pulse = true;
+        break;
+    case SMMU_IRQ_GERROR:
+    {
+        uint32_t pending = s->gerror ^ s->gerrorn;
+        uint32_t new_gerrors = ~pending & gerror_mask;
+
+        if (!new_gerrors) {
+            /* only toggle non pending errors */
+            return;
+        }
+        s->gerror ^= new_gerrors;
+        trace_smmuv3_write_gerror(new_gerrors, s->gerror);
+
+        pulse = smmuv3_gerror_irq_enabled(s);
+        break;
+    }
+    }
+    if (pulse) {
+            trace_smmuv3_trigger_irq(irq);
+            qemu_irq_pulse(s->irq[irq]);
+    }
+}
+
+void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+{
+    uint32_t pending = s->gerror ^ s->gerrorn;
+    uint32_t toggled = s->gerrorn ^ new_gerrorn;
+
+    if (toggled & ~pending) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "guest toggles non pending errors = 0x%x\n",
+                      toggled & ~pending);
+    }
+
+    /*
+     * We do not raise any error in case guest toggles bits corresponding
+     * to not active IRQs (CONSTRAINED UNPREDICTABLE)
+     */
+    s->gerrorn = new_gerrorn;
+
+    trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
+}
+
 static void smmuv3_init_regs(SMMUv3State *s)
 {
     /**
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "base
 
 #hw/arm/smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+smmuv3_trigger_irq(int irq) "irq=%d"
+smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
+smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

We introduce helpers to read/write into the command and event
circular queues.

smmuv3_write_eventq and smmuv3_cmq_consume will become static
in subsequent patches.

Invalidation commands are not yet dealt with. We do not cache
data that need to be invalidated. This will change with vhost
integration.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-7-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 163 +++++++++++++++++++++++++++++++++++++++
 hw/arm/smmuv3.c          | 136 ++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   5 ++
 3 files changed, 304 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
 void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
 void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
 
+/* Queue Handling */
+
+#define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
+#define WRAP_MASK(q)       (1 << (q)->log2size)
+#define INDEX_MASK(q)      (((1 << (q)->log2size)) - 1)
+#define WRAP_INDEX_MASK(q) ((1 << ((q)->log2size + 1)) - 1)
+
+#define Q_CONS(q) ((q)->cons & INDEX_MASK(q))
+#define Q_PROD(q) ((q)->prod & INDEX_MASK(q))
+
+#define Q_CONS_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_CONS(q))
+#define Q_PROD_ENTRY(q)  (Q_BASE(q) + (q)->entry_size * Q_PROD(q))
+
+#define Q_CONS_WRAP(q) (((q)->cons & WRAP_MASK(q)) >> (q)->log2size)
+#define Q_PROD_WRAP(q) (((q)->prod & WRAP_MASK(q)) >> (q)->log2size)
+
+static inline bool smmuv3_q_full(SMMUQueue *q)
+{
+    return ((q->cons ^ q->prod) & WRAP_INDEX_MASK(q)) == WRAP_MASK(q);
+}
+
+static inline bool smmuv3_q_empty(SMMUQueue *q)
+{
+    return (q->cons & WRAP_INDEX_MASK(q)) == (q->prod & WRAP_INDEX_MASK(q));
+}
+
+static inline void queue_prod_incr(SMMUQueue *q)
+{
+    q->prod = (q->prod + 1) & WRAP_INDEX_MASK(q);
+}
+
+static inline void queue_cons_incr(SMMUQueue *q)
+{
+    /*
+     * We have to use deposit for the CONS registers to preserve
+     * the ERR field in the high bits.
+     */
+    q->cons = deposit32(q->cons, 0, q->log2size + 1, q->cons + 1);
+}
+
+static inline bool smmuv3_cmdq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, CMDQEN);
+}
+
+static inline bool smmuv3_eventq_enabled(SMMUv3State *s)
+{
+    return FIELD_EX32(s->cr[0], CR0, EVENTQEN);
+}
+
+static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
+{
+    s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
+}
+
+void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
+
+/* Commands */
+
+typedef enum SMMUCommandType {
+    SMMU_CMD_NONE            = 0x00,
+    SMMU_CMD_PREFETCH_CONFIG       ,
+    SMMU_CMD_PREFETCH_ADDR,
+    SMMU_CMD_CFGI_STE,
+    SMMU_CMD_CFGI_STE_RANGE,
+    SMMU_CMD_CFGI_CD,
+    SMMU_CMD_CFGI_CD_ALL,
+    SMMU_CMD_CFGI_ALL,
+    SMMU_CMD_TLBI_NH_ALL     = 0x10,
+    SMMU_CMD_TLBI_NH_ASID,
+    SMMU_CMD_TLBI_NH_VA,
+    SMMU_CMD_TLBI_NH_VAA,
+    SMMU_CMD_TLBI_EL3_ALL    = 0x18,
+    SMMU_CMD_TLBI_EL3_VA     = 0x1a,
+    SMMU_CMD_TLBI_EL2_ALL    = 0x20,
+    SMMU_CMD_TLBI_EL2_ASID,
+    SMMU_CMD_TLBI_EL2_VA,
+    SMMU_CMD_TLBI_EL2_VAA,
+    SMMU_CMD_TLBI_S12_VMALL  = 0x28,
+    SMMU_CMD_TLBI_S2_IPA     = 0x2a,
+    SMMU_CMD_TLBI_NSNH_ALL   = 0x30,
+    SMMU_CMD_ATC_INV         = 0x40,
+    SMMU_CMD_PRI_RESP,
+    SMMU_CMD_RESUME          = 0x44,
+    SMMU_CMD_STALL_TERM,
+    SMMU_CMD_SYNC,
+} SMMUCommandType;
+
+static const char *cmd_stringify[] = {
+    [SMMU_CMD_PREFETCH_CONFIG] = "SMMU_CMD_PREFETCH_CONFIG",
+    [SMMU_CMD_PREFETCH_ADDR]   = "SMMU_CMD_PREFETCH_ADDR",
+    [SMMU_CMD_CFGI_STE]        = "SMMU_CMD_CFGI_STE",
+    [SMMU_CMD_CFGI_STE_RANGE]  = "SMMU_CMD_CFGI_STE_RANGE",
+    [SMMU_CMD_CFGI_CD]         = "SMMU_CMD_CFGI_CD",
+    [SMMU_CMD_CFGI_CD_ALL]     = "SMMU_CMD_CFGI_CD_ALL",
+    [SMMU_CMD_CFGI_ALL]        = "SMMU_CMD_CFGI_ALL",
+    [SMMU_CMD_TLBI_NH_ALL]     = "SMMU_CMD_TLBI_NH_ALL",
+    [SMMU_CMD_TLBI_NH_ASID]    = "SMMU_CMD_TLBI_NH_ASID",
+    [SMMU_CMD_TLBI_NH_VA]      = "SMMU_CMD_TLBI_NH_VA",
+    [SMMU_CMD_TLBI_NH_VAA]     = "SMMU_CMD_TLBI_NH_VAA",
+    [SMMU_CMD_TLBI_EL3_ALL]    = "SMMU_CMD_TLBI_EL3_ALL",
+    [SMMU_CMD_TLBI_EL3_VA]     = "SMMU_CMD_TLBI_EL3_VA",
+    [SMMU_CMD_TLBI_EL2_ALL]    = "SMMU_CMD_TLBI_EL2_ALL",
+    [SMMU_CMD_TLBI_EL2_ASID]   = "SMMU_CMD_TLBI_EL2_ASID",
+    [SMMU_CMD_TLBI_EL2_VA]     = "SMMU_CMD_TLBI_EL2_VA",
+    [SMMU_CMD_TLBI_EL2_VAA]    = "SMMU_CMD_TLBI_EL2_VAA",
+    [SMMU_CMD_TLBI_S12_VMALL]  = "SMMU_CMD_TLBI_S12_VMALL",
+    [SMMU_CMD_TLBI_S2_IPA]     = "SMMU_CMD_TLBI_S2_IPA",
+    [SMMU_CMD_TLBI_NSNH_ALL]   = "SMMU_CMD_TLBI_NSNH_ALL",
+    [SMMU_CMD_ATC_INV]         = "SMMU_CMD_ATC_INV",
+    [SMMU_CMD_PRI_RESP]        = "SMMU_CMD_PRI_RESP",
+    [SMMU_CMD_RESUME]          = "SMMU_CMD_RESUME",
+    [SMMU_CMD_STALL_TERM]      = "SMMU_CMD_STALL_TERM",
+    [SMMU_CMD_SYNC]            = "SMMU_CMD_SYNC",
+};
+
+static inline const char *smmu_cmd_string(SMMUCommandType type)
+{
+    if (type > SMMU_CMD_NONE && type < ARRAY_SIZE(cmd_stringify)) {
+        return cmd_stringify[type] ? cmd_stringify[type] : "UNKNOWN";
+    } else {
+        return "INVALID";
+    }
+}
+
+/* CMDQ fields */
+
+typedef enum {
+    SMMU_CERROR_NONE = 0,
+    SMMU_CERROR_ILL,
+    SMMU_CERROR_ABT,
+    SMMU_CERROR_ATC_INV_SYNC,
+} SMMUCmdError;
+
+enum { /* Command completion notification */
+    CMD_SYNC_SIG_NONE,
+    CMD_SYNC_SIG_IRQ,
+    CMD_SYNC_SIG_SEV,
+};
+
+#define CMD_TYPE(x)         extract32((x)->word[0], 0 , 8)
+#define CMD_SSEC(x)         extract32((x)->word[0], 10, 1)
+#define CMD_SSV(x)          extract32((x)->word[0], 11, 1)
+#define CMD_RESUME_AC(x)    extract32((x)->word[0], 12, 1)
+#define CMD_RESUME_AB(x)    extract32((x)->word[0], 13, 1)
+#define CMD_SYNC_CS(x)      extract32((x)->word[0], 12, 2)
+#define CMD_SSID(x)         extract32((x)->word[0], 12, 20)
+#define CMD_SID(x)          ((x)->word[1])
+#define CMD_VMID(x)         extract32((x)->word[1], 0 , 16)
+#define CMD_ASID(x)         extract32((x)->word[1], 16, 16)
+#define CMD_RESUME_STAG(x)  extract32((x)->word[2], 0 , 16)
+#define CMD_RESP(x)         extract32((x)->word[2], 11, 2)
+#define CMD_LEAF(x)         extract32((x)->word[2], 0 , 1)
+#define CMD_STE_RANGE(x)    extract32((x)->word[2], 0 , 5)
+#define CMD_ADDR(x) ({                                        \
+            uint64_t high = (uint64_t)(x)->word[3];           \
+            uint64_t low = extract32((x)->word[2], 12, 20);    \
+            uint64_t addr = high << 32 | (low << 12);         \
+            addr;                                             \
+        })
+
+int smmuv3_cmdq_consume(SMMUv3State *s);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
     trace_smmuv3_write_gerrorn(toggled & pending, s->gerrorn);
 }
 
+static inline MemTxResult queue_read(SMMUQueue *q, void *data)
+{
+    dma_addr_t addr = Q_CONS_ENTRY(q);
+
+    return dma_memory_read(&address_space_memory, addr, data, q->entry_size);
+}
+
+static MemTxResult queue_write(SMMUQueue *q, void *data)
+{
+    dma_addr_t addr = Q_PROD_ENTRY(q);
+    MemTxResult ret;
+
+    ret = dma_memory_write(&address_space_memory, addr, data, q->entry_size);
+    if (ret != MEMTX_OK) {
+        return ret;
+    }
+
+    queue_prod_incr(q);
+    return MEMTX_OK;
+}
+
+void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
+{
+    SMMUQueue *q = &s->eventq;
+
+    if (!smmuv3_eventq_enabled(s)) {
+        return;
+    }
+
+    if (smmuv3_q_full(q)) {
+        return;
+    }
+
+    queue_write(q, evt);
+
+    if (smmuv3_q_empty(q)) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    }
+}
+
 static void smmuv3_init_regs(SMMUv3State *s)
 {
     /**
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
+int smmuv3_cmdq_consume(SMMUv3State *s)
+{
+    SMMUCmdError cmd_error = SMMU_CERROR_NONE;
+    SMMUQueue *q = &s->cmdq;
+    SMMUCommandType type = 0;
+
+    if (!smmuv3_cmdq_enabled(s)) {
+        return 0;
+    }
+    /*
+     * some commands depend on register values, typically CR0. In case those
+     * register values change while handling the command, spec says it
+     * is UNPREDICTABLE whether the command is interpreted under the new
+     * or old value.
+     */
+
+    while (!smmuv3_q_empty(q)) {
+        uint32_t pending = s->gerror ^ s->gerrorn;
+        Cmd cmd;
+
+        trace_smmuv3_cmdq_consume(Q_PROD(q), Q_CONS(q),
+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
+
+        if (FIELD_EX32(pending, GERROR, CMDQ_ERR)) {
+            break;
+        }
+
+        if (queue_read(q, &cmd) != MEMTX_OK) {
+            cmd_error = SMMU_CERROR_ABT;
+            break;
+        }
+
+        type = CMD_TYPE(&cmd);
+
+        trace_smmuv3_cmdq_opcode(smmu_cmd_string(type));
+
+        switch (type) {
+        case SMMU_CMD_SYNC:
+            if (CMD_SYNC_CS(&cmd) & CMD_SYNC_SIG_IRQ) {
+                smmuv3_trigger_irq(s, SMMU_IRQ_CMD_SYNC, 0);
+            }
+            break;
+        case SMMU_CMD_PREFETCH_CONFIG:
+        case SMMU_CMD_PREFETCH_ADDR:
+        case SMMU_CMD_CFGI_STE:
+        case SMMU_CMD_CFGI_STE_RANGE: /* same as SMMU_CMD_CFGI_ALL */
+        case SMMU_CMD_CFGI_CD:
+        case SMMU_CMD_CFGI_CD_ALL:
+        case SMMU_CMD_TLBI_NH_ALL:
+        case SMMU_CMD_TLBI_NH_ASID:
+        case SMMU_CMD_TLBI_NH_VA:
+        case SMMU_CMD_TLBI_NH_VAA:
+        case SMMU_CMD_TLBI_EL3_ALL:
+        case SMMU_CMD_TLBI_EL3_VA:
+        case SMMU_CMD_TLBI_EL2_ALL:
+        case SMMU_CMD_TLBI_EL2_ASID:
+        case SMMU_CMD_TLBI_EL2_VA:
+        case SMMU_CMD_TLBI_EL2_VAA:
+        case SMMU_CMD_TLBI_S12_VMALL:
+        case SMMU_CMD_TLBI_S2_IPA:
+        case SMMU_CMD_TLBI_NSNH_ALL:
+        case SMMU_CMD_ATC_INV:
+        case SMMU_CMD_PRI_RESP:
+        case SMMU_CMD_RESUME:
+        case SMMU_CMD_STALL_TERM:
+            trace_smmuv3_unhandled_cmd(type);
+            break;
+        default:
+            cmd_error = SMMU_CERROR_ILL;
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            break;
+        }
+        if (cmd_error) {
+            break;
+        }
+        /*
+         * We only increment the cons index after the completion of
+         * the command. We do that because the SYNC returns immediately
+         * and does not check the completion of previous commands
+         */
+        queue_cons_incr(q);
+    }
+
+    if (cmd_error) {
+        trace_smmuv3_cmdq_consume_error(smmu_cmd_string(type), cmd_error);
+        smmu_write_cmdq_err(s, cmd_error);
+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_CMDQ_ERR_MASK);
+    }
+
+    trace_smmuv3_cmdq_consume_out(Q_PROD(q), Q_CONS(q),
+                                  Q_PROD_WRAP(q), Q_CONS_WRAP(q));
+
+    return 0;
+}
+
 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                    unsigned size, MemTxAttrs attrs)
 {
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
 smmuv3_trigger_irq(int irq) "irq=%d"
 smmuv3_write_gerror(uint32_t toggled, uint32_t gerror) "toggled=0x%x, new GERROR=0x%x"
 smmuv3_write_gerrorn(uint32_t acked, uint32_t gerrorn) "acked=0x%x, new GERRORN=0x%x"
+smmuv3_unhandled_cmd(uint32_t type) "Unhandled command type=%d"
+smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod=%d cons=%d prod.wrap=%d cons.wrap=%d"
+smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
+smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
+smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

Now we have relevant helpers for queue and irq
management, let's implement MMIO write operations.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-8-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h |   8 +-
 hw/arm/smmuv3.c          | 170 +++++++++++++++++++++++++++++++++++++--
 hw/arm/trace-events      |   6 ++
 3 files changed, 174 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ REG32(CR0,                 0x20)
     FIELD(CR0, EVENTQEN,      2, 1)
     FIELD(CR0, CMDQEN,        3, 1)
 
+#define SMMU_CR0_RESERVED 0xFFFFFC20
+
 REG32(CR0ACK,              0x24)
 REG32(CR1,                 0x28)
 REG32(CR2,                 0x2c)
@@ -XXX,XX +XXX,XX @@ static inline bool smmuv3_gerror_irq_enabled(SMMUv3State *s)
     return FIELD_EX32(s->irq_ctrl, IRQ_CTRL, GERROR_IRQEN);
 }
 
-/* public until callers get introduced */
-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask);
-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t gerrorn);
-
 /* Queue Handling */
 
 #define Q_BASE(q)          ((q)->base & SMMU_BASE_ADDR_MASK)
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
             addr;                                             \
         })
 
-int smmuv3_cmdq_consume(SMMUv3State *s);
+#define SMMU_FEATURE_2LVL_STE (1 << 0)
 
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  * @irq: irq type
  * @gerror_mask: mask of gerrors to toggle (relevant if @irq is GERROR)
  */
-void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
+static void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq,
+                               uint32_t gerror_mask)
 {
 
     bool pulse = false;
@@ -XXX,XX +XXX,XX @@ void smmuv3_trigger_irq(SMMUv3State *s, SMMUIrq irq, uint32_t gerror_mask)
     }
 }
 
-void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
+static void smmuv3_write_gerrorn(SMMUv3State *s, uint32_t new_gerrorn)
 {
     uint32_t pending = s->gerror ^ s->gerrorn;
     uint32_t toggled = s->gerrorn ^ new_gerrorn;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
-int smmuv3_cmdq_consume(SMMUv3State *s)
+static int smmuv3_cmdq_consume(SMMUv3State *s)
 {
     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
     SMMUQueue *q = &s->cmdq;
@@ -XXX,XX +XXX,XX @@ int smmuv3_cmdq_consume(SMMUv3State *s)
     return 0;
 }
 
+static MemTxResult smmu_writell(SMMUv3State *s, hwaddr offset,
+                               uint64_t data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_GERROR_IRQ_CFG0:
+        s->gerror_irq_cfg0 = data;
+        return MEMTX_OK;
+    case A_STRTAB_BASE:
+        s->strtab_base = data;
+        return MEMTX_OK;
+    case A_CMDQ_BASE:
+        s->cmdq.base = data;
+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+        if (s->cmdq.log2size > SMMU_CMDQS) {
+            s->cmdq.log2size = SMMU_CMDQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_BASE:
+        s->eventq.base = data;
+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
+        if (s->eventq.log2size > SMMU_EVENTQS) {
+            s->eventq.log2size = SMMU_EVENTQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0:
+        s->eventq_irq_cfg0 = data;
+        return MEMTX_OK;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 64-bit access to 0x%"PRIx64" (WI)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
+static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
+                               uint64_t data, MemTxAttrs attrs)
+{
+    switch (offset) {
+    case A_CR0:
+        s->cr[0] = data;
+        s->cr0ack = data & ~SMMU_CR0_RESERVED;
+        /* in case the command queue has been enabled */
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_CR1:
+        s->cr[1] = data;
+        return MEMTX_OK;
+    case A_CR2:
+        s->cr[2] = data;
+        return MEMTX_OK;
+    case A_IRQ_CTRL:
+        s->irq_ctrl = data;
+        return MEMTX_OK;
+    case A_GERRORN:
+        smmuv3_write_gerrorn(s, data);
+        /*
+         * By acknowledging the CMDQ_ERR, SW may notify cmds can
+         * be processed again
+         */
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0: /* 64b */
+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 0, 32, data);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG0 + 4:
+        s->gerror_irq_cfg0 = deposit64(s->gerror_irq_cfg0, 32, 32, data);
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG1:
+        s->gerror_irq_cfg1 = data;
+        return MEMTX_OK;
+    case A_GERROR_IRQ_CFG2:
+        s->gerror_irq_cfg2 = data;
+        return MEMTX_OK;
+    case A_STRTAB_BASE: /* 64b */
+        s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
+        return MEMTX_OK;
+    case A_STRTAB_BASE + 4:
+        s->strtab_base = deposit64(s->strtab_base, 32, 32, data);
+        return MEMTX_OK;
+    case A_STRTAB_BASE_CFG:
+        s->strtab_base_cfg = data;
+        if (FIELD_EX32(data, STRTAB_BASE_CFG, FMT) == 1) {
+            s->sid_split = FIELD_EX32(data, STRTAB_BASE_CFG, SPLIT);
+            s->features |= SMMU_FEATURE_2LVL_STE;
+        }
+        return MEMTX_OK;
+    case A_CMDQ_BASE: /* 64b */
+        s->cmdq.base = deposit64(s->cmdq.base, 0, 32, data);
+        s->cmdq.log2size = extract64(s->cmdq.base, 0, 5);
+        if (s->cmdq.log2size > SMMU_CMDQS) {
+            s->cmdq.log2size = SMMU_CMDQS;
+        }
+        return MEMTX_OK;
+    case A_CMDQ_BASE + 4: /* 64b */
+        s->cmdq.base = deposit64(s->cmdq.base, 32, 32, data);
+        return MEMTX_OK;
+    case A_CMDQ_PROD:
+        s->cmdq.prod = data;
+        smmuv3_cmdq_consume(s);
+        return MEMTX_OK;
+    case A_CMDQ_CONS:
+        s->cmdq.cons = data;
+        return MEMTX_OK;
+    case A_EVENTQ_BASE: /* 64b */
+        s->eventq.base = deposit64(s->eventq.base, 0, 32, data);
+        s->eventq.log2size = extract64(s->eventq.base, 0, 5);
+        if (s->eventq.log2size > SMMU_EVENTQS) {
+            s->eventq.log2size = SMMU_EVENTQS;
+        }
+        return MEMTX_OK;
+    case A_EVENTQ_BASE + 4:
+        s->eventq.base = deposit64(s->eventq.base, 32, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_PROD:
+        s->eventq.prod = data;
+        return MEMTX_OK;
+    case A_EVENTQ_CONS:
+        s->eventq.cons = data;
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0: /* 64b */
+        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 0, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG0 + 4:
+        s->eventq_irq_cfg0 = deposit64(s->eventq_irq_cfg0, 32, 32, data);
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG1:
+        s->eventq_irq_cfg1 = data;
+        return MEMTX_OK;
+    case A_EVENTQ_IRQ_CFG2:
+        s->eventq_irq_cfg2 = data;
+        return MEMTX_OK;
+    default:
+        qemu_log_mask(LOG_UNIMP,
+                      "%s Unexpected 32-bit access to 0x%"PRIx64" (WI)\n",
+                      __func__, offset);
+        return MEMTX_OK;
+    }
+}
+
 static MemTxResult smmu_write_mmio(void *opaque, hwaddr offset, uint64_t data,
                                    unsigned size, MemTxAttrs attrs)
 {
-    /* not yet implemented */
-    return MEMTX_ERROR;
+    SMMUState *sys = opaque;
+    SMMUv3State *s = ARM_SMMUV3(sys);
+    MemTxResult r;
+
+    /* CONSTRAINED UNPREDICTABLE choice to have page0/1 be exact aliases */
+    offset &= ~0x10000;
+
+    switch (size) {
+    case 8:
+        r = smmu_writell(s, offset, data, attrs);
+        break;
+    case 4:
+        r = smmu_writel(s, offset, data, attrs);
+        break;
+    default:
+        r = MEMTX_ERROR;
+        break;
+    }
+
+    trace_smmuv3_write_mmio(offset, data, size, r);
+    return r;
 }
 
 static MemTxResult smmu_readll(SMMUv3State *s, hwaddr offset,
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_consume(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t con
 smmuv3_cmdq_opcode(const char *opcode) "<--- %s"
 smmuv3_cmdq_consume_out(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "prod:%d, cons:%d, prod_wrap:%d, cons_wrap:%d "
 smmuv3_cmdq_consume_error(const char *cmd_name, uint8_t cmd_error) "Error on %s command execution: %d"
+smmuv3_update(bool is_empty, uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "q empty:%d prod:%d cons:%d p.wrap:%d p.cons:%d"
+smmuv3_update_check_cmd(int error) "cmdq not enabled or error :0x%x"
+smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
+smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
+smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

Let's introduce a helper function aiming at recording an
event in the event queue.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-9-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 148 ++++++++++++++++++++++++++++++++++++++-
 hw/arm/smmuv3.c          | 108 ++++++++++++++++++++++++++--
 hw/arm/trace-events      |   1 +
 3 files changed, 249 insertions(+), 8 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ static inline void smmu_write_cmdq_err(SMMUv3State *s, uint32_t err_type)
     s->cmdq.cons = FIELD_DP32(s->cmdq.cons, CMDQ_CONS, ERR, err_type);
 }
 
-void smmuv3_write_eventq(SMMUv3State *s, Evt *evt);
-
 /* Commands */
 
 typedef enum SMMUCommandType {
@@ -XXX,XX +XXX,XX @@ enum { /* Command completion notification */
 
 #define SMMU_FEATURE_2LVL_STE (1 << 0)
 
+/* Events */
+
+typedef enum SMMUEventType {
+    SMMU_EVT_OK                 = 0x00,
+    SMMU_EVT_F_UUT                    ,
+    SMMU_EVT_C_BAD_STREAMID           ,
+    SMMU_EVT_F_STE_FETCH              ,
+    SMMU_EVT_C_BAD_STE                ,
+    SMMU_EVT_F_BAD_ATS_TREQ           ,
+    SMMU_EVT_F_STREAM_DISABLED        ,
+    SMMU_EVT_F_TRANS_FORBIDDEN        ,
+    SMMU_EVT_C_BAD_SUBSTREAMID        ,
+    SMMU_EVT_F_CD_FETCH               ,
+    SMMU_EVT_C_BAD_CD                 ,
+    SMMU_EVT_F_WALK_EABT              ,
+    SMMU_EVT_F_TRANSLATION      = 0x10,
+    SMMU_EVT_F_ADDR_SIZE              ,
+    SMMU_EVT_F_ACCESS                 ,
+    SMMU_EVT_F_PERMISSION             ,
+    SMMU_EVT_F_TLB_CONFLICT     = 0x20,
+    SMMU_EVT_F_CFG_CONFLICT           ,
+    SMMU_EVT_E_PAGE_REQ         = 0x24,
+} SMMUEventType;
+
+static const char *event_stringify[] = {
+    [SMMU_EVT_OK]                       = "SMMU_EVT_OK",
+    [SMMU_EVT_F_UUT]                    = "SMMU_EVT_F_UUT",
+    [SMMU_EVT_C_BAD_STREAMID]           = "SMMU_EVT_C_BAD_STREAMID",
+    [SMMU_EVT_F_STE_FETCH]              = "SMMU_EVT_F_STE_FETCH",
+    [SMMU_EVT_C_BAD_STE]                = "SMMU_EVT_C_BAD_STE",
+    [SMMU_EVT_F_BAD_ATS_TREQ]           = "SMMU_EVT_F_BAD_ATS_TREQ",
+    [SMMU_EVT_F_STREAM_DISABLED]        = "SMMU_EVT_F_STREAM_DISABLED",
+    [SMMU_EVT_F_TRANS_FORBIDDEN]        = "SMMU_EVT_F_TRANS_FORBIDDEN",
+    [SMMU_EVT_C_BAD_SUBSTREAMID]        = "SMMU_EVT_C_BAD_SUBSTREAMID",
+    [SMMU_EVT_F_CD_FETCH]               = "SMMU_EVT_F_CD_FETCH",
+    [SMMU_EVT_C_BAD_CD]                 = "SMMU_EVT_C_BAD_CD",
+    [SMMU_EVT_F_WALK_EABT]              = "SMMU_EVT_F_WALK_EABT",
+    [SMMU_EVT_F_TRANSLATION]            = "SMMU_EVT_F_TRANSLATION",
+    [SMMU_EVT_F_ADDR_SIZE]              = "SMMU_EVT_F_ADDR_SIZE",
+    [SMMU_EVT_F_ACCESS]                 = "SMMU_EVT_F_ACCESS",
+    [SMMU_EVT_F_PERMISSION]             = "SMMU_EVT_F_PERMISSION",
+    [SMMU_EVT_F_TLB_CONFLICT]           = "SMMU_EVT_F_TLB_CONFLICT",
+    [SMMU_EVT_F_CFG_CONFLICT]           = "SMMU_EVT_F_CFG_CONFLICT",
+    [SMMU_EVT_E_PAGE_REQ]               = "SMMU_EVT_E_PAGE_REQ",
+};
+
+static inline const char *smmu_event_string(SMMUEventType type)
+{
+    if (type < ARRAY_SIZE(event_stringify)) {
+        return event_stringify[type] ? event_stringify[type] : "UNKNOWN";
+    } else {
+        return "INVALID";
+    }
+}
+
+/*  Encode an event record */
+typedef struct SMMUEventInfo {
+    SMMUEventType type;
+    uint32_t sid;
+    bool recorded;
+    bool record_trans_faults;
+    union {
+        struct {
+            uint32_t ssid;
+            bool ssv;
+            dma_addr_t addr;
+            bool rnw;
+            bool pnu;
+            bool ind;
+       } f_uut;
+       struct SSIDInfo {
+            uint32_t ssid;
+            bool ssv;
+       } c_bad_streamid;
+       struct SSIDAddrInfo {
+            uint32_t ssid;
+            bool ssv;
+            dma_addr_t addr;
+       } f_ste_fetch;
+       struct SSIDInfo c_bad_ste;
+       struct {
+            dma_addr_t addr;
+            bool rnw;
+       } f_transl_forbidden;
+       struct {
+            uint32_t ssid;
+       } c_bad_substream;
+       struct SSIDAddrInfo f_cd_fetch;
+       struct SSIDInfo c_bad_cd;
+       struct FullInfo {
+            bool stall;
+            uint16_t stag;
+            uint32_t ssid;
+            bool ssv;
+            bool s2;
+            dma_addr_t addr;
+            bool rnw;
+            bool pnu;
+            bool ind;
+            uint8_t class;
+            dma_addr_t addr2;
+       } f_walk_eabt;
+       struct FullInfo f_translation;
+       struct FullInfo f_addr_size;
+       struct FullInfo f_access;
+       struct FullInfo f_permission;
+       struct SSIDInfo f_cfg_conflict;
+       /**
+        * not supported yet:
+        * F_BAD_ATS_TREQ
+        * F_BAD_ATS_TREQ
+        * F_TLB_CONFLICT
+        * E_PAGE_REQUEST
+        * IMPDEF_EVENTn
+        */
+    } u;
+} SMMUEventInfo;
+
+/* EVTQ fields */
+
+#define EVT_Q_OVERFLOW        (1 << 31)
+
+#define EVT_SET_TYPE(x, v)              deposit32((x)->word[0], 0 , 8 , v)
+#define EVT_SET_SSV(x, v)               deposit32((x)->word[0], 11, 1 , v)
+#define EVT_SET_SSID(x, v)              deposit32((x)->word[0], 12, 20, v)
+#define EVT_SET_SID(x, v)               ((x)->word[1] = v)
+#define EVT_SET_STAG(x, v)              deposit32((x)->word[2], 0 , 16, v)
+#define EVT_SET_STALL(x, v)             deposit32((x)->word[2], 31, 1 , v)
+#define EVT_SET_PNU(x, v)               deposit32((x)->word[3], 1 , 1 , v)
+#define EVT_SET_IND(x, v)               deposit32((x)->word[3], 2 , 1 , v)
+#define EVT_SET_RNW(x, v)               deposit32((x)->word[3], 3 , 1 , v)
+#define EVT_SET_S2(x, v)                deposit32((x)->word[3], 7 , 1 , v)
+#define EVT_SET_CLASS(x, v)             deposit32((x)->word[3], 8 , 2 , v)
+#define EVT_SET_ADDR(x, addr)                             \
+    do {                                                  \
+            (x)->word[5] = (uint32_t)(addr >> 32);        \
+            (x)->word[4] = (uint32_t)(addr & 0xffffffff); \
+    } while (0)
+#define EVT_SET_ADDR2(x, addr)                            \
+    do {                                                  \
+            deposit32((x)->word[7], 3, 29, addr >> 16);   \
+            deposit32((x)->word[7], 0, 16, addr & 0xffff);\
+    } while (0)
+
+void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult queue_write(SMMUQueue *q, void *data)
     return MEMTX_OK;
 }
 
-void smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
+static MemTxResult smmuv3_write_eventq(SMMUv3State *s, Evt *evt)
 {
     SMMUQueue *q = &s->eventq;
+    MemTxResult r;
+
+    if (!smmuv3_eventq_enabled(s)) {
+        return MEMTX_ERROR;
+    }
+
+    if (smmuv3_q_full(q)) {
+        return MEMTX_ERROR;
+    }
+
+    r = queue_write(q, evt);
+    if (r != MEMTX_OK) {
+        return r;
+    }
+
+    if (smmuv3_q_empty(q)) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    }
+    return MEMTX_OK;
+}
+
+void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
+{
+    Evt evt;
+    MemTxResult r;
 
     if (!smmuv3_eventq_enabled(s)) {
         return;
     }
 
-    if (smmuv3_q_full(q)) {
+    EVT_SET_TYPE(&evt, info->type);
+    EVT_SET_SID(&evt, info->sid);
+
+    switch (info->type) {
+    case SMMU_EVT_OK:
         return;
+    case SMMU_EVT_F_UUT:
+        EVT_SET_SSID(&evt, info->u.f_uut.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_uut.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_uut.addr);
+        EVT_SET_RNW(&evt,  info->u.f_uut.rnw);
+        EVT_SET_PNU(&evt,  info->u.f_uut.pnu);
+        EVT_SET_IND(&evt,  info->u.f_uut.ind);
+        break;
+    case SMMU_EVT_C_BAD_STREAMID:
+        EVT_SET_SSID(&evt, info->u.c_bad_streamid.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_streamid.ssv);
+        break;
+    case SMMU_EVT_F_STE_FETCH:
+        EVT_SET_SSID(&evt, info->u.f_ste_fetch.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_ste_fetch.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_ste_fetch.addr);
+        break;
+    case SMMU_EVT_C_BAD_STE:
+        EVT_SET_SSID(&evt, info->u.c_bad_ste.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_ste.ssv);
+        break;
+    case SMMU_EVT_F_STREAM_DISABLED:
+        break;
+    case SMMU_EVT_F_TRANS_FORBIDDEN:
+        EVT_SET_ADDR(&evt, info->u.f_transl_forbidden.addr);
+        EVT_SET_RNW(&evt, info->u.f_transl_forbidden.rnw);
+        break;
+    case SMMU_EVT_C_BAD_SUBSTREAMID:
+        EVT_SET_SSID(&evt, info->u.c_bad_substream.ssid);
+        break;
+    case SMMU_EVT_F_CD_FETCH:
+        EVT_SET_SSID(&evt, info->u.f_cd_fetch.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_cd_fetch.ssv);
+        EVT_SET_ADDR(&evt, info->u.f_cd_fetch.addr);
+        break;
+    case SMMU_EVT_C_BAD_CD:
+        EVT_SET_SSID(&evt, info->u.c_bad_cd.ssid);
+        EVT_SET_SSV(&evt,  info->u.c_bad_cd.ssv);
+        break;
+    case SMMU_EVT_F_WALK_EABT:
+    case SMMU_EVT_F_TRANSLATION:
+    case SMMU_EVT_F_ADDR_SIZE:
+    case SMMU_EVT_F_ACCESS:
+    case SMMU_EVT_F_PERMISSION:
+        EVT_SET_STALL(&evt, info->u.f_walk_eabt.stall);
+        EVT_SET_STAG(&evt, info->u.f_walk_eabt.stag);
+        EVT_SET_SSID(&evt, info->u.f_walk_eabt.ssid);
+        EVT_SET_SSV(&evt, info->u.f_walk_eabt.ssv);
+        EVT_SET_S2(&evt, info->u.f_walk_eabt.s2);
+        EVT_SET_ADDR(&evt, info->u.f_walk_eabt.addr);
+        EVT_SET_RNW(&evt, info->u.f_walk_eabt.rnw);
+        EVT_SET_PNU(&evt, info->u.f_walk_eabt.pnu);
+        EVT_SET_IND(&evt, info->u.f_walk_eabt.ind);
+        EVT_SET_CLASS(&evt, info->u.f_walk_eabt.class);
+        EVT_SET_ADDR2(&evt, info->u.f_walk_eabt.addr2);
+        break;
+    case SMMU_EVT_F_CFG_CONFLICT:
+        EVT_SET_SSID(&evt, info->u.f_cfg_conflict.ssid);
+        EVT_SET_SSV(&evt,  info->u.f_cfg_conflict.ssv);
+        break;
+    /* rest is not implemented */
+    case SMMU_EVT_F_BAD_ATS_TREQ:
+    case SMMU_EVT_F_TLB_CONFLICT:
+    case SMMU_EVT_E_PAGE_REQ:
+    default:
+        g_assert_not_reached();
     }
 
-    queue_write(q, evt);
-
-    if (smmuv3_q_empty(q)) {
-        smmuv3_trigger_irq(s, SMMU_IRQ_EVTQ, 0);
+    trace_smmuv3_record_event(smmu_event_string(info->type), info->sid);
+    r = smmuv3_write_eventq(s, &evt);
+    if (r != MEMTX_OK) {
+        smmuv3_trigger_irq(s, SMMU_IRQ_GERROR, R_GERROR_EVENTQ_ABT_ERR_MASK);
     }
+    info->recorded = true;
 }
 
 static void smmuv3_init_regs(SMMUv3State *s)
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr:
 smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx val64:0x%lx"
 smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
+smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

This patch implements the IOMMU Memory Region translate()
callback. Most of the code relates to the translation
configuration decoding and check (STE, CD).

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Message-id: 1524665762-31355-10-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 160 +++++++++++++++++
 hw/arm/smmuv3.c          | 358 +++++++++++++++++++++++++++++++++++++++
 hw/arm/trace-events      |   9 +
 3 files changed, 527 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUEventInfo {
 
 void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *event);
 
+/* Configuration Data */
+
+/* STE Level 1 Descriptor */
+typedef struct STEDesc {
+    uint32_t word[2];
+} STEDesc;
+
+/* CD Level 1 Descriptor */
+typedef struct CDDesc {
+    uint32_t word[2];
+} CDDesc;
+
+/* Stream Table Entry(STE) */
+typedef struct STE {
+    uint32_t word[16];
+} STE;
+
+/* Context Descriptor(CD) */
+typedef struct CD {
+    uint32_t word[16];
+} CD;
+
+/* STE fields */
+
+#define STE_VALID(x)   extract32((x)->word[0], 0, 1)
+
+#define STE_CONFIG(x)  extract32((x)->word[0], 1, 3)
+#define STE_CFG_S1_ENABLED(config) (config & 0x1)
+#define STE_CFG_S2_ENABLED(config) (config & 0x2)
+#define STE_CFG_ABORT(config)      (!(config & 0x4))
+#define STE_CFG_BYPASS(config)     (config == 0x4)
+
+#define STE_S1FMT(x)       extract32((x)->word[0], 4 , 2)
+#define STE_S1CDMAX(x)     extract32((x)->word[1], 27, 5)
+#define STE_S1STALLD(x)    extract32((x)->word[2], 27, 1)
+#define STE_EATS(x)        extract32((x)->word[2], 28, 2)
+#define STE_STRW(x)        extract32((x)->word[2], 30, 2)
+#define STE_S2VMID(x)      extract32((x)->word[4], 0 , 16)
+#define STE_S2T0SZ(x)      extract32((x)->word[5], 0 , 6)
+#define STE_S2SL0(x)       extract32((x)->word[5], 6 , 2)
+#define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
+#define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
+#define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_CTXPTR(x)                                           \
+    ({                                                          \
+        unsigned long addr;                                     \
+        addr = (uint64_t)extract32((x)->word[1], 0, 16) << 32;  \
+        addr |= (uint64_t)((x)->word[0] & 0xffffffc0);          \
+        addr;                                                   \
+    })
+
+#define STE_S2TTB(x)                                            \
+    ({                                                          \
+        unsigned long addr;                                     \
+        addr = (uint64_t)extract32((x)->word[7], 0, 16) << 32;  \
+        addr |= (uint64_t)((x)->word[6] & 0xfffffff0);          \
+        addr;                                                   \
+    })
+
+static inline int oas2bits(int oas_field)
+{
+    switch (oas_field) {
+    case 0:
+        return 32;
+    case 1:
+        return 36;
+    case 2:
+        return 40;
+    case 3:
+        return 42;
+    case 4:
+        return 44;
+    case 5:
+        return 48;
+    }
+    return -1;
+}
+
+static inline int pa_range(STE *ste)
+{
+    int oas_field = MIN(STE_S2PS(ste), SMMU_IDR5_OAS);
+
+    if (!STE_S2AA64(ste)) {
+        return 40;
+    }
+
+    return oas2bits(oas_field);
+}
+
+#define MAX_PA(ste) ((1 << pa_range(ste)) - 1)
+
+/* CD fields */
+
+#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
+#define CD_ASID(x)    extract32((x)->word[1], 16, 16)
+#define CD_TTB(x, sel)                                      \
+    ({                                                      \
+        uint64_t hi, lo;                                    \
+        hi = extract32((x)->word[(sel) * 2 + 3], 0, 19);    \
+        hi <<= 32;                                          \
+        lo = (x)->word[(sel) * 2 + 2] & ~0xfULL;            \
+        hi | lo;                                            \
+    })
+
+#define CD_TSZ(x, sel)   extract32((x)->word[0], (16 * (sel)) + 0, 6)
+#define CD_TG(x, sel)    extract32((x)->word[0], (16 * (sel)) + 6, 2)
+#define CD_EPD(x, sel)   extract32((x)->word[0], (16 * (sel)) + 14, 1)
+#define CD_ENDI(x)       extract32((x)->word[0], 15, 1)
+#define CD_IPS(x)        extract32((x)->word[1], 0 , 3)
+#define CD_TBI(x)        extract32((x)->word[1], 6 , 2)
+#define CD_HD(x)         extract32((x)->word[1], 10 , 1)
+#define CD_HA(x)         extract32((x)->word[1], 11 , 1)
+#define CD_S(x)          extract32((x)->word[1], 12, 1)
+#define CD_R(x)          extract32((x)->word[1], 13, 1)
+#define CD_A(x)          extract32((x)->word[1], 14, 1)
+#define CD_AARCH64(x)    extract32((x)->word[1], 9 , 1)
+
+#define CDM_VALID(x)    ((x)->word[0] & 0x1)
+
+static inline int is_cd_valid(SMMUv3State *s, STE *ste, CD *cd)
+{
+    return CD_VALID(cd);
+}
+
+/**
+ * tg2granule - Decodes the CD translation granule size field according
+ * to the ttbr in use
+ * @bits: TG0/1 fields
+ * @ttbr: ttbr index in use
+ */
+static inline int tg2granule(int bits, int ttbr)
+{
+    switch (bits) {
+    case 0:
+        return ttbr ? 0  : 12;
+    case 1:
+        return ttbr ? 14 : 16;
+    case 2:
+        return ttbr ? 12 : 14;
+    case 3:
+        return ttbr ? 16 :  0;
+    default:
+        return 0;
+    }
+}
+
+static inline uint64_t l1std_l2ptr(STEDesc *desc)
+{
+    uint64_t hi, lo;
+
+    hi = desc->word[1];
+    lo = desc->word[0] & ~0x1fULL;
+    return hi << 32 | lo;
+}
+
+#define L1STD_SPAN(stm) (extract32((stm)->word[0], 0, 4))
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->sid_split = 0;
 }
 
+static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
+                        SMMUEventInfo *event)
+{
+    int ret;
+
+    trace_smmuv3_get_ste(addr);
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                          (void *)buf, sizeof(*buf));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
+        event->type = SMMU_EVT_F_STE_FETCH;
+        event->u.f_ste_fetch.addr = addr;
+        return -EINVAL;
+    }
+    return 0;
+
+}
+
+/* @ssid > 0 not supported yet */
+static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
+                       CD *buf, SMMUEventInfo *event)
+{
+    dma_addr_t addr = STE_CTXPTR(ste);
+    int ret;
+
+    trace_smmuv3_get_cd(addr);
+    /* TODO: guarantee 64-bit single-copy atomicity */
+    ret = dma_memory_read(&address_space_memory, addr,
+                           (void *)buf, sizeof(*buf));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Cannot fetch pte at address=0x%"PRIx64"\n", addr);
+        event->type = SMMU_EVT_F_CD_FETCH;
+        event->u.f_ste_fetch.addr = addr;
+        return -EINVAL;
+    }
+    return 0;
+}
+
+/* Returns <0 if the caller has no need to continue the translation */
+static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
+                      STE *ste, SMMUEventInfo *event)
+{
+    uint32_t config;
+    int ret = -EINVAL;
+
+    if (!STE_VALID(ste)) {
+        goto bad_ste;
+    }
+
+    config = STE_CONFIG(ste);
+
+    if (STE_CFG_ABORT(config)) {
+        cfg->aborted = true; /* abort but don't record any event */
+        return ret;
+    }
+
+    if (STE_CFG_BYPASS(config)) {
+        cfg->bypassed = true;
+        return ret;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+        goto bad_ste;
+    }
+
+    if (STE_S1CDMAX(ste) != 0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 does not support multiple context descriptors yet\n");
+        goto bad_ste;
+    }
+
+    if (STE_S1STALLD(ste)) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 S1 stalling fault model not allowed yet\n");
+        goto bad_ste;
+    }
+    return 0;
+
+bad_ste:
+    event->type = SMMU_EVT_C_BAD_STE;
+    return -EINVAL;
+}
+
+/**
+ * smmu_find_ste - Return the stream table entry associated
+ * to the sid
+ *
+ * @s: smmuv3 handle
+ * @sid: stream ID
+ * @ste: returned stream table entry
+ * @event: handle to an event info
+ *
+ * Supports linear and 2-level stream table
+ * Return 0 on success, -EINVAL otherwise
+ */
+static int smmu_find_ste(SMMUv3State *s, uint32_t sid, STE *ste,
+                         SMMUEventInfo *event)
+{
+    dma_addr_t addr;
+    int ret;
+
+    trace_smmuv3_find_ste(sid, s->features, s->sid_split);
+    /* Check SID range */
+    if (sid > (1 << SMMU_IDR1_SIDSIZE)) {
+        event->type = SMMU_EVT_C_BAD_STREAMID;
+        return -EINVAL;
+    }
+    if (s->features & SMMU_FEATURE_2LVL_STE) {
+        int l1_ste_offset, l2_ste_offset, max_l2_ste, span;
+        dma_addr_t strtab_base, l1ptr, l2ptr;
+        STEDesc l1std;
+
+        strtab_base = s->strtab_base & SMMU_BASE_ADDR_MASK;
+        l1_ste_offset = sid >> s->sid_split;
+        l2_ste_offset = sid & ((1 << s->sid_split) - 1);
+        l1ptr = (dma_addr_t)(strtab_base + l1_ste_offset * sizeof(l1std));
+        /* TODO: guarantee 64-bit single-copy atomicity */
+        ret = dma_memory_read(&address_space_memory, l1ptr,
+                              (uint8_t *)&l1std, sizeof(l1std));
+        if (ret != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Could not read L1PTR at 0X%"PRIx64"\n", l1ptr);
+            event->type = SMMU_EVT_F_STE_FETCH;
+            event->u.f_ste_fetch.addr = l1ptr;
+            return -EINVAL;
+        }
+
+        span = L1STD_SPAN(&l1std);
+
+        if (!span) {
+            /* l2ptr is not valid */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "invalid sid=%d (L1STD span=0)\n", sid);
+            event->type = SMMU_EVT_C_BAD_STREAMID;
+            return -EINVAL;
+        }
+        max_l2_ste = (1 << span) - 1;
+        l2ptr = l1std_l2ptr(&l1std);
+        trace_smmuv3_find_ste_2lvl(s->strtab_base, l1ptr, l1_ste_offset,
+                                   l2ptr, l2_ste_offset, max_l2_ste);
+        if (l2_ste_offset > max_l2_ste) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "l2_ste_offset=%d > max_l2_ste=%d\n",
+                          l2_ste_offset, max_l2_ste);
+            event->type = SMMU_EVT_C_BAD_STE;
+            return -EINVAL;
+        }
+        addr = l2ptr + l2_ste_offset * sizeof(*ste);
+    } else {
+        addr = s->strtab_base + sid * sizeof(*ste);
+    }
+
+    if (smmu_get_ste(s, addr, ste, event)) {
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int decode_cd(SMMUTransCfg *cfg, CD *cd, SMMUEventInfo *event)
+{
+    int ret = -EINVAL;
+    int i;
+
+    if (!CD_VALID(cd) || !CD_AARCH64(cd)) {
+        goto bad_cd;
+    }
+    if (!CD_A(cd)) {
+        goto bad_cd; /* SMMU_IDR0.TERM_MODEL == 1 */
+    }
+    if (CD_S(cd)) {
+        goto bad_cd; /* !STE_SECURE && SMMU_IDR0.STALL_MODEL == 1 */
+    }
+    if (CD_HA(cd) || CD_HD(cd)) {
+        goto bad_cd; /* HTTU = 0 */
+    }
+
+    /* we support only those at the moment */
+    cfg->aa64 = true;
+    cfg->stage = 1;
+
+    cfg->oas = oas2bits(CD_IPS(cd));
+    cfg->oas = MIN(oas2bits(SMMU_IDR5_OAS), cfg->oas);
+    cfg->tbi = CD_TBI(cd);
+    cfg->asid = CD_ASID(cd);
+
+    trace_smmuv3_decode_cd(cfg->oas);
+
+    /* decode data dependent on TT */
+    for (i = 0; i <= 1; i++) {
+        int tg, tsz;
+        SMMUTransTableInfo *tt = &cfg->tt[i];
+
+        cfg->tt[i].disabled = CD_EPD(cd, i);
+        if (cfg->tt[i].disabled) {
+            continue;
+        }
+
+        tsz = CD_TSZ(cd, i);
+        if (tsz < 16 || tsz > 39) {
+            goto bad_cd;
+        }
+
+        tg = CD_TG(cd, i);
+        tt->granule_sz = tg2granule(tg, i);
+        if ((tt->granule_sz != 12 && tt->granule_sz != 16) || CD_ENDI(cd)) {
+            goto bad_cd;
+        }
+
+        tt->tsz = tsz;
+        tt->ttb = CD_TTB(cd, i);
+        if (tt->ttb & ~(MAKE_64BIT_MASK(0, cfg->oas))) {
+            goto bad_cd;
+        }
+        trace_smmuv3_decode_cd_tt(i, tt->tsz, tt->ttb, tt->granule_sz);
+    }
+
+    event->record_trans_faults = CD_R(cd);
+
+    return 0;
+
+bad_cd:
+    event->type = SMMU_EVT_C_BAD_CD;
+    return ret;
+}
+
+/**
+ * smmuv3_decode_config - Prepare the translation configuration
+ * for the @mr iommu region
+ * @mr: iommu memory region the translation config must be prepared for
+ * @cfg: output translation configuration which is populated through
+ *       the different configuration decoding steps
+ * @event: must be zero'ed by the caller
+ *
+ * return < 0 if the translation needs to be aborted (@event is filled
+ * accordingly). Return 0 otherwise.
+ */
+static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
+                                SMMUEventInfo *event)
+{
+    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
+    uint32_t sid = smmu_get_sid(sdev);
+    SMMUv3State *s = sdev->smmu;
+    int ret = -EINVAL;
+    STE ste;
+    CD cd;
+
+    if (smmu_find_ste(s, sid, &ste, event)) {
+        return ret;
+    }
+
+    if (decode_ste(s, cfg, &ste, event)) {
+        return ret;
+    }
+
+    if (smmu_get_cd(s, &ste, 0 /* ssid */, &cd, event)) {
+        return ret;
+    }
+
+    return decode_cd(cfg, &cd, event);
+}
+
+static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+                                      IOMMUAccessFlags flag)
+{
+    SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
+    SMMUv3State *s = sdev->smmu;
+    uint32_t sid = smmu_get_sid(sdev);
+    SMMUEventInfo event = {.type = SMMU_EVT_OK, .sid = sid};
+    SMMUPTWEventInfo ptw_info = {};
+    SMMUTransCfg cfg = {};
+    IOMMUTLBEntry entry = {
+        .target_as = &address_space_memory,
+        .iova = addr,
+        .translated_addr = addr,
+        .addr_mask = ~(hwaddr)0,
+        .perm = IOMMU_NONE,
+    };
+    int ret = 0;
+
+    if (!smmu_enabled(s)) {
+        goto out;
+    }
+
+    ret = smmuv3_decode_config(mr, &cfg, &event);
+    if (ret) {
+        goto out;
+    }
+
+    if (cfg.aborted) {
+        goto out;
+    }
+
+    ret = smmu_ptw(&cfg, addr, flag, &entry, &ptw_info);
+    if (ret) {
+        switch (ptw_info.type) {
+        case SMMU_PTW_ERR_WALK_EABT:
+            event.type = SMMU_EVT_F_WALK_EABT;
+            event.u.f_walk_eabt.addr = addr;
+            event.u.f_walk_eabt.rnw = flag & 0x1;
+            event.u.f_walk_eabt.class = 0x1;
+            event.u.f_walk_eabt.addr2 = ptw_info.addr;
+            break;
+        case SMMU_PTW_ERR_TRANSLATION:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_ADDR_SIZE:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_ADDR_SIZE;
+                event.u.f_addr_size.addr = addr;
+                event.u.f_addr_size.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_ACCESS:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_ACCESS;
+                event.u.f_access.addr = addr;
+                event.u.f_access.rnw = flag & 0x1;
+            }
+            break;
+        case SMMU_PTW_ERR_PERMISSION:
+            if (event.record_trans_faults) {
+                event.type = SMMU_EVT_F_PERMISSION;
+                event.u.f_permission.addr = addr;
+                event.u.f_permission.rnw = flag & 0x1;
+            }
+            break;
+        default:
+            g_assert_not_reached();
+        }
+    }
+out:
+    if (ret) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s translation failed for iova=0x%"PRIx64"(%d)\n",
+                      mr->parent_obj.name, addr, ret);
+        entry.perm = IOMMU_NONE;
+        smmuv3_record_event(s, &event);
+    } else if (!cfg.aborted) {
+        entry.perm = flag;
+        trace_smmuv3_translate(mr->parent_obj.name, sid, addr,
+                               entry.translated_addr, entry.perm);
+    }
+
+    return entry;
+}
+
 static int smmuv3_cmdq_consume(SMMUv3State *s)
 {
     SMMUCmdError cmd_error = SMMU_CERROR_NONE;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
                                                   void *data)
 {
+    IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
+
+    imrc->translate = smmuv3_translate;
 }
 
 static const TypeInfo smmuv3_type_info = {
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_write_mmio_idr(uint64_t addr, uint64_t val) "write to RO/Unimpl reg 0x%lx
 smmuv3_write_mmio_evtq_cons_bef_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "Before clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_write_mmio_evtq_cons_after_clear(uint32_t prod, uint32_t cons, uint8_t prod_wrap, uint8_t cons_wrap) "after clearing interrupt prod:0x%x cons:0x%x prod.w:%d cons.w:%d"
 smmuv3_record_event(const char *type, uint32_t sid) "%s sid=%d"
+smmuv3_find_ste(uint16_t sid, uint32_t features, uint16_t sid_split) "SID:0x%x features:0x%x, sid_split:0x%x"
+smmuv3_find_ste_2lvl(uint64_t strtab_base, uint64_t l1ptr, int l1_ste_offset, uint64_t l2ptr, int l2_ste_offset, int max_l2_ste) "strtab_base:0x%lx l1ptr:0x%"PRIx64" l1_off:0x%x, l2ptr:0x%"PRIx64" l2_off:0x%x max_l2_ste:%d"
+smmuv3_get_ste(uint64_t addr) "STE addr: 0x%"PRIx64
+smmuv3_translate_bypass(const char *n, uint16_t sid, uint64_t addr, bool is_write) "%s sid=%d bypass iova:0x%"PRIx64" is_write=%d"
+smmuv3_translate_in(uint16_t sid, int pci_bus_num, uint64_t strtab_base) "SID:0x%x bus:%d strtab_base:0x%"PRIx64
+smmuv3_get_cd(uint64_t addr) "CD addr: 0x%"PRIx64
+smmuv3_translate(const char *n, uint16_t sid, uint64_t iova, uint64_t translated, int perm) "%s sid=%d iova=0x%"PRIx64" translated=0x%"PRIx64" perm=0x%x"
+smmuv3_decode_cd(uint32_t oas) "oas=%d"
+smmuv3_decode_cd_tt(int i, uint32_t tsz, uint64_t ttb, uint32_t granule_sz) "TT[%d]:tsz:%d ttb:0x%"PRIx64" granule_sz:%d"
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

At the moment, the SMMUv3 does not support notification on
TLB invalidation. So let's log an error as soon as such notifier
gets enabled.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 1524665762-31355-11-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
     dc->realize = smmu_realize;
 }
 
+static void smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
+                                       IOMMUNotifierFlag old,
+                                       IOMMUNotifierFlag new)
+{
+    if (old == IOMMU_NOTIFIER_NONE) {
+        warn_report("SMMUV3 does not support vhost/vfio integration yet: "
+                    "devices of those types will not function properly");
+    }
+}
+
 static void smmuv3_iommu_memory_region_class_init(ObjectClass *klass,
                                                   void *data)
 {
     IOMMUMemoryRegionClass *imrc = IOMMU_MEMORY_REGION_CLASS(klass);
 
     imrc->translate = smmuv3_translate;
+    imrc->notify_flag_changed = smmuv3_notify_flag_changed;
 }
 
 static const TypeInfo smmuv3_type_info = {
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

In case the MSI is translated by an IOMMU we need to fixup the
MSI route with the translated address.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Bharat Bhushan <Bharat.Bhushan@nxp.com>
Message-id: 1524665762-31355-12-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c        | 38 +++++++++++++++++++++++++++++++++++++-
 target/arm/trace-events |  3 +++
 2 files changed, 40 insertions(+), 1 deletion(-)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "cpu.h"
+#include "trace.h"
 #include "internals.h"
 #include "hw/arm/arm.h"
+#include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "exec/address-spaces.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void)
 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
                              uint64_t address, uint32_t data, PCIDevice *dev)
 {
-    return 0;
+    AddressSpace *as = pci_device_iommu_address_space(dev);
+    hwaddr xlat, len, doorbell_gpa;
+    MemoryRegionSection mrs;
+    MemoryRegion *mr;
+    int ret = 1;
+
+    if (as == &address_space_memory) {
+        return 0;
+    }
+
+    /* MSI doorbell address is translated by an IOMMU */
+
+    rcu_read_lock();
+    mr = address_space_translate(as, address, &xlat, &len, true);
+    if (!mr) {
+        goto unlock;
+    }
+    mrs = memory_region_find(mr, xlat, 1);
+    if (!mrs.mr) {
+        goto unlock;
+    }
+
+    doorbell_gpa = mrs.offset_within_address_space;
+    memory_region_unref(mrs.mr);
+
+    route->u.msi.address_lo = doorbell_gpa;
+    route->u.msi.address_hi = doorbell_gpa >> 32;
+
+    trace_kvm_arm_fixup_msi_route(address, doorbell_gpa);
+
+    ret = 0;
+
+unlock:
+    rcu_read_unlock();
+    return ret;
 }
 
 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
diff --git a/target/arm/trace-events b/target/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -XXX,XX +XXX,XX @@ arm_gt_tval_write(int timer, uint64_t value) "gt_tval_write: timer %d value 0x%"
 arm_gt_ctl_write(int timer, uint64_t value) "gt_ctl_write: timer %d value 0x%" PRIx64
 arm_gt_imask_toggle(int timer, int irqstate) "gt_ctl_write: timer %d IMASK toggle, new irqstate %d"
 arm_gt_cntvoff_write(uint64_t value) "gt_cntvoff_write: value 0x%" PRIx64
+
+# target/arm/kvm.c
+kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

Add code to instantiate an smmuv3 in virt machine. A new iommu
integer member is introduced in VirtMachineState to store the type
of the iommu in use.

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 
 #define NUM_GICV2M_SPIS       64
 #define NUM_VIRTIO_TRANSPORTS 32
+#define NUM_SMMU_IRQS          4
 
 #define ARCH_GICV3_MAINT_IRQ  9
 
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_GIC_V2M,
     VIRT_GIC_ITS,
     VIRT_GIC_REDIST,
+    VIRT_SMMU,
     VIRT_UART,
     VIRT_MMIO,
     VIRT_RTC,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_SECURE_MEM,
 };
 
+typedef enum VirtIOMMUType {
+    VIRT_IOMMU_NONE,
+    VIRT_IOMMU_SMMUV3,
+    VIRT_IOMMU_VIRTIO,
+} VirtIOMMUType;
+
 typedef struct MemMapEntry {
     hwaddr base;
     hwaddr size;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     bool its;
     bool virt;
     int32_t gic_version;
+    VirtIOMMUType iommu;
     struct arm_boot_info bootinfo;
     const MemMapEntry *memmap;
     const int *irqmap;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t clock_phandle;
     uint32_t gic_phandle;
     uint32_t msi_phandle;
+    uint32_t iommu_phandle;
     int psci_conduit;
 } VirtMachineState;
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/smbios/smbios.h"
 #include "qapi/visitor.h"
 #include "standard-headers/linux/input.h"
+#include "hw/arm/smmuv3.h"
 
 #define DEFINE_VIRT_MACHINE_LATEST(major, minor, latest) \
     static void virt_##major##_##minor##_class_init(ObjectClass *oc, \
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry a15memmap[] = {
     [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
     [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
     [VIRT_SECURE_UART] =        { 0x09040000, 0x00001000 },
+    [VIRT_SMMU] =               { 0x09050000, 0x00020000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static const int a15irqmap[] = {
     [VIRT_SECURE_UART] = 8,
     [VIRT_MMIO] = 16, /* ...to 16 + NUM_VIRTIO_TRANSPORTS - 1 */
     [VIRT_GIC_V2M] = 48, /* ...to 48 + NUM_GICV2M_SPIS - 1 */
+    [VIRT_SMMU] = 74,    /* ...to 74 + NUM_SMMU_IRQS - 1 */
     [VIRT_PLATFORM_BUS] = 112, /* ...to 112 + PLATFORM_BUS_NUM_IRQS -1 */
 };
 
@@ -XXX,XX +XXX,XX @@ static void create_pcie_irq_map(const VirtMachineState *vms,
                            0x7           /* PCI irq */);
 }
 
-static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
+static void create_smmu(const VirtMachineState *vms, qemu_irq *pic,
+                        PCIBus *bus)
+{
+    char *node;
+    const char compat[] = "arm,smmu-v3";
+    int irq =  vms->irqmap[VIRT_SMMU];
+    int i;
+    hwaddr base = vms->memmap[VIRT_SMMU].base;
+    hwaddr size = vms->memmap[VIRT_SMMU].size;
+    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
+    DeviceState *dev;
+
+    if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {
+        return;
+    }
+
+    dev = qdev_create(NULL, "arm-smmuv3");
+
+    object_property_set_link(OBJECT(dev), OBJECT(bus), "primary-bus",
+                             &error_abort);
+    qdev_init_nofail(dev);
+    sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
+    for (i = 0; i < NUM_SMMU_IRQS; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, pic[irq + i]);
+    }
+
+    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
+    qemu_fdt_add_subnode(vms->fdt, node);
+    qemu_fdt_setprop(vms->fdt, node, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(vms->fdt, node, "reg", 2, base, 2, size);
+
+    qemu_fdt_setprop_cells(vms->fdt, node, "interrupts",
+            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+
+    qemu_fdt_setprop(vms->fdt, node, "interrupt-names", irq_names,
+                     sizeof(irq_names));
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "clocks", vms->clock_phandle);
+    qemu_fdt_setprop_string(vms->fdt, node, "clock-names", "apb_pclk");
+    qemu_fdt_setprop(vms->fdt, node, "dma-coherent", NULL, 0);
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "#iommu-cells", 1);
+
+    qemu_fdt_setprop_cell(vms->fdt, node, "phandle", vms->iommu_phandle);
+    g_free(node);
+}
+
+static void create_pcie(VirtMachineState *vms, qemu_irq *pic)
 {
     hwaddr base_mmio = vms->memmap[VIRT_PCIE_MMIO].base;
     hwaddr size_mmio = vms->memmap[VIRT_PCIE_MMIO].size;
@@ -XXX,XX +XXX,XX @@ static void create_pcie(const VirtMachineState *vms, qemu_irq *pic)
     qemu_fdt_setprop_cell(vms->fdt, nodename, "#interrupt-cells", 1);
     create_pcie_irq_map(vms, vms->gic_phandle, irq, nodename);
 
+    if (vms->iommu) {
+        vms->iommu_phandle = qemu_fdt_alloc_phandle(vms->fdt);
+
+        create_smmu(vms, pic, pci->bus);
+
+        qemu_fdt_setprop_cells(vms->fdt, nodename, "iommu-map",
+                               0x0, vms->iommu_phandle, 0x0, 0x10000);
+    }
+
     g_free(nodename);
 }
 
-- 
2.17.0

From: Prem Mallappa <prem.mallappa@broadcom.com>

This patch builds the smmuv3 node in the ACPI IORT table.

The RID space of the root complex, which spans 0x0-0x10000
maps to streamid space 0x0-0x10000 in smmuv3, which in turn
maps to deviceid space 0x0-0x10000 in the ITS group.

The guest must feature the IOMMU probe deferral series
(https://lkml.org/lkml/2017/4/10/214) which fixes streamid
multiple lookup. This bug is not related to the SMMU emulation.

Signed-off-by: Prem Mallappa <prem.mallappa@broadcom.com>
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Shannon Zhao <zhaoshenglong@huawei.com>
Message-id: 1524665762-31355-14-git-send-email-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/acpi/acpi-defs.h | 15 ++++++++++
 hw/arm/virt-acpi-build.c    | 55 ++++++++++++++++++++++++++++++++-----
 2 files changed, 63 insertions(+), 7 deletions(-)

diff --git a/include/hw/acpi/acpi-defs.h b/include/hw/acpi/acpi-defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/acpi/acpi-defs.h
+++ b/include/hw/acpi/acpi-defs.h
@@ -XXX,XX +XXX,XX @@ struct AcpiIortItsGroup {
 } QEMU_PACKED;
 typedef struct AcpiIortItsGroup AcpiIortItsGroup;
 
+struct AcpiIortSmmu3 {
+    ACPI_IORT_NODE_HEADER_DEF
+    uint64_t base_address;
+    uint32_t flags;
+    uint32_t reserved2;
+    uint64_t vatos_address;
+    uint32_t model;
+    uint32_t event_gsiv;
+    uint32_t pri_gsiv;
+    uint32_t gerr_gsiv;
+    uint32_t sync_gsiv;
+    AcpiIortIdMapping id_mapping_array[0];
+} QEMU_PACKED;
+typedef struct AcpiIortSmmu3 AcpiIortSmmu3;
+
 struct AcpiIortRC {
     ACPI_IORT_NODE_HEADER_DEF
     AcpiIortMemoryAccess memory_properties;
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_rsdp(GArray *rsdp_table, BIOSLinker *linker, unsigned xsdt_tbl_offset)
 }
 
 static void
-build_iort(GArray *table_data, BIOSLinker *linker)
+build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
-    int iort_start = table_data->len;
+    int nb_nodes, iort_start = table_data->len;
     AcpiIortIdMapping *idmap;
     AcpiIortItsGroup *its;
     AcpiIortTable *iort;
-    size_t node_size, iort_length;
+    AcpiIortSmmu3 *smmu;
+    size_t node_size, iort_length, smmu_offset = 0;
     AcpiIortRC *rc;
 
     iort = acpi_data_push(table_data, sizeof(*iort));
 
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        nb_nodes = 3; /* RC, ITS, SMMUv3 */
+    } else {
+        nb_nodes = 2; /* RC, ITS */
+    }
+
     iort_length = sizeof(*iort);
-    iort->node_count = cpu_to_le32(2); /* RC and ITS nodes */
+    iort->node_count = cpu_to_le32(nb_nodes);
     iort->node_offset = cpu_to_le32(sizeof(*iort));
 
     /* ITS group node */
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
     its->its_count = cpu_to_le32(1);
     its->identifiers[0] = 0; /* MADT translation_id */
 
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        int irq =  vms->irqmap[VIRT_SMMU];
+
+        /* SMMUv3 node */
+        smmu_offset = iort->node_offset + node_size;
+        node_size = sizeof(*smmu) + sizeof(*idmap);
+        iort_length += node_size;
+        smmu = acpi_data_push(table_data, node_size);
+
+        smmu->type = ACPI_IORT_NODE_SMMU_V3;
+        smmu->length = cpu_to_le16(node_size);
+        smmu->mapping_count = cpu_to_le32(1);
+        smmu->mapping_offset = cpu_to_le32(sizeof(*smmu));
+        smmu->base_address = cpu_to_le64(vms->memmap[VIRT_SMMU].base);
+        smmu->event_gsiv = cpu_to_le32(irq);
+        smmu->pri_gsiv = cpu_to_le32(irq + 1);
+        smmu->gerr_gsiv = cpu_to_le32(irq + 2);
+        smmu->sync_gsiv = cpu_to_le32(irq + 3);
+
+        /* Identity RID mapping covering the whole input RID range */
+        idmap = &smmu->id_mapping_array[0];
+        idmap->input_base = 0;
+        idmap->id_count = cpu_to_le32(0xFFFF);
+        idmap->output_base = 0;
+        /* output IORT node is the ITS group node (the first node) */
+        idmap->output_reference = cpu_to_le32(iort->node_offset);
+    }
+
     /* Root Complex Node */
     node_size = sizeof(*rc) + sizeof(*idmap);
     iort_length += node_size;
@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker)
     idmap->input_base = 0;
     idmap->id_count = cpu_to_le32(0xFFFF);
     idmap->output_base = 0;
-    /* output IORT node is the ITS group node (the first node) */
-    idmap->output_reference = cpu_to_le32(iort->node_offset);
+
+    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+        /* output IORT node is the smmuv3 node */
+        idmap->output_reference = cpu_to_le32(smmu_offset);
+    } else {
+        /* output IORT node is the ITS group node (the first node) */
+        idmap->output_reference = cpu_to_le32(iort->node_offset);
+    }
 
     iort->length = cpu_to_le32(iort_length);
 
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
 
     if (its_class_name() && !vmc->no_its) {
         acpi_add_table(table_offsets, tables_blob);
-        build_iort(tables_blob, tables->linker);
+        build_iort(tables_blob, tables->linker, vms);
     }
 
     /* XSDT is pointed to by RSDP */
-- 
2.17.0

From: Eric Auger <eric.auger@redhat.com>

ARM virt machine now exposes a new "iommu" option.
The SMMUv3 IOMMU is instantiated using -machine virt,iommu=smmuv3.

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_set_gic_version(Object *obj, const char *value, Error **errp)
     }
 }
 
+static char *virt_get_iommu(Object *obj, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    switch (vms->iommu) {
+    case VIRT_IOMMU_NONE:
+        return g_strdup("none");
+    case VIRT_IOMMU_SMMUV3:
+        return g_strdup("smmuv3");
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void virt_set_iommu(Object *obj, const char *value, Error **errp)
+{
+    VirtMachineState *vms = VIRT_MACHINE(obj);
+
+    if (!strcmp(value, "smmuv3")) {
+        vms->iommu = VIRT_IOMMU_SMMUV3;
+    } else if (!strcmp(value, "none")) {
+        vms->iommu = VIRT_IOMMU_NONE;
+    } else {
+        error_setg(errp, "Invalid iommu value");
+        error_append_hint(errp, "Valid values are none, smmuv3.\n");
+    }
+}
+
 static CpuInstanceProperties
 virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
 {
@@ -XXX,XX +XXX,XX @@ static void virt_2_12_instance_init(Object *obj)
                                         NULL);
     }
 
+    /* Default disallows iommu instantiation */
+    vms->iommu = VIRT_IOMMU_NONE;
+    object_property_add_str(obj, "iommu", virt_get_iommu, virt_set_iommu, NULL);
+    object_property_set_description(obj, "iommu",
+                                    "Set the IOMMU type. "
+                                    "Valid values are none and smmuv3",
+                                    NULL);
+
     vms->memmap = a15memmap;
     vms->irqmap = a15irqmap;
 }
-- 
2.17.0

First arm pullreq of the cycle; this is mostly my softfloat NaN
handling series. (Lots more in my to-review queue, but I don't
like pullreqs growing too close to a hundred patches at a time :-))

thanks
-- PMM

The following changes since commit 97f2796a3736ed37a1b85dc1c76a6c45b829dd17:

Open 10.0 development tree (2024-12-10 17:41:17 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241211

for you to fetch changes up to 1abe28d519239eea5cf9620bb13149423e5665f8:

MAINTAINERS: Add correct email address for Vikram Garhwal (2024-12-11 15:31:09 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/net/lan9118: Extract PHY model, reuse with imx_fec, fix bugs
 * fpu: Make muladd NaN handling runtime-selected, not compile-time
 * fpu: Make default NaN pattern runtime-selected, not compile-time
 * fpu: Minor NaN-related cleanups
 * MAINTAINERS: email address updates

----------------------------------------------------------------
Bernhard Beschow (5):
      hw/net/lan9118: Extract lan9118_phy
      hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
      hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
      hw/net/lan9118_phy: Reuse MII constants
      hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement

Leif Lindholm (1):
      MAINTAINERS: update email address for Leif Lindholm

Peter Maydell (54):
      fpu: handle raising Invalid for infzero in pick_nan_muladd
      fpu: Check for default_nan_mode before calling pickNaNMulAdd
      softfloat: Allow runtime choice of inf * 0 + NaN result
      tests/fp: Explicitly set inf-zero-nan rule
      target/arm: Set FloatInfZeroNaNRule explicitly
      target/s390: Set FloatInfZeroNaNRule explicitly
      target/ppc: Set FloatInfZeroNaNRule explicitly
      target/mips: Set FloatInfZeroNaNRule explicitly
      target/sparc: Set FloatInfZeroNaNRule explicitly
      target/xtensa: Set FloatInfZeroNaNRule explicitly
      target/x86: Set FloatInfZeroNaNRule explicitly
      target/loongarch: Set FloatInfZeroNaNRule explicitly
      target/hppa: Set FloatInfZeroNaNRule explicitly
      softfloat: Pass have_snan to pickNaNMulAdd
      softfloat: Allow runtime choice of NaN propagation for muladd
      tests/fp: Explicitly set 3-NaN propagation rule
      target/arm: Set Float3NaNPropRule explicitly
      target/loongarch: Set Float3NaNPropRule explicitly
      target/ppc: Set Float3NaNPropRule explicitly
      target/s390x: Set Float3NaNPropRule explicitly
      target/sparc: Set Float3NaNPropRule explicitly
      target/mips: Set Float3NaNPropRule explicitly
      target/xtensa: Set Float3NaNPropRule explicitly
      target/i386: Set Float3NaNPropRule explicitly
      target/hppa: Set Float3NaNPropRule explicitly
      fpu: Remove use_first_nan field from float_status
      target/m68k: Don't pass NULL float_status to floatx80_default_nan()
      softfloat: Create floatx80 default NaN from parts64_default_nan
      target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
      target/m68k: In frem helper, initialize local float_status from env->fp_status
      target/m68k: Init local float_status from env fp_status in gdb get/set reg
      target/sparc: Initialize local scratch float_status from env->fp_status
      target/ppc: Use env->fp_status in helper_compute_fprf functions
      fpu: Allow runtime choice of default NaN value
      tests/fp: Set default NaN pattern explicitly
      target/microblaze: Set default NaN pattern explicitly
      target/i386: Set default NaN pattern explicitly
      target/hppa: Set default NaN pattern explicitly
      target/alpha: Set default NaN pattern explicitly
      target/arm: Set default NaN pattern explicitly
      target/loongarch: Set default NaN pattern explicitly
      target/m68k: Set default NaN pattern explicitly
      target/mips: Set default NaN pattern explicitly
      target/openrisc: Set default NaN pattern explicitly
      target/ppc: Set default NaN pattern explicitly
      target/sh4: Set default NaN pattern explicitly
      target/rx: Set default NaN pattern explicitly
      target/s390x: Set default NaN pattern explicitly
      target/sparc: Set default NaN pattern explicitly
      target/xtensa: Set default NaN pattern explicitly
      target/hexagon: Set default NaN pattern explicitly
      target/riscv: Set default NaN pattern explicitly
      target/tricore: Set default NaN pattern explicitly
      fpu: Remove default handling for dnan_pattern

Richard Henderson (11):
      target/arm: Copy entire float_status in is_ebf
      softfloat: Inline pickNaNMulAdd
      softfloat: Use goto for default nan case in pick_nan_muladd
      softfloat: Remove which from parts_pick_nan_muladd
      softfloat: Pad array size in pick_nan_muladd
      softfloat: Move propagateFloatx80NaN to softfloat.c
      softfloat: Use parts_pick_nan in propagateFloatx80NaN
      softfloat: Inline pickNaN
      softfloat: Share code between parts_pick_nan cases
      softfloat: Sink frac_cmp in parts_pick_nan until needed
      softfloat: Replace WHICH with RET in parts_pick_nan

Vikram Garhwal (1):
      MAINTAINERS: Add correct email address for Vikram Garhwal

From: Bernhard Beschow <shentey@gmail.com>

A very similar implementation of the same device exists in imx_fec. Prepare for
a common implementation by extracting a device model into its own files.

Some migration state has been moved into the new device model which breaks
migration compatibility for the following machines:
* smdkc210
* realview-*
* vexpress-*
* kzm
* mps2-*

While breaking migration ABI, fix the size of the MII registers to be 16 bit,
as defined by IEEE 802.3u.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-2-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/lan9118_phy.h |  37 ++++++++
 hw/net/lan9118.c             | 137 +++++-----------------------
 hw/net/lan9118_phy.c         | 169 +++++++++++++++++++++++++++++++++++
 hw/net/Kconfig               |   4 +
 hw/net/meson.build           |   1 +
 5 files changed, 233 insertions(+), 115 deletions(-)
 create mode 100644 include/hw/net/lan9118_phy.h
 create mode 100644 hw/net/lan9118_phy.c

diff --git a/include/hw/net/lan9118_phy.h b/include/hw/net/lan9118_phy.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/net/lan9118_phy.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SMSC LAN9118 PHY emulation
+ *
+ * Copyright (c) 2009 CodeSourcery, LLC.
+ * Written by Paul Brook
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef HW_NET_LAN9118_PHY_H
+#define HW_NET_LAN9118_PHY_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+
+#define TYPE_LAN9118_PHY "lan9118-phy"
+OBJECT_DECLARE_SIMPLE_TYPE(Lan9118PhyState, LAN9118_PHY)
+
+typedef struct Lan9118PhyState {
+    SysBusDevice parent_obj;
+
+    uint16_t status;
+    uint16_t control;
+    uint16_t advertise;
+    uint16_t ints;
+    uint16_t int_mask;
+    qemu_irq irq;
+    bool link_down;
+} Lan9118PhyState;
+
+void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down);
+void lan9118_phy_reset(Lan9118PhyState *s);
+uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg);
+void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val);
+
+#endif
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "net/eth.h"
 #include "hw/irq.h"
+#include "hw/net/lan9118_phy.h"
 #include "hw/net/lan9118.h"
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
 #define MAC_CR_RXEN     0x00000004
 #define MAC_CR_RESERVED 0x7f404213
 
-#define PHY_INT_ENERGYON            0x80
-#define PHY_INT_AUTONEG_COMPLETE    0x40
-#define PHY_INT_FAULT               0x20
-#define PHY_INT_DOWN                0x10
-#define PHY_INT_AUTONEG_LP          0x08
-#define PHY_INT_PARFAULT            0x04
-#define PHY_INT_AUTONEG_PAGE        0x02
-
 #define GPT_TIMER_EN    0x20000000
 
 /*
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
     uint32_t mac_mii_data;
     uint32_t mac_flow;
 
-    uint32_t phy_status;
-    uint32_t phy_control;
-    uint32_t phy_advertise;
-    uint32_t phy_int;
-    uint32_t phy_int_mask;
+    Lan9118PhyState mii;
+    IRQState mii_irq;
 
     int32_t eeprom_writable;
     uint8_t eeprom[128];
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
 
 static const VMStateDescription vmstate_lan9118 = {
     .name = "lan9118",
-    .version_id = 2,
-    .minimum_version_id = 1,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
         VMSTATE_PTIMER(timer, lan9118_state),
         VMSTATE_UINT32(irq_cfg, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118 = {
         VMSTATE_UINT32(mac_mii_acc, lan9118_state),
         VMSTATE_UINT32(mac_mii_data, lan9118_state),
         VMSTATE_UINT32(mac_flow, lan9118_state),
-        VMSTATE_UINT32(phy_status, lan9118_state),
-        VMSTATE_UINT32(phy_control, lan9118_state),
-        VMSTATE_UINT32(phy_advertise, lan9118_state),
-        VMSTATE_UINT32(phy_int, lan9118_state),
-        VMSTATE_UINT32(phy_int_mask, lan9118_state),
         VMSTATE_INT32(eeprom_writable, lan9118_state),
         VMSTATE_UINT8_ARRAY(eeprom, lan9118_state, 128),
         VMSTATE_INT32(tx_fifo_size, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static void lan9118_reload_eeprom(lan9118_state *s)
     lan9118_mac_changed(s);
 }
 
-static void phy_update_irq(lan9118_state *s)
+static void lan9118_update_irq(void *opaque, int n, int level)
 {
-    if (s->phy_int & s->phy_int_mask) {
+    lan9118_state *s = opaque;
+
+    if (level) {
         s->int_sts |= PHY_INT;
     } else {
         s->int_sts &= ~PHY_INT;
@@ -XXX,XX +XXX,XX @@ static void phy_update_irq(lan9118_state *s)
     lan9118_update(s);
 }
 
-static void phy_update_link(lan9118_state *s)
-{
-    /* Autonegotiation status mirrors link status.  */
-    if (qemu_get_queue(s->nic)->link_down) {
-        s->phy_status &= ~0x0024;
-        s->phy_int |= PHY_INT_DOWN;
-    } else {
-        s->phy_status |= 0x0024;
-        s->phy_int |= PHY_INT_ENERGYON;
-        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
-    }
-    phy_update_irq(s);
-}
-
 static void lan9118_set_link(NetClientState *nc)
 {
-    phy_update_link(qemu_get_nic_opaque(nc));
-}
-
-static void phy_reset(lan9118_state *s)
-{
-    s->phy_status = 0x7809;
-    s->phy_control = 0x3000;
-    s->phy_advertise = 0x01e1;
-    s->phy_int_mask = 0;
-    s->phy_int = 0;
-    phy_update_link(s);
+    lan9118_phy_update_link(&LAN9118(qemu_get_nic_opaque(nc))->mii,
+                            nc->link_down);
 }
 
 static void lan9118_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
     s->read_word_n = 0;
     s->write_word_n = 0;
 
-    phy_reset(s);
-
     s->eeprom_writable = 0;
     lan9118_reload_eeprom(s);
 }
@@ -XXX,XX +XXX,XX @@ static void do_tx_packet(lan9118_state *s)
     uint32_t status;
 
     /* FIXME: Honor TX disable, and allow queueing of packets.  */
-    if (s->phy_control & 0x4000)  {
+    if (s->mii.control & 0x4000) {
         /* This assumes the receive routine doesn't touch the VLANClient.  */
         qemu_receive_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
     } else {
@@ -XXX,XX +XXX,XX @@ static void tx_fifo_push(lan9118_state *s, uint32_t val)
     }
 }
 
-static uint32_t do_phy_read(lan9118_state *s, int reg)
-{
-    uint32_t val;
-
-    switch (reg) {
-    case 0: /* Basic Control */
-        return s->phy_control;
-    case 1: /* Basic Status */
-        return s->phy_status;
-    case 2: /* ID1 */
-        return 0x0007;
-    case 3: /* ID2 */
-        return 0xc0d1;
-    case 4: /* Auto-neg advertisement */
-        return s->phy_advertise;
-    case 5: /* Auto-neg Link Partner Ability */
-        return 0x0f71;
-    case 6: /* Auto-neg Expansion */
-        return 1;
-        /* TODO 17, 18, 27, 29, 30, 31 */
-    case 29: /* Interrupt source.  */
-        val = s->phy_int;
-        s->phy_int = 0;
-        phy_update_irq(s);
-        return val;
-    case 30: /* Interrupt mask */
-        return s->phy_int_mask;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "do_phy_read: PHY read reg %d\n", reg);
-        return 0;
-    }
-}
-
-static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
-{
-    switch (reg) {
-    case 0: /* Basic Control */
-        if (val & 0x8000) {
-            phy_reset(s);
-            break;
-        }
-        s->phy_control = val & 0x7980;
-        /* Complete autonegotiation immediately.  */
-        if (val & 0x1000) {
-            s->phy_status |= 0x0020;
-        }
-        break;
-    case 4: /* Auto-neg advertisement */
-        s->phy_advertise = (val & 0x2d7f) | 0x80;
-        break;
-        /* TODO 17, 18, 27, 31 */
-    case 30: /* Interrupt mask */
-        s->phy_int_mask = val & 0xff;
-        phy_update_irq(s);
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
-    }
-}
-
 static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
 {
     switch (reg) {
@@ -XXX,XX +XXX,XX @@ static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
         if (val & 2) {
             DPRINTF("PHY write %d = 0x%04x\n",
                     (val >> 6) & 0x1f, s->mac_mii_data);
-            do_phy_write(s, (val >> 6) & 0x1f, s->mac_mii_data);
+            lan9118_phy_write(&s->mii, (val >> 6) & 0x1f, s->mac_mii_data);
         } else {
-            s->mac_mii_data = do_phy_read(s, (val >> 6) & 0x1f);
+            s->mac_mii_data = lan9118_phy_read(&s->mii, (val >> 6) & 0x1f);
             DPRINTF("PHY read %d = 0x%04x\n",
                     (val >> 6) & 0x1f, s->mac_mii_data);
         }
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
         break;
     case CSR_PMT_CTRL:
         if (val & 0x400) {
-            phy_reset(s);
+            lan9118_phy_reset(&s->mii);
         }
         s->pmt_ctrl &= ~0x34e;
         s->pmt_ctrl |= (val & 0x34e);
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
     const MemoryRegionOps *mem_ops =
             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 
+    qemu_init_irq(&s->mii_irq, lan9118_update_irq, s, 0);
+    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
+    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
+
     memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                           "lan9118-mmio", 0x100);
     sysbus_init_mmio(sbd, &s->mmio);
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SMSC LAN9118 PHY emulation
+ *
+ * Copyright (c) 2009 CodeSourcery, LLC.
+ * Written by Paul Brook
+ *
+ * This code is licensed under the GNU GPL v2
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/net/lan9118_phy.h"
+#include "hw/irq.h"
+#include "hw/resettable.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+
+#define PHY_INT_ENERGYON            (1 << 7)
+#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
+#define PHY_INT_FAULT               (1 << 5)
+#define PHY_INT_DOWN                (1 << 4)
+#define PHY_INT_AUTONEG_LP          (1 << 3)
+#define PHY_INT_PARFAULT            (1 << 2)
+#define PHY_INT_AUTONEG_PAGE        (1 << 1)
+
+static void lan9118_phy_update_irq(Lan9118PhyState *s)
+{
+    qemu_set_irq(s->irq, !!(s->ints & s->int_mask));
+}
+
+uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
+{
+    uint16_t val;
+
+    switch (reg) {
+    case 0: /* Basic Control */
+        return s->control;
+    case 1: /* Basic Status */
+        return s->status;
+    case 2: /* ID1 */
+        return 0x0007;
+    case 3: /* ID2 */
+        return 0xc0d1;
+    case 4: /* Auto-neg advertisement */
+        return s->advertise;
+    case 5: /* Auto-neg Link Partner Ability */
+        return 0x0f71;
+    case 6: /* Auto-neg Expansion */
+        return 1;
+        /* TODO 17, 18, 27, 29, 30, 31 */
+    case 29: /* Interrupt source. */
+        val = s->ints;
+        s->ints = 0;
+        lan9118_phy_update_irq(s);
+        return val;
+    case 30: /* Interrupt mask */
+        return s->int_mask;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118_phy_read: PHY read reg %d\n", reg);
+        return 0;
+    }
+}
+
+void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
+{
+    switch (reg) {
+    case 0: /* Basic Control */
+        if (val & 0x8000) {
+            lan9118_phy_reset(s);
+            break;
+        }
+        s->control = val & 0x7980;
+        /* Complete autonegotiation immediately. */
+        if (val & 0x1000) {
+            s->status |= 0x0020;
+        }
+        break;
+    case 4: /* Auto-neg advertisement */
+        s->advertise = (val & 0x2d7f) | 0x80;
+        break;
+        /* TODO 17, 18, 27, 31 */
+    case 30: /* Interrupt mask */
+        s->int_mask = val & 0xff;
+        lan9118_phy_update_irq(s);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
+    }
+}
+
+void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
+{
+    s->link_down = link_down;
+
+    /* Autonegotiation status mirrors link status. */
+    if (link_down) {
+        s->status &= ~0x0024;
+        s->ints |= PHY_INT_DOWN;
+    } else {
+        s->status |= 0x0024;
+        s->ints |= PHY_INT_ENERGYON;
+        s->ints |= PHY_INT_AUTONEG_COMPLETE;
+    }
+    lan9118_phy_update_irq(s);
+}
+
+void lan9118_phy_reset(Lan9118PhyState *s)
+{
+    s->control = 0x3000;
+    s->status = 0x7809;
+    s->advertise = 0x01e1;
+    s->int_mask = 0;
+    s->ints = 0;
+    lan9118_phy_update_link(s, s->link_down);
+}
+
+static void lan9118_phy_reset_hold(Object *obj, ResetType type)
+{
+    Lan9118PhyState *s = LAN9118_PHY(obj);
+
+    lan9118_phy_reset(s);
+}
+
+static void lan9118_phy_init(Object *obj)
+{
+    Lan9118PhyState *s = LAN9118_PHY(obj);
+
+    qdev_init_gpio_out(DEVICE(s), &s->irq, 1);
+}
+
+static const VMStateDescription vmstate_lan9118_phy = {
+    .name = "lan9118-phy",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT16(control, Lan9118PhyState),
+        VMSTATE_UINT16(status, Lan9118PhyState),
+        VMSTATE_UINT16(advertise, Lan9118PhyState),
+        VMSTATE_UINT16(ints, Lan9118PhyState),
+        VMSTATE_UINT16(int_mask, Lan9118PhyState),
+        VMSTATE_BOOL(link_down, Lan9118PhyState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void lan9118_phy_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    rc->phases.hold = lan9118_phy_reset_hold;
+    dc->vmsd = &vmstate_lan9118_phy;
+}
+
+static const TypeInfo types[] = {
+    {
+        .name          = TYPE_LAN9118_PHY,
+        .parent        = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Lan9118PhyState),
+        .instance_init = lan9118_phy_init,
+        .class_init    = lan9118_phy_class_init,
+    }
+};
+
+DEFINE_TYPES(types)
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config VMXNET3_PCI
 config SMC91C111
     bool
 
+config LAN9118_PHY
+    bool
+
 config LAN9118
     bool
+    select LAN9118_PHY
     select PTIMER
 
 config NE2000_ISA
diff --git a/hw/net/meson.build b/hw/net/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/meson.build
+++ b/hw/net/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VMXNET3_PCI', if_true: files('vmxnet3.c'))
 
 system_ss.add(when: 'CONFIG_SMC91C111', if_true: files('smc91c111.c'))
 system_ss.add(when: 'CONFIG_LAN9118', if_true: files('lan9118.c'))
+system_ss.add(when: 'CONFIG_LAN9118_PHY', if_true: files('lan9118_phy.c'))
 system_ss.add(when: 'CONFIG_NE2000_ISA', if_true: files('ne2000-isa.c'))
 system_ss.add(when: 'CONFIG_OPENCORES_ETH', if_true: files('opencores_eth.c'))
 system_ss.add(when: 'CONFIG_XGMAC', if_true: files('xgmac.c'))
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

imx_fec models the same PHY as lan9118_phy. The code is almost the same with
imx_fec having more logging and tracing. Merge these improvements into
lan9118_phy and reuse in imx_fec to fix the code duplication.

Some migration state how resides in the new device model which breaks migration
compatibility for the following machines:
* imx25-pdk
* sabrelite
* mcimx7d-sabre
* mcimx6ul-evk

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h |   9 ++-
 hw/net/imx_fec.c         | 146 ++++-----------------------------------
 hw/net/lan9118_phy.c     |  82 ++++++++++++++++------
 hw/net/Kconfig           |   1 +
 hw/net/trace-events      |  10 +--
 5 files changed, 85 insertions(+), 163 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IMXFECState, IMX_FEC)
 #define TYPE_IMX_ENET "imx.enet"
 
 #include "hw/sysbus.h"
+#include "hw/net/lan9118_phy.h"
+#include "hw/irq.h"
 #include "net/net.h"
 
 #define ENET_EIR               1
@@ -XXX,XX +XXX,XX @@ struct IMXFECState {
     uint32_t tx_descriptor[ENET_TX_RING_NUM];
     uint32_t tx_ring_num;
 
-    uint32_t phy_status;
-    uint32_t phy_control;
-    uint32_t phy_advertise;
-    uint32_t phy_int;
-    uint32_t phy_int_mask;
+    Lan9118PhyState mii;
+    IRQState mii_irq;
     uint32_t phy_num;
     bool phy_connected;
     struct IMXFECState *phy_consumer;
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth_txdescs = {
 
 static const VMStateDescription vmstate_imx_eth = {
     .name = TYPE_IMX_FEC,
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
         VMSTATE_UINT32(rx_descriptor, IMXFECState),
         VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
-        VMSTATE_UINT32(phy_status, IMXFECState),
-        VMSTATE_UINT32(phy_control, IMXFECState),
-        VMSTATE_UINT32(phy_advertise, IMXFECState),
-        VMSTATE_UINT32(phy_int, IMXFECState),
-        VMSTATE_UINT32(phy_int_mask, IMXFECState),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription * const []) {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
     },
 };
 
-#define PHY_INT_ENERGYON            (1 << 7)
-#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-#define PHY_INT_FAULT               (1 << 5)
-#define PHY_INT_DOWN                (1 << 4)
-#define PHY_INT_AUTONEG_LP          (1 << 3)
-#define PHY_INT_PARFAULT            (1 << 2)
-#define PHY_INT_AUTONEG_PAGE        (1 << 1)
-
 static void imx_eth_update(IMXFECState *s);
 
 /*
@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s);
  * For now we don't handle any GPIO/interrupt line, so the OS will
  * have to poll for the PHY status.
  */
-static void imx_phy_update_irq(IMXFECState *s)
+static void imx_phy_update_irq(void *opaque, int n, int level)
 {
-    imx_eth_update(s);
-}
-
-static void imx_phy_update_link(IMXFECState *s)
-{
-    /* Autonegotiation status mirrors link status.  */
-    if (qemu_get_queue(s->nic)->link_down) {
-        trace_imx_phy_update_link("down");
-        s->phy_status &= ~0x0024;
-        s->phy_int |= PHY_INT_DOWN;
-    } else {
-        trace_imx_phy_update_link("up");
-        s->phy_status |= 0x0024;
-        s->phy_int |= PHY_INT_ENERGYON;
-        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
-    }
-    imx_phy_update_irq(s);
+    imx_eth_update(opaque);
 }
 
 static void imx_eth_set_link(NetClientState *nc)
 {
-    imx_phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
-}
-
-static void imx_phy_reset(IMXFECState *s)
-{
-    trace_imx_phy_reset();
-
-    s->phy_status = 0x7809;
-    s->phy_control = 0x3000;
-    s->phy_advertise = 0x01e1;
-    s->phy_int_mask = 0;
-    s->phy_int = 0;
-    imx_phy_update_link(s);
+    lan9118_phy_update_link(&IMX_FEC(qemu_get_nic_opaque(nc))->mii,
+                            nc->link_down);
 }
 
 static uint32_t imx_phy_read(IMXFECState *s, int reg)
 {
-    uint32_t val;
     uint32_t phy = reg / 32;
 
     if (!s->phy_connected) {
@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
 
     reg %= 32;
 
-    switch (reg) {
-    case 0:     /* Basic Control */
-        val = s->phy_control;
-        break;
-    case 1:     /* Basic Status */
-        val = s->phy_status;
-        break;
-    case 2:     /* ID1 */
-        val = 0x0007;
-        break;
-    case 3:     /* ID2 */
-        val = 0xc0d1;
-        break;
-    case 4:     /* Auto-neg advertisement */
-        val = s->phy_advertise;
-        break;
-    case 5:     /* Auto-neg Link Partner Ability */
-        val = 0x0f71;
-        break;
-    case 6:     /* Auto-neg Expansion */
-        val = 1;
-        break;
-    case 29:    /* Interrupt source.  */
-        val = s->phy_int;
-        s->phy_int = 0;
-        imx_phy_update_irq(s);
-        break;
-    case 30:    /* Interrupt mask */
-        val = s->phy_int_mask;
-        break;
-    case 17:
-    case 18:
-    case 27:
-    case 31:
-        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        val = 0;
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        val = 0;
-        break;
-    }
-
-    trace_imx_phy_read(val, phy, reg);
-
-    return val;
+    return lan9118_phy_read(&s->mii, reg);
 }
 
 static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
 
     reg %= 32;
 
-    trace_imx_phy_write(val, phy, reg);
-
-    switch (reg) {
-    case 0:     /* Basic Control */
-        if (val & 0x8000) {
-            imx_phy_reset(s);
-        } else {
-            s->phy_control = val & 0x7980;
-            /* Complete autonegotiation immediately.  */
-            if (val & 0x1000) {
-                s->phy_status |= 0x0020;
-            }
-        }
-        break;
-    case 4:     /* Auto-neg advertisement */
-        s->phy_advertise = (val & 0x2d7f) | 0x80;
-        break;
-    case 30:    /* Interrupt mask */
-        s->phy_int_mask = val & 0xff;
-        imx_phy_update_irq(s);
-        break;
-    case 17:
-    case 18:
-    case 27:
-    case 31:
-        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        break;
-    }
+    lan9118_phy_write(&s->mii, reg, val);
 }
 
 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
 
     s->rx_descriptor = 0;
     memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
-
-    /* We also reset the PHY */
-    imx_phy_reset(s);
 }
 
 static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(sbd, &s->irq[0]);
     sysbus_init_irq(sbd, &s->irq[1]);
 
+    qemu_init_irq(&s->mii_irq, imx_phy_update_irq, s, 0);
+    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
+    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
+
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
  * Copyright (c) 2009 CodeSourcery, LLC.
  * Written by Paul Brook
  *
+ * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
+ *
  * This code is licensed under the GNU GPL v2
  *
  * Contributions after 2012-01-13 are licensed under the terms of the
@@ -XXX,XX +XXX,XX @@
 #include "hw/resettable.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
+#include "trace.h"
 
 #define PHY_INT_ENERGYON            (1 << 7)
 #define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
 
     switch (reg) {
     case 0: /* Basic Control */
-        return s->control;
+        val = s->control;
+        break;
     case 1: /* Basic Status */
-        return s->status;
+        val = s->status;
+        break;
     case 2: /* ID1 */
-        return 0x0007;
+        val = 0x0007;
+        break;
     case 3: /* ID2 */
-        return 0xc0d1;
+        val = 0xc0d1;
+        break;
     case 4: /* Auto-neg advertisement */
-        return s->advertise;
+        val = s->advertise;
+        break;
     case 5: /* Auto-neg Link Partner Ability */
-        return 0x0f71;
+        val = 0x0f71;
+        break;
     case 6: /* Auto-neg Expansion */
-        return 1;
-        /* TODO 17, 18, 27, 29, 30, 31 */
+        val = 1;
+        break;
     case 29: /* Interrupt source. */
         val = s->ints;
         s->ints = 0;
         lan9118_phy_update_irq(s);
-        return val;
+        break;
     case 30: /* Interrupt mask */
-        return s->int_mask;
+        val = s->int_mask;
+        break;
+    case 17:
+    case 18:
+    case 27:
+    case 31:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        val = 0;
+        break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "lan9118_phy_read: PHY read reg %d\n", reg);
-        return 0;
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        val = 0;
+        break;
     }
+
+    trace_lan9118_phy_read(val, reg);
+
+    return val;
 }
 
 void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
 {
+    trace_lan9118_phy_write(val, reg);
+
     switch (reg) {
     case 0: /* Basic Control */
         if (val & 0x8000) {
             lan9118_phy_reset(s);
-            break;
-        }
-        s->control = val & 0x7980;
-        /* Complete autonegotiation immediately. */
-        if (val & 0x1000) {
-            s->status |= 0x0020;
+        } else {
+            s->control = val & 0x7980;
+            /* Complete autonegotiation immediately. */
+            if (val & 0x1000) {
+                s->status |= 0x0020;
+            }
         }
         break;
     case 4: /* Auto-neg advertisement */
         s->advertise = (val & 0x2d7f) | 0x80;
         break;
-        /* TODO 17, 18, 27, 31 */
     case 30: /* Interrupt mask */
         s->int_mask = val & 0xff;
         lan9118_phy_update_irq(s);
         break;
+    case 17:
+    case 18:
+    case 27:
+    case 31:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        break;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
 
     /* Autonegotiation status mirrors link status. */
     if (link_down) {
+        trace_lan9118_phy_update_link("down");
         s->status &= ~0x0024;
         s->ints |= PHY_INT_DOWN;
     } else {
+        trace_lan9118_phy_update_link("up");
         s->status |= 0x0024;
         s->ints |= PHY_INT_ENERGYON;
         s->ints |= PHY_INT_AUTONEG_COMPLETE;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
 
 void lan9118_phy_reset(Lan9118PhyState *s)
 {
+    trace_lan9118_phy_reset();
+
     s->control = 0x3000;
     s->status = 0x7809;
     s->advertise = 0x01e1;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118_phy = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINT16(control, Lan9118PhyState),
         VMSTATE_UINT16(status, Lan9118PhyState),
+        VMSTATE_UINT16(control, Lan9118PhyState),
         VMSTATE_UINT16(advertise, Lan9118PhyState),
         VMSTATE_UINT16(ints, Lan9118PhyState),
         VMSTATE_UINT16(int_mask, Lan9118PhyState),
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_SUN8I_EMAC
 
 config IMX_FEC
     bool
+    select LAN9118_PHY
 
 config CADENCE
     bool
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
 allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
 allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
 
+# lan9118_phy.c
+lan9118_phy_read(uint16_t val, int reg) "[0x%02x] -> 0x%04" PRIx16
+lan9118_phy_write(uint16_t val, int reg) "[0x%02x] <- 0x%04" PRIx16
+lan9118_phy_update_link(const char *s) "%s"
+lan9118_phy_reset(void) ""
+
 # lance.c
 lance_mem_readw(uint64_t addr, uint32_t ret) "addr=0x%"PRIx64"val=0x%04x"
 lance_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64"val=0x%04x"
@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"
 i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
 
 # imx_fec.c
-imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
 imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
-imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
 imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
-imx_phy_update_link(const char *s) "%s"
-imx_phy_reset(void) ""
 imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
 imx_enet_read_bd(uint64_t addr, int flags, int len, int data, int options, int status) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x option 0x%04x status 0x%04x"
 imx_eth_tx_bd_busy(void) "tx_bd ran out of descriptors to transmit"
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Turns 0x70 into 0xe0 (== 0x70 << 1) which adds the missing MII_ANLPAR_TX and
fixes the MSB of selector field to be zero, as specified in the datasheet.

Fixes: 2a424990170b "LAN9118 emulation"
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-4-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/lan9118_phy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
         val = s->advertise;
         break;
     case 5: /* Auto-neg Link Partner Ability */
-        val = 0x0f71;
+        val = 0x0fe1;
         break;
     case 6: /* Auto-neg Expansion */
         val = 1;
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Prefer named constants over magic values for better readability.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20241102125724.532843-5-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/mii.h |  6 +++++
 hw/net/lan9118_phy.c | 63 ++++++++++++++++++++++++++++----------------
 2 files changed, 46 insertions(+), 23 deletions(-)

diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/mii.h
+++ b/include/hw/net/mii.h
@@ -XXX,XX +XXX,XX @@
 #define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
 #define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
 
+#define MII_ANAR_RFAULT     (1 << 13) /* Say we can detect faults */
 #define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymmetric pause */
 #define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
 #define MII_ANAR_TXFD       (1 << 8)
@@ -XXX,XX +XXX,XX @@
 #define MII_ANAR_10FD       (1 << 6)
 #define MII_ANAR_10         (1 << 5)
 #define MII_ANAR_CSMACD     (1 << 0)
+#define MII_ANAR_SELECT     (0x001f)  /* Selector bits */
 
 #define MII_ANLPAR_ACK      (1 << 14)
 #define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
@@ -XXX,XX +XXX,XX @@
 #define RTL8201CP_PHYID1    0x0000
 #define RTL8201CP_PHYID2    0x8201
 
+/* SMSC LAN9118 */
+#define SMSCLAN9118_PHYID1  0x0007
+#define SMSCLAN9118_PHYID2  0xc0d1
+
 /* RealTek 8211E */
 #define RTL8211E_PHYID1     0x001c
 #define RTL8211E_PHYID2     0xc915
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/net/lan9118_phy.h"
+#include "hw/net/mii.h"
 #include "hw/irq.h"
 #include "hw/resettable.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
     uint16_t val;
 
     switch (reg) {
-    case 0: /* Basic Control */
+    case MII_BMCR:
         val = s->control;
         break;
-    case 1: /* Basic Status */
+    case MII_BMSR:
         val = s->status;
         break;
-    case 2: /* ID1 */
-        val = 0x0007;
+    case MII_PHYID1:
+        val = SMSCLAN9118_PHYID1;
         break;
-    case 3: /* ID2 */
-        val = 0xc0d1;
+    case MII_PHYID2:
+        val = SMSCLAN9118_PHYID2;
         break;
-    case 4: /* Auto-neg advertisement */
+    case MII_ANAR:
         val = s->advertise;
         break;
-    case 5: /* Auto-neg Link Partner Ability */
-        val = 0x0fe1;
+    case MII_ANLPAR:
+        val = MII_ANLPAR_PAUSEASY | MII_ANLPAR_PAUSE | MII_ANLPAR_T4 |
+              MII_ANLPAR_TXFD | MII_ANLPAR_TX | MII_ANLPAR_10FD |
+              MII_ANLPAR_10 | MII_ANLPAR_CSMACD;
         break;
-    case 6: /* Auto-neg Expansion */
-        val = 1;
+    case MII_ANER:
+        val = MII_ANER_NWAY;
         break;
     case 29: /* Interrupt source. */
         val = s->ints;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
     trace_lan9118_phy_write(val, reg);
 
     switch (reg) {
-    case 0: /* Basic Control */
-        if (val & 0x8000) {
+    case MII_BMCR:
+        if (val & MII_BMCR_RESET) {
             lan9118_phy_reset(s);
         } else {
-            s->control = val & 0x7980;
+            s->control = val & (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |
+                                MII_BMCR_AUTOEN | MII_BMCR_PDOWN | MII_BMCR_FD |
+                                MII_BMCR_CTST);
             /* Complete autonegotiation immediately. */
-            if (val & 0x1000) {
-                s->status |= 0x0020;
+            if (val & MII_BMCR_AUTOEN) {
+                s->status |= MII_BMSR_AN_COMP;
             }
         }
         break;
-    case 4: /* Auto-neg advertisement */
-        s->advertise = (val & 0x2d7f) | 0x80;
+    case MII_ANAR:
+        s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
+                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
+                               MII_ANAR_SELECT))
+                     | MII_ANAR_TX;
         break;
     case 30: /* Interrupt mask */
         s->int_mask = val & 0xff;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
     /* Autonegotiation status mirrors link status. */
     if (link_down) {
         trace_lan9118_phy_update_link("down");
-        s->status &= ~0x0024;
+        s->status &= ~(MII_BMSR_AN_COMP | MII_BMSR_LINK_ST);
         s->ints |= PHY_INT_DOWN;
     } else {
         trace_lan9118_phy_update_link("up");
-        s->status |= 0x0024;
+        s->status |= MII_BMSR_AN_COMP | MII_BMSR_LINK_ST;
         s->ints |= PHY_INT_ENERGYON;
         s->ints |= PHY_INT_AUTONEG_COMPLETE;
     }
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_reset(Lan9118PhyState *s)
 {
     trace_lan9118_phy_reset();
 
-    s->control = 0x3000;
-    s->status = 0x7809;
-    s->advertise = 0x01e1;
+    s->control = MII_BMCR_AUTOEN | MII_BMCR_SPEED100;
+    s->status = MII_BMSR_100TX_FD
+                | MII_BMSR_100TX_HD
+                | MII_BMSR_10T_FD
+                | MII_BMSR_10T_HD
+                | MII_BMSR_AUTONEG
+                | MII_BMSR_EXTCAP;
+    s->advertise = MII_ANAR_TXFD
+                   | MII_ANAR_TX
+                   | MII_ANAR_10FD
+                   | MII_ANAR_10
+                   | MII_ANAR_CSMACD;
     s->int_mask = 0;
     s->ints = 0;
     lan9118_phy_update_link(s, s->link_down);
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

The real device advertises this mode and the device model already advertises
100 mbps half duplex and 10 mbps full+half duplex. So advertise this mode to
make the model more realistic.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20241102125724.532843-6-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/lan9118_phy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
         break;
     case MII_ANAR:
         s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
-                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
-                               MII_ANAR_SELECT))
+                               MII_ANAR_PAUSE | MII_ANAR_TXFD | MII_ANAR_10FD |
+                               MII_ANAR_10 | MII_ANAR_SELECT))
                      | MII_ANAR_TX;
         break;
     case 30: /* Interrupt mask */
-- 
2.34.1

For IEEE fused multiply-add, the (0 * inf) + NaN case should raise
Invalid for the multiplication of 0 by infinity.  Currently we handle
this in the per-architecture ifdef ladder in pickNaNMulAdd().
However, since this isn't really architecture specific we can hoist
it up to the generic code.

For the cases where the infzero test in pickNaNMulAdd was
returning 2, we can delete the check entirely and allow the
code to fall into the normal pick-a-NaN handling, because this
will return 2 anyway (input 'c' being the only NaN in this case).
For the cases where infzero was returning 3 to indicate "return
the default NaN", we must retain that "return 3".

For Arm, this looks like it might be a behaviour change because we
used to set float_flag_invalid | float_flag_invalid_imz only if C is
a quiet NaN.  However, it is not, because Arm target code never looks
at float_flag_invalid_imz, and for the (0 * inf) + SNaN case we
already raised float_flag_invalid via the "abc_mask &
float_cmask_snan" check in pick_nan_muladd.

For any target architecture using the "default implementation" at the
bottom of the ifdef, this is a behaviour change but will be fixing a
bug (where we failed to raise the Invalid exception for (0 * inf +
QNaN).  The architectures using the default case are:
 * hppa
 * i386
 * sh4
 * tricore

The x86, Tricore and SH4 CPU architecture manuals are clear that this
should have raised Invalid; HPPA is a bit vaguer but still seems
clear enough.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-2-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 13 +++++++------
 fpu/softfloat-specialize.c.inc | 29 +----------------------------
 2 files changed, 8 insertions(+), 34 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
                                             int ab_mask, int abc_mask)
 {
     int which;
+    bool infzero = (ab_mask == float_cmask_infzero);
 
     if (unlikely(abc_mask & float_cmask_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
-    which = pickNaNMulAdd(a->cls, b->cls, c->cls,
-                          ab_mask == float_cmask_infzero, s);
+    if (infzero) {
+        /* This is (0 * inf) + NaN or (inf * 0) + NaN */
+        float_raise(float_flag_invalid | float_flag_invalid_imz, s);
+    }
+
+    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
 
     if (s->default_nan_mode || which == 3) {
-        /*
-         * Note that this check is after pickNaNMulAdd so that function
-         * has an opportunity to set the Invalid flag for infzero.
-         */
         parts_default_nan(a, s);
         return a;
     }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * the default NaN
      */
     if (infzero && is_qnan(c_cls)) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
         return 3;
     }
 
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * case sets InvalidOp and returns the default NaN
          */
         if (infzero) {
-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
             return 3;
         }
         /* Prefer sNaN over qNaN, in the a, b, c order. */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
          */
-        if (infzero) {
-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-            return 2;
-        }
         /* Prefer sNaN over qNaN, in the c, a, b order. */
         if (is_snan(c_cls)) {
             return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
      * case sets InvalidOp and returns the input value 'c'
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
+
     /* Prefer sNaN over qNaN, in the c, a, b order. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * to return an input NaN if we have one (ie c) rather than generating
      * a default NaN
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
 
     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_RISCV)
-    /* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-    }
     return 3; /* default NaN */
 #elif defined(TARGET_S390X)
     if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
         return 3;
     }
 
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 2;
     }
 #elif defined(TARGET_SPARC)
-    /* For (inf,0,nan) return c. */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
     /* Prefer SNaN over QNaN, order C, B, A. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
      * an input NaN if we have one (ie c).
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
     if (status->use_first_nan) {
         if (is_nan(a_cls)) {
             return 0;
-- 
2.34.1

If the target sets default_nan_mode then we're always going to return
the default NaN, and pickNaNMulAdd() no longer has any side effects.
For consistency with pickNaN(), check for default_nan_mode before
calling pickNaNMulAdd().

When we convert pickNaNMulAdd() to allow runtime selection of the NaN
propagation rule, this means we won't have to make the targets which
use default_nan_mode also set a propagation rule.

Since RiscV always uses default_nan_mode, this allows us to remove
its ifdef case from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-3-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 8 ++++++--
 fpu/softfloat-specialize.c.inc | 9 +++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         float_raise(float_flag_invalid | float_flag_invalid_imz, s);
     }
 
-    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+    if (s->default_nan_mode) {
+        which = 3;
+    } else {
+        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+    }
 
-    if (s->default_nan_mode || which == 3) {
+    if (which == 3) {
         parts_default_nan(a, s);
         return a;
     }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
+    /*
+     * We guarantee not to require the target to tell us how to
+     * pick a NaN if we're always returning the default NaN.
+     * But if we're not in default-NaN mode then the target must
+     * specify.
+     */
+    assert(!status->default_nan_mode);
 #if defined(TARGET_ARM)
     /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
      * the default NaN
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     } else {
         return 1;
     }
-#elif defined(TARGET_RISCV)
-    return 3; /* default NaN */
 #elif defined(TARGET_S390X)
     if (infzero) {
         return 3;
-- 
2.34.1

IEEE 758 does not define a fixed rule for what NaN to return in
the case of a fused multiply-add of inf * 0 + NaN. Different
architectures thus do different things:
 * some return the default NaN
 * some return the input NaN
 * Arm returns the default NaN if the input NaN is quiet,
   and the input NaN if it is signalling

We want to make this logic be runtime selected rather than
hardcoded into the binary, because:
 * this will let us have multiple targets in one QEMU binary
 * the Arm FEAT_AFP architectural feature includes letting
   the guest select a NaN propagation rule at runtime

In this commit we add an enum for the propagation rule, the field in
float_status, and the corresponding getters and setters.  We change
pickNaNMulAdd to honour this, but because all targets still leave
this field at its default 0 value, the fallback logic will pick the
rule type with the old ifdef ladder.

Note that four architectures both use the muladd softfloat functions
and did not have a branch of the ifdef ladder to specify their
behaviour (and so were ending up with the "default" case, probably
wrongly): i386, HPPA, SH4 and Tricore.  SH4 and Tricore both set
default_nan_mode, and so will never get into pickNaNMulAdd().  For
HPPA and i386 we retain the same behaviour as the old default-case,
which is to not ever return the default NaN.  This might not be
correct but it is not a behaviour change.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-4-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 11 ++++
 include/fpu/softfloat-types.h   | 23 +++++++++
 fpu/softfloat-specialize.c.inc  | 91 ++++++++++++++++++++++-----------
 3 files changed, 95 insertions(+), 30 deletions(-)

diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-helpers.h
+++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
     status->float_2nan_prop_rule = rule;
 }
 
+static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
+                                             float_status *status)
+{
+    status->float_infzeronan_rule = rule;
+}
+
 static inline void set_flush_to_zero(bool val, float_status *status)
 {
     status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
     return status->float_2nan_prop_rule;
 }
 
+static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
+{
+    return status->float_infzeronan_rule;
+}
+
 static inline bool get_flush_to_zero(float_status *status)
 {
     return status->flush_to_zero;
diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_2nan_prop_x87,
 } Float2NaNPropRule;
 
+/*
+ * Rule for result of fused multiply-add 0 * Inf + NaN.
+ * This must be a NaN, but implementations differ on whether this
+ * is the input NaN or the default NaN.
+ *
+ * You don't need to set this if default_nan_mode is enabled.
+ * When not in default-NaN mode, it is an error for the target
+ * not to set the rule in float_status if it uses muladd, and we
+ * will assert if we need to handle an input NaN and no rule was
+ * selected.
+ */
+typedef enum __attribute__((__packed__)) {
+    /* No propagation rule specified */
+    float_infzeronan_none = 0,
+    /* Result is never the default NaN (so always the input NaN) */
+    float_infzeronan_dnan_never,
+    /* Result is always the default NaN */
+    float_infzeronan_dnan_always,
+    /* Result is the default NaN if the input NaN is quiet */
+    float_infzeronan_dnan_if_qnan,
+} FloatInfZeroNaNRule;
+
 /*
  * Floating Point Status. Individual architectures may maintain
  * several versions of float_status for different functions. The
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     FloatRoundMode float_rounding_mode;
     FloatX80RoundPrec floatx80_rounding_precision;
     Float2NaNPropRule float_2nan_prop_rule;
+    FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
     bool flush_to_zero;
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
+    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
+
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * specify.
      */
     assert(!status->default_nan_mode);
+
+    if (rule == float_infzeronan_none) {
+        /*
+         * Temporarily fall back to ifdef ladder
+         */
 #if defined(TARGET_ARM)
-    /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
-     * the default NaN
-     */
-    if (infzero && is_qnan(c_cls)) {
-        return 3;
+        /*
+         * For ARM, the (inf,zero,qnan) case returns the default NaN,
+         * but (inf,zero,snan) returns the input NaN.
+         */
+        rule = float_infzeronan_dnan_if_qnan;
+#elif defined(TARGET_MIPS)
+        if (snan_bit_is_one(status)) {
+            /*
+             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+             * case sets InvalidOp and returns the default NaN
+             */
+            rule = float_infzeronan_dnan_always;
+        } else {
+            /*
+             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+             * case sets InvalidOp and returns the input value 'c'
+             */
+            rule = float_infzeronan_dnan_never;
+        }
+#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
+    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+        /*
+         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+         * case sets InvalidOp and returns the input value 'c'
+         */
+        /*
+         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+         * to return an input NaN if we have one (ie c) rather than generating
+         * a default NaN
+         */
+        rule = float_infzeronan_dnan_never;
+#elif defined(TARGET_S390X)
+        rule = float_infzeronan_dnan_always;
+#endif
     }
 
+    if (infzero) {
+        /*
+         * Inf * 0 + NaN -- some implementations return the default NaN here,
+         * and some return the input NaN.
+         */
+        switch (rule) {
+        case float_infzeronan_dnan_never:
+            return 2;
+        case float_infzeronan_dnan_always:
+            return 3;
+        case float_infzeronan_dnan_if_qnan:
+            return is_qnan(c_cls) ? 3 : 2;
+        default:
+            g_assert_not_reached();
+        }
+    }
+
+#if defined(TARGET_ARM)
+
     /* This looks different from the ARM ARM pseudocode, because the ARM ARM
      * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
      */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 #elif defined(TARGET_MIPS)
     if (snan_bit_is_one(status)) {
-        /*
-         * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-         * case sets InvalidOp and returns the default NaN
-         */
-        if (infzero) {
-            return 3;
-        }
         /* Prefer sNaN over qNaN, in the a, b, c order. */
         if (is_snan(a_cls)) {
             return 0;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
             return 2;
         }
     } else {
-        /*
-         * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
-         * case sets InvalidOp and returns the input value 'c'
-         */
         /* Prefer sNaN over qNaN, in the c, a, b order. */
         if (is_snan(c_cls)) {
             return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 #elif defined(TARGET_LOONGARCH64)
-    /*
-     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-     * case sets InvalidOp and returns the input value 'c'
-     */
-
     /* Prefer sNaN over qNaN, in the c, a, b order. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_PPC)
-    /* For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
-     * to return an input NaN if we have one (ie c) rather than generating
-     * a default NaN
-     */
-
     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
      */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_S390X)
-    if (infzero) {
-        return 3;
-    }
-
     if (is_snan(a_cls)) {
         return 0;
     } else if (is_snan(b_cls)) {
-- 
2.34.1

Explicitly set a rule in the softfloat tests for the inf-zero-nan
muladd special case.  In meson.build we put -DTARGET_ARM in fpcflags,
and so we should select here the Arm rule of
float_infzeronan_dnan_if_qnan.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241202131347.498124-5-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c | 5 +++++
 tests/fp/fp-test.c  | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
 {
     bench_func_t f;
 
+    /*
+     * These implementation-defined choices for various things IEEE
+     * doesn't specify match those used by the Arm architecture.
+     */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
 
     f = bench_funcs[operation][precision];
     g_assert(f);
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
 {
     unsigned int i;
 
+    /*
+     * These implementation-defined choices for various things IEEE
+     * doesn't specify match those used by the Arm architecture.
+     */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
     verCases_maxErrorCount = n_max_errors;
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the Arm target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-6-peter.maydell@linaro.org
---
 target/arm/cpu.c               | 3 +++
 fpu/softfloat-specialize.c.inc | 8 +-------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *  * tininess-before-rounding
  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
  *    operand A over operand B (see FPProcessNaNs() pseudocode)
+ *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+ *    and the input NaN if it is signalling
  */
 static void arm_set_default_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_before_rounding, s);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 }
 
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_ARM)
-        /*
-         * For ARM, the (inf,zero,qnan) case returns the default NaN,
-         * but (inf,zero,snan) returns the input NaN.
-         */
-        rule = float_infzeronan_dnan_if_qnan;
-#elif defined(TARGET_MIPS)
+#if defined(TARGET_MIPS)
         if (snan_bit_is_one(status)) {
             /*
              * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for s390, so we
can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-7-peter.maydell@linaro.org
---
 target/s390x/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
         set_float_detect_tininess(float_tininess_before_rounding,
                                   &env->fpu_status);
         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
+        set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                  &env->fpu_status);
        /* fall through */
     case RESET_TYPE_S390_CPU_NORMAL:
         env->psw.mask &= ~PSW_MASK_RI;
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * a default NaN
          */
         rule = float_infzeronan_dnan_never;
-#elif defined(TARGET_S390X)
-        rule = float_infzeronan_dnan_always;
 #endif
     }
 
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the PPC target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-8-peter.maydell@linaro.org
---
 target/ppc/cpu_init.c          | 7 +++++++
 fpu/softfloat-specialize.c.inc | 7 +------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
+    /*
+     * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+     * to return an input NaN if we have one (ie c) rather than generating
+     * a default NaN
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
 
     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
         ppc_spr_t *spr = &env->spr_cb[i];
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
              */
             rule = float_infzeronan_dnan_never;
         }
-#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
+#elif defined(TARGET_SPARC) || \
     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
          */
-        /*
-         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
-         * to return an input NaN if we have one (ie c) rather than generating
-         * a default NaN
-         */
         rule = float_infzeronan_dnan_never;
 #endif
     }
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the MIPS target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-9-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h       |  9 +++++++++
 target/mips/msa.c              |  4 ++++
 fpu/softfloat-specialize.c.inc | 16 +---------------
 3 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_flush_mode(CPUMIPSState *env)
 static inline void restore_snan_bit_mode(CPUMIPSState *env)
 {
     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
+    FloatInfZeroNaNRule izn_rule;
 
     /*
      * With nan2008, SNaNs are silenced in the usual way.
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
      */
     set_snan_bit_is_one(!nan2008, &env->active_fpu.fp_status);
     set_default_nan_mode(!nan2008, &env->active_fpu.fp_status);
+    /*
+     * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+     * case sets InvalidOp and returns the default NaN.
+     * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+     * case sets InvalidOp and returns the input value 'c'.
+     */
+    izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
+    set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
 }
 
 static inline void restore_fp_status(CPUMIPSState *env)
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
 
     /* set proper signanling bit meaning ("1" means "quiet") */
     set_snan_bit_is_one(0, &env->active_tc.msa_fp_status);
+
+    /* Inf * 0 + NaN returns the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never,
+                              &env->active_tc.msa_fp_status);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_MIPS)
-        if (snan_bit_is_one(status)) {
-            /*
-             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-             * case sets InvalidOp and returns the default NaN
-             */
-            rule = float_infzeronan_dnan_always;
-        } else {
-            /*
-             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
-             * case sets InvalidOp and returns the input value 'c'
-             */
-            rule = float_infzeronan_dnan_never;
-        }
-#elif defined(TARGET_SPARC) || \
+#if defined(TARGET_SPARC) || \
     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the SPARC target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-10-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
      * the CPU state struct so it won't get zeroed on reset.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 
     cpu_exec_realizefn(cs, &local_err);
     if (local_err != NULL) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_SPARC) || \
-    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the xtensa target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-11-peter.maydell@linaro.org
---
 target/xtensa/cpu.c            | 2 ++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
     reset_mmu(env);
     cs->halted = env->runstall;
 #endif
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
     set_no_signaling_nans(!dfpu, &env->fp_status);
     xtensa_use_first_nan(env, !dfpu);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+#if defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the x86 target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-12-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c   | 7 +++++++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
      */
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->mmx_status);
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->sse_status);
+    /*
+     * Only SSE has multiply-add instructions. In the SDM Section 14.5.2
+     * "Fused-Multiply-ADD (FMA) Numeric Behavior" the NaN handling is
+     * specified -- for 0 * inf + NaN the input NaN is selected, and if
+     * there are multiple input NaNs they are selected in the order a, b, c.
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * Temporarily fall back to ifdef ladder
          */
 #if defined(TARGET_HPPA) || \
-    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+    defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the loongarch target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-13-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 5 +++++
 fpu/softfloat-specialize.c.inc    | 7 +------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
                             &env->fp_status);
     set_flush_to_zero(0, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /*
+     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+     * case sets InvalidOp and returns the input value 'c'
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
 
 int ieee_ex_to_loongarch(int xcpt)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_HPPA) || \
-    defined(TARGET_LOONGARCH)
-        /*
-         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-         * case sets InvalidOp and returns the input value 'c'
-         */
+#if defined(TARGET_HPPA)
         rule = float_infzeronan_dnan_never;
 #endif
     }
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the HPPA target,
so we can remove the ifdef from pickNaNMulAdd().

As this is the last target to be converted to explicitly setting
the rule, we can remove the fallback code in pickNaNMulAdd()
entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-14-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       |  2 ++
 fpu/softfloat-specialize.c.inc | 13 +------------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
      * HPPA does note implement a CPU reset method at all...
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
 
 void cpu_hppa_loaded_fr0(CPUHPPAState *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
-    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
-
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      */
     assert(!status->default_nan_mode);
 
-    if (rule == float_infzeronan_none) {
-        /*
-         * Temporarily fall back to ifdef ladder
-         */
-#if defined(TARGET_HPPA)
-        rule = float_infzeronan_dnan_never;
-#endif
-    }
-
     if (infzero) {
         /*
          * Inf * 0 + NaN -- some implementations return the default NaN here,
          * and some return the input NaN.
          */
-        switch (rule) {
+        switch (status->float_infzeronan_rule) {
         case float_infzeronan_dnan_never:
             return 2;
         case float_infzeronan_dnan_always:
-- 
2.34.1

The new implementation of pickNaNMulAdd() will find it convenient
to know whether at least one of the three arguments to the muladd
was a signaling NaN. We already calculate that in the caller,
so pass it in as a new bool have_snan.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-15-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 5 +++--
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
 {
     int which;
     bool infzero = (ab_mask == float_cmask_infzero);
+    bool have_snan = (abc_mask & float_cmask_snan);
 
-    if (unlikely(abc_mask & float_cmask_snan)) {
+    if (unlikely(have_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
     if (s->default_nan_mode) {
         which = 3;
     } else {
-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
     }
 
     if (which == 3) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 | Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
 *----------------------------------------------------------------------------*/
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-                         bool infzero, float_status *status)
+                         bool infzero, bool have_snan, float_status *status)
 {
     /*
      * We guarantee not to require the target to tell us how to
-- 
2.34.1

IEEE 758 does not define a fixed rule for which NaN to pick as the
result if both operands of a 3-operand fused multiply-add operation
are NaNs.  As a result different architectures have ended up with
different rules for propagating NaNs.

QEMU currently hardcodes the NaN propagation logic into the binary
because pickNaNMulAdd() has an ifdef ladder for different targets.
We want to make the propagation rule instead be selectable at
runtime, because:
 * this will let us have multiple targets in one QEMU binary
 * the Arm FEAT_AFP architectural feature includes letting
   the guest select a NaN propagation rule at runtime

It's valid not to set a propagation rule if default_nan_mode is
enabled, because in that case there's no need to pick a NaN; all the
callers of pickNaNMulAdd() catch this case and skip calling it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-16-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h |  11 +++
 include/fpu/softfloat-types.h   |  55 +++++++++++
 fpu/softfloat-specialize.c.inc  | 167 ++++++++------------------------
 3 files changed, 107 insertions(+), 126 deletions(-)

diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-helpers.h
+++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
     status->float_2nan_prop_rule = rule;
 }
 
+static inline void set_float_3nan_prop_rule(Float3NaNPropRule rule,
+                                            float_status *status)
+{
+    status->float_3nan_prop_rule = rule;
+}
+
 static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
                                              float_status *status)
 {
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
     return status->float_2nan_prop_rule;
 }
 
+static inline Float3NaNPropRule get_float_3nan_prop_rule(float_status *status)
+{
+    return status->float_3nan_prop_rule;
+}
+
 static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
 {
     return status->float_infzeronan_rule;
diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ this code that are retained.
 #ifndef SOFTFLOAT_TYPES_H
 #define SOFTFLOAT_TYPES_H
 
+#include "hw/registerfields.h"
+
 /*
  * Software IEC/IEEE floating-point types.
  */
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_2nan_prop_x87,
 } Float2NaNPropRule;
 
+/*
+ * 3-input NaN propagation rule, for fused multiply-add. Individual
+ * architectures have different rules for which input NaN is
+ * propagated to the output when there is more than one NaN on the
+ * input.
+ *
+ * If default_nan_mode is enabled then it is valid not to set a NaN
+ * propagation rule, because the softfloat code guarantees not to try
+ * to pick a NaN to propagate in default NaN mode.  When not in
+ * default-NaN mode, it is an error for the target not to set the rule
+ * in float_status if it uses a muladd, and we will assert if we need
+ * to handle an input NaN and no rule was selected.
+ *
+ * The naming scheme for Float3NaNPropRule values is:
+ *  float_3nan_prop_s_abc:
+ *    = "Prefer SNaN over QNaN, then operand A over B over C"
+ *  float_3nan_prop_abc:
+ *    = "Prefer A over B over C regardless of SNaN vs QNAN"
+ *
+ * For QEMU, the multiply-add operation is A * B + C.
+ */
+
+/*
+ * We set the Float3NaNPropRule enum values up so we can select the
+ * right value in pickNaNMulAdd in a data driven way.
+ */
+FIELD(3NAN, 1ST, 0, 2)   /* which operand is most preferred ? */
+FIELD(3NAN, 2ND, 2, 2)   /* which operand is next most preferred ? */
+FIELD(3NAN, 3RD, 4, 2)   /* which operand is least preferred ? */
+FIELD(3NAN, SNAN, 6, 1)  /* do we prefer SNaN over QNaN ? */
+
+#define PROPRULE(X, Y, Z) \
+    ((X << R_3NAN_1ST_SHIFT) | (Y << R_3NAN_2ND_SHIFT) | (Z << R_3NAN_3RD_SHIFT))
+
+typedef enum __attribute__((__packed__)) {
+    float_3nan_prop_none = 0,     /* No propagation rule specified */
+    float_3nan_prop_abc = PROPRULE(0, 1, 2),
+    float_3nan_prop_acb = PROPRULE(0, 2, 1),
+    float_3nan_prop_bac = PROPRULE(1, 0, 2),
+    float_3nan_prop_bca = PROPRULE(1, 2, 0),
+    float_3nan_prop_cab = PROPRULE(2, 0, 1),
+    float_3nan_prop_cba = PROPRULE(2, 1, 0),
+    float_3nan_prop_s_abc = float_3nan_prop_abc | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_acb = float_3nan_prop_acb | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_bac = float_3nan_prop_bac | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_bca = float_3nan_prop_bca | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_cab = float_3nan_prop_cab | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_cba = float_3nan_prop_cba | R_3NAN_SNAN_MASK,
+} Float3NaNPropRule;
+
+#undef PROPRULE
+
 /*
  * Rule for result of fused multiply-add 0 * Inf + NaN.
  * This must be a NaN, but implementations differ on whether this
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     FloatRoundMode float_rounding_mode;
     FloatX80RoundPrec floatx80_rounding_precision;
     Float2NaNPropRule float_2nan_prop_rule;
+    Float3NaNPropRule float_3nan_prop_rule;
     FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, bool have_snan, float_status *status)
 {
+    FloatClass cls[3] = { a_cls, b_cls, c_cls };
+    Float3NaNPropRule rule = status->float_3nan_prop_rule;
+    int which;
+
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 
+    if (rule == float_3nan_prop_none) {
 #if defined(TARGET_ARM)
-
-    /* This looks different from the ARM ARM pseudocode, because the ARM ARM
-     * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
-     */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else {
-        return 1;
-    }
+        /*
+         * This looks different from the ARM ARM pseudocode, because the ARM ARM
+         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
+         */
+        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_MIPS)
-    if (snan_bit_is_one(status)) {
-        /* Prefer sNaN over qNaN, in the a, b, c order. */
-        if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_snan(c_cls)) {
-            return 2;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else if (is_qnan(b_cls)) {
-            return 1;
+        if (snan_bit_is_one(status)) {
+            rule = float_3nan_prop_s_abc;
         } else {
-            return 2;
+            rule = float_3nan_prop_s_cab;
         }
-    } else {
-        /* Prefer sNaN over qNaN, in the c, a, b order. */
-        if (is_snan(c_cls)) {
-            return 2;
-        } else if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_qnan(c_cls)) {
-            return 2;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-    }
 #elif defined(TARGET_LOONGARCH64)
-    /* Prefer sNaN over qNaN, in the c, a, b order. */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else {
-        return 1;
-    }
+        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_PPC)
-    /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
-     */
-    if (is_nan(a_cls)) {
-        return 0;
-    } else if (is_nan(c_cls)) {
-        return 2;
-    } else {
-        return 1;
-    }
+        /*
+         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+         */
+        rule = float_3nan_prop_acb;
 #elif defined(TARGET_S390X)
-    if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else if (is_qnan(b_cls)) {
-        return 1;
-    } else {
-        return 2;
-    }
+        rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
-    /* Prefer SNaN over QNaN, order C, B, A. */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(b_cls)) {
-        return 1;
-    } else {
-        return 0;
-    }
+        rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
-    /*
-     * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
-     * an input NaN if we have one (ie c).
-     */
-    if (status->use_first_nan) {
-        if (is_nan(a_cls)) {
-            return 0;
-        } else if (is_nan(b_cls)) {
-            return 1;
+        if (status->use_first_nan) {
+            rule = float_3nan_prop_abc;
         } else {
-            return 2;
+            rule = float_3nan_prop_cba;
         }
-    } else {
-        if (is_nan(c_cls)) {
-            return 2;
-        } else if (is_nan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-    }
 #else
-    /* A default implementation: prefer a to b to c.
-     * This is unlikely to actually match any real implementation.
-     */
-    if (is_nan(a_cls)) {
-        return 0;
-    } else if (is_nan(b_cls)) {
-        return 1;
-    } else {
-        return 2;
-    }
+        rule = float_3nan_prop_abc;
 #endif
+    }
+
+    assert(rule != float_3nan_prop_none);
+    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+        /* We have at least one SNaN input and should prefer it */
+        do {
+            which = rule & R_3NAN_1ST_MASK;
+            rule >>= R_3NAN_1ST_LENGTH;
+        } while (!is_snan(cls[which]));
+    } else {
+        do {
+            which = rule & R_3NAN_1ST_MASK;
+            rule >>= R_3NAN_1ST_LENGTH;
+        } while (!is_nan(cls[which]));
+    }
+    return which;
 }
 
 /*----------------------------------------------------------------------------
-- 
2.34.1

Explicitly set a rule in the softfloat tests for propagating NaNs in
the muladd case.  In meson.build we put -DTARGET_ARM in fpcflags, and
so we should select here the Arm rule of float_3nan_prop_s_cab.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-17-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c | 1 +
 tests/fp/fp-test.c  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
      * doesn't specify match those used by the Arm architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
 
     f = bench_funcs[operation][precision];
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
      * doesn't specify match those used by the Arm architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
-- 
2.34.1

Set the Float3NaNPropRule explicitly for Arm, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-18-peter.maydell@linaro.org
---
 target/arm/cpu.c               | 5 +++++
 fpu/softfloat-specialize.c.inc | 8 +-------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *  * tininess-before-rounding
  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
  *    operand A over operand B (see FPProcessNaNs() pseudocode)
+ *  * 3-input NaN propagation prefers SNaN over QNaN, and then
+ *    operand C over A over B (see FPProcessNaNs3() pseudocode,
+ *    but note that for QEMU muladd is a * b + c, whereas for
+ *    the pseudocode function the arguments are in the order c, a, b.
  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
  *    and the input NaN if it is signalling
  */
@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_before_rounding, s);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 }
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_ARM)
-        /*
-         * This looks different from the ARM ARM pseudocode, because the ARM ARM
-         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
-         */
-        rule = float_3nan_prop_s_cab;
-#elif defined(TARGET_MIPS)
+#if defined(TARGET_MIPS)
         if (snan_bit_is_one(status)) {
             rule = float_3nan_prop_s_abc;
         } else {
-- 
2.34.1

Set the Float3NaNPropRule explicitly for loongarch, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-19-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 1 +
 fpu/softfloat-specialize.c.inc    | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
      * case sets InvalidOp and returns the input value 'c'
      */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
 }
 
 int ieee_ex_to_loongarch(int xcpt)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_LOONGARCH64)
-        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_PPC)
         /*
          * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-- 
2.34.1

Set the Float3NaNPropRule explicitly for PPC, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-20-peter.maydell@linaro.org
---
 target/ppc/cpu_init.c          | 8 ++++++++
 fpu/softfloat-specialize.c.inc | 6 ------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
+    /*
+     * NaN propagation for fused multiply-add:
+     * if fRA is a NaN return it; otherwise if fRB is a NaN return it;
+     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+     * whereas QEMU labels the operands as (a * b) + c.
+     */
+    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->fp_status);
+    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->vec_status);
     /*
      * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
      * to return an input NaN if we have one (ie c) rather than generating
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_PPC)
-        /*
-         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
-         */
-        rule = float_3nan_prop_acb;
 #elif defined(TARGET_S390X)
         rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
-- 
2.34.1

Set the Float3NaNPropRule explicitly for s390x, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-21-peter.maydell@linaro.org
---
 target/s390x/cpu.c             | 1 +
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
         set_float_detect_tininess(float_tininess_before_rounding,
                                   &env->fpu_status);
         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
+        set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
         set_float_infzeronan_rule(float_infzeronan_dnan_always,
                                   &env->fpu_status);
        /* fall through */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_S390X)
-        rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
         rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
-- 
2.34.1

Set the Float3NaNPropRule explicitly for SPARC, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-22-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
      * the CPU state struct so it won't get zeroed on reset.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
+    /* For fused-multiply add, prefer SNaN over QNaN, then C->B->A */
+    set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_SPARC)
-        rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
         if (status->use_first_nan) {
             rule = float_3nan_prop_abc;
-- 
2.34.1

Set the Float3NaNPropRule explicitly for Arm, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-23-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h       | 4 ++++
 target/mips/msa.c              | 3 +++
 fpu/softfloat-specialize.c.inc | 8 +-------
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
 {
     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
     FloatInfZeroNaNRule izn_rule;
+    Float3NaNPropRule nan3_rule;
 
     /*
      * With nan2008, SNaNs are silenced in the usual way.
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
      */
     izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
+    nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
+    set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
+
 }
 
 static inline void restore_fp_status(CPUMIPSState *env)
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab,
                              &env->active_tc.msa_fp_status);
 
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab,
+                             &env->active_tc.msa_fp_status);
+
     /* clear float_status exception flags */
     set_float_exception_flags(0, &env->active_tc.msa_fp_status);
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_MIPS)
-        if (snan_bit_is_one(status)) {
-            rule = float_3nan_prop_s_abc;
-        } else {
-            rule = float_3nan_prop_s_cab;
-        }
-#elif defined(TARGET_XTENSA)
+#if defined(TARGET_XTENSA)
         if (status->use_first_nan) {
             rule = float_3nan_prop_abc;
         } else {
-- 
2.34.1

Set the Float3NaNPropRule explicitly for xtensa, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-24-peter.maydell@linaro.org
---
 target/xtensa/fpu_helper.c     | 2 ++
 fpu/softfloat-specialize.c.inc | 8 --------
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/fpu_helper.c
+++ b/target/xtensa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
     set_use_first_nan(use_first, &env->fp_status);
     set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
                              &env->fp_status);
+    set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
+                             &env->fp_status);
 }
 
 void HELPER(wur_fpu2k_fcr)(CPUXtensaState *env, uint32_t v)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_XTENSA)
-        if (status->use_first_nan) {
-            rule = float_3nan_prop_abc;
-        } else {
-            rule = float_3nan_prop_cba;
-        }
-#else
         rule = float_3nan_prop_abc;
-#endif
     }
 
     assert(rule != float_3nan_prop_none);
-- 
2.34.1

Set the Float3NaNPropRule explicitly for i386.  We had no
i386-specific behaviour in the old ifdef ladder, so we were using the
default "prefer a then b then c" fallback; this is actually the
correct per-the-spec handling for i386.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-25-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c | 1 +
 1 file changed, 1 insertion(+)

Set the Float3NaNPropRule explicitly for HPPA, and remove the
ifdef from pickNaNMulAdd().

HPPA is the only target that was using the default branch of the
ifdef ladder (other targets either do not use muladd or set
default_nan_mode), so we can remove the ifdef fallback entirely now
(allowing the "rule not set" case to fall into the default of the
switch statement and assert).

We add a TODO note that the HPPA rule is probably wrong; this is
not a behavioural change for this refactoring.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-26-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       | 8 ++++++++
 fpu/softfloat-specialize.c.inc | 4 ----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
      * HPPA does note implement a CPU reset method at all...
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /*
+     * TODO: The HPPA architecture reference only documents its NaN
+     * propagation rule for 2-operand operations. Testing on real hardware
+     * might be necessary to confirm whether this order for muladd is correct.
+     * Not preferring the SNaN is almost certainly incorrect as it diverges
+     * from the documented rules for 2-operand operations.
+     */
+    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 
-    if (rule == float_3nan_prop_none) {
-        rule = float_3nan_prop_abc;
-    }
-
     assert(rule != float_3nan_prop_none);
     if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
         /* We have at least one SNaN input and should prefer it */
-- 
2.34.1

The use_first_nan field in float_status was an xtensa-specific way to
select at runtime from two different NaN propagation rules.  Now that
xtensa is using the target-agnostic NaN propagation rule selection
that we've just added, we can remove use_first_nan, because there is
no longer any code that reads it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-27-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 5 -----
 include/fpu/softfloat-types.h   | 1 -
 target/xtensa/fpu_helper.c      | 1 -
 3 files changed, 7 deletions(-)

Currently m68k_cpu_reset_hold() calls floatx80_default_nan(NULL)
to get the NaN bit pattern to reset the FPU registers. This
works because it happens that our implementation of
floatx80_default_nan() doesn't actually look at the float_status
pointer except for TARGET_MIPS. However, this isn't guaranteed,
and to be able to remove the ifdef in floatx80_default_nan()
we're going to need a real float_status here.

Rearrange m68k_cpu_reset_hold() so that we initialize env->fp_status
earlier, and thus can pass it to floatx80_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-28-peter.maydell@linaro.org
---
 target/m68k/cpu.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
     CPUState *cs = CPU(obj);
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(obj);
     CPUM68KState *env = cpu_env(cs);
-    floatx80 nan = floatx80_default_nan(NULL);
+    floatx80 nan;
     int i;
 
     if (mcc->parent_phases.hold) {
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
 #else
     cpu_m68k_set_sr(env, SR_S | SR_I);
 #endif
-    for (i = 0; i < 8; i++) {
-        env->fregs[i].d = nan;
-    }
-    cpu_m68k_set_fpcr(env, 0);
     /*
      * M68000 FAMILY PROGRAMMER'S REFERENCE MANUAL
      * 3.4 FLOATING-POINT INSTRUCTION DETAILS
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
      * preceding paragraph for nonsignaling NaNs.
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+
+    nan = floatx80_default_nan(&env->fp_status);
+    for (i = 0; i < 8; i++) {
+        env->fregs[i].d = nan;
+    }
+    cpu_m68k_set_fpcr(env, 0);
     env->fpsr = 0;
 
     /* TODO: We should set PC from the interrupt vector.  */
-- 
2.34.1

We create our 128-bit default NaN by calling parts64_default_nan()
and then adjusting the result.  We can do the same trick for creating
the floatx80 default NaN, which lets us drop a target ifdef.

floatx80 is used only by:
 i386
 m68k
 arm nwfpe old floating-point emulation emulation support
    (which is essentially dead, especially the parts involving floatx80)
 PPC (only in the xsrqpxp instruction, which just rounds an input
    value by converting to floatx80 and back, so will never generate
    the default NaN)

The floatx80 default NaN as currently implemented is:
 m68k: sign = 0, exp = 1...1, int = 1, frac = 1....1
 i386: sign = 1, exp = 1...1, int = 1, frac = 10...0

These are the same as the parts64_default_nan for these architectures.

This is technically a possible behaviour change for arm linux-user
nwfpe emulation emulation, because the default NaN will now have the
sign bit clear.  But we were already generating a different floatx80
default NaN from the real kernel emulation we are supposedly
following, which appears to use an all-bits-1 value:
 https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L267

This won't affect the only "real" use of the nwfpe emulation, which
is ancient binaries that used it as part of the old floating point
calling convention; that only uses loads and stores of 32 and 64 bit
floats, not any of the floatx80 behaviour the original hardware had.
We also get the nwfpe float64 default NaN value wrong:
 https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L166
so if we ever cared about this obscure corner the right fix would be
to correct that so nwfpe used its own default-NaN setting rather
than the Arm VFP one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-29-peter.maydell@linaro.org
---
 fpu/softfloat-specialize.c.inc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts128_silence_nan(FloatParts128 *p, float_status *status)
 floatx80 floatx80_default_nan(float_status *status)
 {
     floatx80 r;
+    /*
+     * Extrapolate from the choices made by parts64_default_nan to fill
+     * in the floatx80 format. We assume that floatx80's explicit
+     * integer bit is always set (this is true for i386 and m68k,
+     * which are the only real users of this format).
+     */
+    FloatParts64 p64;
+    parts64_default_nan(&p64, status);
 
-    /* None of the targets that have snan_bit_is_one use floatx80.  */
-    assert(!snan_bit_is_one(status));
-#if defined(TARGET_M68K)
-    r.low = UINT64_C(0xFFFFFFFFFFFFFFFF);
-    r.high = 0x7FFF;
-#else
-    /* X86 */
-    r.low = UINT64_C(0xC000000000000000);
-    r.high = 0xFFFF;
-#endif
+    r.high = 0x7FFF | (p64.sign << 15);
+    r.low = (1ULL << DECOMPOSED_BINARY_POINT) | p64.frac;
     return r;
 }
 
-- 
2.34.1

In target/loongarch's helper_fclass_s() and helper_fclass_d() we pass
a zero-initialized float_status struct to float32_is_quiet_nan() and
float64_is_quiet_nan(), with the cryptic comment "for
snan_bit_is_one".

This pattern appears to have been copied from target/riscv, where it
is used because the functions there do not have ready access to the
CPU state struct. The comment presumably refers to the fact that the
main reason the is_quiet_nan() functions want the float_state is
because they want to know about the snan_bit_is_one config.

In the loongarch helpers, though, we have the CPU state struct
to hand. Use the usual env->fp_status here. This avoids our needing
to track that we need to update the initializer of the local
float_status structs when the core softfloat code adds new
options for targets to configure their behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-30-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_s(CPULoongArchState *env, uint64_t fj)
     } else if (float32_is_zero_or_denormal(f)) {
         return sign ? 1 << 4 : 1 << 8;
     } else if (float32_is_any_nan(f)) {
-        float_status s = { }; /* for snan_bit_is_one */
-        return float32_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
+        return float32_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
     } else {
         return sign ? 1 << 3 : 1 << 7;
     }
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_d(CPULoongArchState *env, uint64_t fj)
     } else if (float64_is_zero_or_denormal(f)) {
         return sign ? 1 << 4 : 1 << 8;
     } else if (float64_is_any_nan(f)) {
-        float_status s = { }; /* for snan_bit_is_one */
-        return float64_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
+        return float64_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
     } else {
         return sign ? 1 << 3 : 1 << 7;
     }
-- 
2.34.1

In the frem helper, we have a local float_status because we want to
execute the floatx80_div() with a custom rounding mode.  Instead of
zero-initializing the local float_status and then having to set it up
with the m68k standard behaviour (including the NaN propagation rule
and copying the rounding precision from env->fp_status), initialize
it as a complete copy of env->fp_status. This will avoid our having
to add new code in this function for every new config knob we add
to fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-31-peter.maydell@linaro.org
---
 target/m68k/fpu_helper.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(frem)(CPUM68KState *env, FPReg *res, FPReg *val0, FPReg *val1)
 
     fp_rem = floatx80_rem(val1->d, val0->d, &env->fp_status);
     if (!floatx80_is_any_nan(fp_rem)) {
-        float_status fp_status = { };
+        /* Use local temporary fp_status to set different rounding mode */
+        float_status fp_status = env->fp_status;
         uint32_t quotient;
         int sign;
 
         /* Calculate quotient directly using round to nearest mode */
-        set_float_2nan_prop_rule(float_2nan_prop_ab, &fp_status);
         set_float_rounding_mode(float_round_nearest_even, &fp_status);
-        set_floatx80_rounding_precision(
-            get_floatx80_rounding_precision(&env->fp_status), &fp_status);
         fp_quot.d = floatx80_div(val1->d, val0->d, &fp_status);
 
         sign = extractFloatx80Sign(fp_quot.d);
-- 
2.34.1

In cf_fpu_gdb_get_reg() and cf_fpu_gdb_set_reg() we do the conversion
from float64 to floatx80 using a scratch float_status, because we
don't want the conversion to affect the CPU's floating point exception
status. Currently we use a zero-initialized float_status. This will
get steadily more awkward as we add config knobs to float_status
that the target must initialize. Avoid having to add any of that
configuration here by instead initializing our local float_status
from the env->fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-32-peter.maydell@linaro.org
---
 target/m68k/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_get_reg(CPUState *cs, GByteArray *mem_buf, int n)
     CPUM68KState *env = &cpu->env;
 
     if (n < 8) {
-        float_status s = {};
+        /* Use scratch float_status so any exceptions don't change CPU state */
+        float_status s = env->fp_status;
         return gdb_get_reg64(mem_buf, floatx80_to_float64(env->fregs[n].d, &s));
     }
     switch (n) {
@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_set_reg(CPUState *cs, uint8_t *mem_buf, int n)
     CPUM68KState *env = &cpu->env;
 
     if (n < 8) {
-        float_status s = {};
+        /* Use scratch float_status so any exceptions don't change CPU state */
+        float_status s = env->fp_status;
         env->fregs[n].d = float64_to_floatx80(ldq_be_p(mem_buf), &s);
         return 8;
     }
-- 
2.34.1

In the helper functions flcmps and flcmpd we use a scratch float_status
so that we don't change the CPU state if the comparison raises any
floating point exception flags. Instead of zero-initializing this
scratch float_status, initialize it as a copy of env->fp_status. This
avoids the need to explicitly initialize settings like the NaN
propagation rule or others we might add to softfloat in future.

To do this we need to pass the CPU env pointer in to the helper.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-33-peter.maydell@linaro.org
---
 target/sparc/helper.h     | 4 ++--
 target/sparc/fop_helper.c | 8 ++++----
 target/sparc/translate.c  | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/sparc/helper.h b/target/sparc/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/helper.h
+++ b/target/sparc/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fcmpd, TCG_CALL_NO_WG, i32, env, f64, f64)
 DEF_HELPER_FLAGS_3(fcmped, TCG_CALL_NO_WG, i32, env, f64, f64)
 DEF_HELPER_FLAGS_3(fcmpq, TCG_CALL_NO_WG, i32, env, i128, i128)
 DEF_HELPER_FLAGS_3(fcmpeq, TCG_CALL_NO_WG, i32, env, i128, i128)
-DEF_HELPER_FLAGS_2(flcmps, TCG_CALL_NO_RWG_SE, i32, f32, f32)
-DEF_HELPER_FLAGS_2(flcmpd, TCG_CALL_NO_RWG_SE, i32, f64, f64)
+DEF_HELPER_FLAGS_3(flcmps, TCG_CALL_NO_RWG_SE, i32, env, f32, f32)
+DEF_HELPER_FLAGS_3(flcmpd, TCG_CALL_NO_RWG_SE, i32, env, f64, f64)
 DEF_HELPER_2(raise_exception, noreturn, env, int)
 
 DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/fop_helper.c
+++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t helper_fcmpeq(CPUSPARCState *env, Int128 src1, Int128 src2)
     return finish_fcmp(env, r, GETPC());
 }
 
-uint32_t helper_flcmps(float32 src1, float32 src2)
+uint32_t helper_flcmps(CPUSPARCState *env, float32 src1, float32 src2)
 {
     /*
      * FLCMP never raises an exception nor modifies any FSR fields.
      * Perform the comparison with a dummy fp environment.
      */
-    float_status discard = { };
+    float_status discard = env->fp_status;
     FloatRelation r;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
@@ -XXX,XX +XXX,XX @@ uint32_t helper_flcmps(float32 src1, float32 src2)
     g_assert_not_reached();
 }
 
-uint32_t helper_flcmpd(float64 src1, float64 src2)
+uint32_t helper_flcmpd(CPUSPARCState *env, float64 src1, float64 src2)
 {
-    float_status discard = { };
+    float_status discard = env->fp_status;
     FloatRelation r;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPs(DisasContext *dc, arg_FLCMPs *a)
 
     src1 = gen_load_fpr_F(dc, a->rs1);
     src2 = gen_load_fpr_F(dc, a->rs2);
-    gen_helper_flcmps(cpu_fcc[a->cc], src1, src2);
+    gen_helper_flcmps(cpu_fcc[a->cc], tcg_env, src1, src2);
     return advance_pc(dc);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPd(DisasContext *dc, arg_FLCMPd *a)
 
     src1 = gen_load_fpr_D(dc, a->rs1);
     src2 = gen_load_fpr_D(dc, a->rs2);
-    gen_helper_flcmpd(cpu_fcc[a->cc], src1, src2);
+    gen_helper_flcmpd(cpu_fcc[a->cc], tcg_env, src1, src2);
     return advance_pc(dc);
 }
 
-- 
2.34.1

In the helper_compute_fprf functions, we pass a dummy float_status
in to the is_signaling_nan() function. This is unnecessary, because
we have convenient access to the CPU env pointer here and that
is already set up with the correct values for the snan_bit_is_one
and no_signaling_nans config settings. is_signaling_nan() doesn't
ever update the fp_status with any exception flags, so there is
no reason not to use env->fp_status here.

Use env->fp_status instead of the dummy fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-34-peter.maydell@linaro.org
---
 target/ppc/fpu_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/fpu_helper.c
+++ b/target/ppc/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_compute_fprf_##tp(CPUPPCState *env, tp arg)           \
     } else if (tp##_is_infinity(arg)) {                           \
         fprf = neg ? 0x09 << FPSCR_FPRF : 0x05 << FPSCR_FPRF;     \
     } else {                                                      \
-        float_status dummy = { };  /* snan_bit_is_one = 0 */      \
-        if (tp##_is_signaling_nan(arg, &dummy)) {                 \
+        if (tp##_is_signaling_nan(arg, &env->fp_status)) {        \
             fprf = 0x00 << FPSCR_FPRF;                            \
         } else {                                                  \
             fprf = 0x11 << FPSCR_FPRF;                            \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Now that float_status has a bunch of fp parameters,
it is easier to copy an existing structure than create
one from scratch.  Begin by copying the structure that
corresponds to the FPSR and make only the adjustments
required for BFloat16 semantics.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
      * no effect on AArch32 instructions.
      */
     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
-    *statusp = (float_status){
-        .tininess_before_rounding = float_tininess_before_rounding,
-        .float_rounding_mode = float_round_to_odd_inf,
-        .flush_to_zero = true,
-        .flush_inputs_to_zero = true,
-        .default_nan_mode = true,
-    };
+
+    *statusp = env->vfp.fp_status;
+    set_default_nan_mode(true, statusp);
 
     if (ebf) {
-        float_status *fpst = &env->vfp.fp_status;
-        set_flush_to_zero(get_flush_to_zero(fpst), statusp);
-        set_flush_inputs_to_zero(get_flush_inputs_to_zero(fpst), statusp);
-        set_float_rounding_mode(get_float_rounding_mode(fpst), statusp);
-
         /* EBF=1 needs to do a step with round-to-odd semantics */
         *oddstatusp = *statusp;
         set_float_rounding_mode(float_round_to_odd, oddstatusp);
+    } else {
+        set_flush_to_zero(true, statusp);
+        set_flush_inputs_to_zero(true, statusp);
+        set_float_rounding_mode(float_round_to_odd_inf, statusp);
     }
-
     return ebf;
 }
 
-- 
2.34.1

Currently we hardcode the default NaN value in parts64_default_nan()
using a compile-time ifdef ladder. This is awkward for two cases:
 * for single-QEMU-binary we can't hard-code target-specifics like this
 * for Arm FEAT_AFP the default NaN value depends on FPCR.AH
   (specifically the sign bit is different)

Add a field to float_status to specify the default NaN value; fall
back to the old ifdef behaviour if these are not set.

The default NaN value is specified by setting a uint8_t to a
pattern corresponding to the sign and upper fraction parts of
the NaN; the lower bits of the fraction are set from bit 0 of
the pattern.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-35-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 11 +++++++
 include/fpu/softfloat-types.h   | 10 ++++++
 fpu/softfloat-specialize.c.inc  | 55 ++++++++++++++++++++-------------
 3 files changed, 54 insertions(+), 22 deletions(-)

Set the default NaN pattern explicitly for the tests/fp code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-36-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c     | 1 +
 tests/fp/fp-test-log2.c | 1 +
 tests/fp/fp-test.c      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+    set_float_default_nan_pattern(0b01000000, &soft_status);
 
     f = bench_funcs[operation][precision];
     g_assert(f);
diff --git a/tests/fp/fp-test-log2.c b/tests/fp/fp-test-log2.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test-log2.c
+++ b/tests/fp/fp-test-log2.c
@@ -XXX,XX +XXX,XX @@ int main(int ac, char **av)
     int i;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_default_nan_pattern(0b01000000, &qsf);
     set_float_rounding_mode(float_round_nearest_even, &qsf);
 
     test.d = 0.0;
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
+    set_float_default_nan_pattern(0b01000000, &qsf);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-37-peter.maydell@linaro.org
---
 target/microblaze/cpu.c        | 2 ++
 fpu/softfloat-specialize.c.inc | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_reset_hold(Object *obj, ResetType type)
      * this architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
+    /* Default NaN: sign bit set, most significant frac bit set */
+    set_float_default_nan_pattern(0b11000000, &env->fp_status);
 
 #if defined(CONFIG_USER_ONLY)
     /* start in user mode with interrupts enabled.  */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
-    || defined(TARGET_MICROBLAZE)
+#elif defined(TARGET_I386) || defined(TARGET_X86_64)
         /* Sign bit set, most significant frac bit set */
         dnan_pattern = 0b11000000;
 #elif defined(TARGET_HPPA)
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-38-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c   | 4 ++++
 fpu/softfloat-specialize.c.inc | 3 ---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
      */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
+    /* Default NaN: sign bit set, most significant frac bit set */
+    set_float_default_nan_pattern(0b11000000, &env->fp_status);
+    set_float_default_nan_pattern(0b11000000, &env->mmx_status);
+    set_float_default_nan_pattern(0b11000000, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_I386) || defined(TARGET_X86_64)
-        /* Sign bit set, most significant frac bit set */
-        dnan_pattern = 0b11000000;
 #elif defined(TARGET_HPPA)
         /* Sign bit clear, msb-1 frac bit set */
         dnan_pattern = 0b00100000;
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-39-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       | 2 ++
 fpu/softfloat-specialize.c.inc | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    /* Default NaN: sign bit clear, msb-1 frac bit set */
+    set_float_default_nan_pattern(0b00100000, &env->fp_status);
 }
 
 void cpu_hppa_loaded_fr0(CPUHPPAState *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_HPPA)
-        /* Sign bit clear, msb-1 frac bit set */
-        dnan_pattern = 0b00100000;
 #elif defined(TARGET_HEXAGON)
         /* Sign bit set, all frac bits set. */
         dnan_pattern = 0b11111111;
-- 
2.34.1

Set the default NaN pattern explicitly for the arm target.
This includes setting it for the old linux-user nwfpe emulation.
For nwfpe, our default doesn't match the real kernel, but we
avoid making a behaviour change in this commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-41-peter.maydell@linaro.org
---
 linux-user/arm/nwfpe/fpa11.c | 5 +++++
 target/arm/cpu.c             | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/nwfpe/fpa11.c
+++ b/linux-user/arm/nwfpe/fpa11.c
@@ -XXX,XX +XXX,XX @@ void resetFPA11(void)
    * this late date.
    */
   set_float_2nan_prop_rule(float_2nan_prop_s_ab, &fpa11->fp_status);
+  /*
+   * Use the same default NaN value as Arm VFP. This doesn't match
+   * the Linux kernel's nwfpe emulation, which uses an all-1s value.
+   */
+  set_float_default_nan_pattern(0b01000000, &fpa11->fp_status);
 }
 
 void SetRoundingMode(const unsigned int opcode)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *    the pseudocode function the arguments are in the order c, a, b.
  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
  *    and the input NaN if it is signalling
+ *  * Default NaN has sign bit clear, msb frac bit set
  */
 static void arm_set_default_fp_behaviours(float_status *s)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+    set_float_default_nan_pattern(0b01000000, s);
 }
 
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
-- 
2.34.1

Set the default NaN pattern explicitly for m68k.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-43-peter.maydell@linaro.org
---
 target/m68k/cpu.c              | 2 ++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
      * preceding paragraph for nonsignaling NaNs.
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+    /* Default NaN: sign bit clear, all frac bits set */
+    set_float_default_nan_pattern(0b01111111, &env->fp_status);
 
     nan = floatx80_default_nan(&env->fp_status);
     for (i = 0; i < 8; i++) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_SPARC) || defined(TARGET_M68K)
+#if defined(TARGET_SPARC)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
 #elif defined(TARGET_HEXAGON)
-- 
2.34.1

Set the default NaN pattern explicitly for MIPS. Note that this
is our only target which currently changes the default NaN
at runtime (which it was previously doing indirectly when it
changed the snan_bit_is_one setting).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-44-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h | 7 +++++++
 target/mips/msa.c        | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
     nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
     set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
+    /*
+     * With nan2008, the default NaN value has the sign bit clear and the
+     * frac msb set; with the older mode, the sign bit is clear, and all
+     * frac bits except the msb are set.
+     */
+    set_float_default_nan_pattern(nan2008 ? 0b01000000 : 0b00111111,
+                                  &env->active_fpu.fp_status);
 
 }
 
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
     /* Inf * 0 + NaN returns the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never,
                               &env->active_tc.msa_fp_status);
+    /* Default NaN: sign bit clear, frac msb set */
+    set_float_default_nan_pattern(0b01000000,
+                                  &env->active_tc.msa_fp_status);
 }
-- 
2.34.1

Set the default NaN pattern explicitly for SPARC, and remove
the ifdef from parts64_default_nan.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-50-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 5 +----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
     set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    /* Default NaN value: sign bit clear, all frac bits set */
+    set_float_default_nan_pattern(0b01111111, &env->fp_status);
 
     cpu_exec_realizefn(cs, &local_err);
     if (local_err != NULL) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_SPARC)
-        /* Sign bit clear, all frac bits set */
-        dnan_pattern = 0b01111111;
-#elif defined(TARGET_HEXAGON)
+#if defined(TARGET_HEXAGON)
         /* Sign bit set, all frac bits set. */
         dnan_pattern = 0b11111111;
 #else
-- 
2.34.1

Set the default NaN pattern explicitly for hexagon.
Remove the ifdef from parts64_default_nan(); the only
remaining unconverted targets all use the default case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-52-peter.maydell@linaro.org
---
 target/hexagon/cpu.c           | 2 ++
 fpu/softfloat-specialize.c.inc | 5 -----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_reset_hold(Object *obj, ResetType type)
 
     set_default_nan_mode(1, &env->fp_status);
     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
+    /* Default NaN value: sign bit set, all frac bits set */
+    set_float_default_nan_pattern(0b11111111, &env->fp_status);
 }
 
 static void hexagon_cpu_disas_set_info(CPUState *s, disassemble_info *info)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_HEXAGON)
-        /* Sign bit set, all frac bits set. */
-        dnan_pattern = 0b11111111;
-#else
         /*
          * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
          * S390, SH4, TriCore, and Xtensa.  Our other supported targets
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
             /* sign bit clear, set frac msb */
             dnan_pattern = 0b01000000;
         }
-#endif
     }
     assert(dnan_pattern != 0);
 
-- 
2.34.1

Now that all our targets have bene converted to explicitly specify
their pattern for the default NaN value we can remove the remaining
fallback code in parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-55-peter.maydell@linaro.org
---
 fpu/softfloat-specialize.c.inc | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint64_t frac;
     uint8_t dnan_pattern = status->default_nan_pattern;
 
-    if (dnan_pattern == 0) {
-        /*
-         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
-         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
-         * do not have floating-point.
-         */
-        if (snan_bit_is_one(status)) {
-            /* sign bit clear, set all frac bits other than msb */
-            dnan_pattern = 0b00111111;
-        } else {
-            /* sign bit clear, set frac msb */
-            dnan_pattern = 0b01000000;
-        }
-    }
     assert(dnan_pattern != 0);
 
     sign = dnan_pattern >> 7;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Inline pickNaNMulAdd into its only caller.  This makes
one assert redundant with the immediately preceding IF.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-3-richard.henderson@linaro.org
[PMM: keep comment from old code in new location]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc      | 41 +++++++++++++++++++++++++-
 fpu/softfloat-specialize.c.inc | 54 ----------------------------------
 2 files changed, 40 insertions(+), 55 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
     }
 
     if (s->default_nan_mode) {
+        /*
+         * We guarantee not to require the target to tell us how to
+         * pick a NaN if we're always returning the default NaN.
+         * But if we're not in default-NaN mode then the target must
+         * specify.
+         */
         which = 3;
+    } else if (infzero) {
+        /*
+         * Inf * 0 + NaN -- some implementations return the
+         * default NaN here, and some return the input NaN.
+         */
+        switch (s->float_infzeronan_rule) {
+        case float_infzeronan_dnan_never:
+            which = 2;
+            break;
+        case float_infzeronan_dnan_always:
+            which = 3;
+            break;
+        case float_infzeronan_dnan_if_qnan:
+            which = is_qnan(c->cls) ? 3 : 2;
+            break;
+        default:
+            g_assert_not_reached();
+        }
     } else {
-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
+        FloatClass cls[3] = { a->cls, b->cls, c->cls };
+        Float3NaNPropRule rule = s->float_3nan_prop_rule;
+
+        assert(rule != float_3nan_prop_none);
+        if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+            /* We have at least one SNaN input and should prefer it */
+            do {
+                which = rule & R_3NAN_1ST_MASK;
+                rule >>= R_3NAN_1ST_LENGTH;
+            } while (!is_snan(cls[which]));
+        } else {
+            do {
+                which = rule & R_3NAN_1ST_MASK;
+                rule >>= R_3NAN_1ST_LENGTH;
+            } while (!is_nan(cls[which]));
+        }
     }
 
     if (which == 3) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
     }
 }
 
-/*----------------------------------------------------------------------------
-| Select which NaN to propagate for a three-input operation.
-| For the moment we assume that no CPU needs the 'larger significand'
-| information.
-| Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
-*----------------------------------------------------------------------------*/
-static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-                         bool infzero, bool have_snan, float_status *status)
-{
-    FloatClass cls[3] = { a_cls, b_cls, c_cls };
-    Float3NaNPropRule rule = status->float_3nan_prop_rule;
-    int which;
-
-    /*
-     * We guarantee not to require the target to tell us how to
-     * pick a NaN if we're always returning the default NaN.
-     * But if we're not in default-NaN mode then the target must
-     * specify.
-     */
-    assert(!status->default_nan_mode);
-
-    if (infzero) {
-        /*
-         * Inf * 0 + NaN -- some implementations return the default NaN here,
-         * and some return the input NaN.
-         */
-        switch (status->float_infzeronan_rule) {
-        case float_infzeronan_dnan_never:
-            return 2;
-        case float_infzeronan_dnan_always:
-            return 3;
-        case float_infzeronan_dnan_if_qnan:
-            return is_qnan(c_cls) ? 3 : 2;
-        default:
-            g_assert_not_reached();
-        }
-    }
-
-    assert(rule != float_3nan_prop_none);
-    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
-        /* We have at least one SNaN input and should prefer it */
-        do {
-            which = rule & R_3NAN_1ST_MASK;
-            rule >>= R_3NAN_1ST_LENGTH;
-        } while (!is_snan(cls[which]));
-    } else {
-        do {
-            which = rule & R_3NAN_1ST_MASK;
-            rule >>= R_3NAN_1ST_LENGTH;
-        } while (!is_nan(cls[which]));
-    }
-    return which;
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the double-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove "3" as a special case for which and simply
branch to return the desired value.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          * But if we're not in default-NaN mode then the target must
          * specify.
          */
-        which = 3;
+        goto default_nan;
     } else if (infzero) {
         /*
          * Inf * 0 + NaN -- some implementations return the
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          */
         switch (s->float_infzeronan_rule) {
         case float_infzeronan_dnan_never:
-            which = 2;
             break;
         case float_infzeronan_dnan_always:
-            which = 3;
-            break;
+            goto default_nan;
         case float_infzeronan_dnan_if_qnan:
-            which = is_qnan(c->cls) ? 3 : 2;
+            if (is_qnan(c->cls)) {
+                goto default_nan;
+            }
             break;
         default:
             g_assert_not_reached();
         }
+        which = 2;
     } else {
         FloatClass cls[3] = { a->cls, b->cls, c->cls };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         }
     }
 
-    if (which == 3) {
-        parts_default_nan(a, s);
-        return a;
-    }
-
     switch (which) {
     case 0:
         break;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         parts_silence_nan(a, s);
     }
     return a;
+
+ default_nan:
+    parts_default_nan(a, s);
+    return a;
 }
 
 /*
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Assign the pointer return value to 'a' directly,
rather than going through an intermediary index.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
                                             FloatPartsN *c, float_status *s,
                                             int ab_mask, int abc_mask)
 {
-    int which;
     bool infzero = (ab_mask == float_cmask_infzero);
     bool have_snan = (abc_mask & float_cmask_snan);
+    FloatPartsN *ret;
 
     if (unlikely(have_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         default:
             g_assert_not_reached();
         }
-        which = 2;
+        ret = c;
     } else {
-        FloatClass cls[3] = { a->cls, b->cls, c->cls };
+        FloatPartsN *val[3] = { a, b, c };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
 
         assert(rule != float_3nan_prop_none);
         if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
             /* We have at least one SNaN input and should prefer it */
             do {
-                which = rule & R_3NAN_1ST_MASK;
+                ret = val[rule & R_3NAN_1ST_MASK];
                 rule >>= R_3NAN_1ST_LENGTH;
-            } while (!is_snan(cls[which]));
+            } while (!is_snan(ret->cls));
         } else {
             do {
-                which = rule & R_3NAN_1ST_MASK;
+                ret = val[rule & R_3NAN_1ST_MASK];
                 rule >>= R_3NAN_1ST_LENGTH;
-            } while (!is_nan(cls[which]));
+            } while (!is_nan(ret->cls));
         }
     }
 
-    switch (which) {
-    case 0:
-        break;
-    case 1:
-        a = b;
-        break;
-    case 2:
-        a = c;
-        break;
-    default:
-        g_assert_not_reached();
+    if (is_snan(ret->cls)) {
+        parts_silence_nan(ret, s);
     }
-    if (is_snan(a->cls)) {
-        parts_silence_nan(a, s);
-    }
-    return a;
+    return ret;
 
  default_nan:
     parts_default_nan(a, s);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While all indices into val[] should be in [0-2], the mask
applied is two bits.  To help static analysis see there is
no possibility of read beyond the end of the array, pad the
array to 4 entries, with the final being (implicitly) NULL.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         }
         ret = c;
     } else {
-        FloatPartsN *val[3] = { a, b, c };
+        FloatPartsN *val[R_3NAN_1ST_MASK + 1] = { a, b, c };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
 
         assert(rule != float_3nan_prop_none);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is part of the public interface and
is not "specialized" to any target in any way.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat.c                | 52 ++++++++++++++++++++++++++++++++++
 fpu/softfloat-specialize.c.inc | 52 ----------------------------------
 2 files changed, 52 insertions(+), 52 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
     *zExpPtr = 1 - shiftCount;
 }
 
+/*----------------------------------------------------------------------------
+| Takes two extended double-precision floating-point values `a' and `b', one
+| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
+| `b' is a signaling NaN, the invalid exception is raised.
+*----------------------------------------------------------------------------*/
+
+floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
+{
+    bool aIsLargerSignificand;
+    FloatClass a_cls, b_cls;
+
+    /* This is not complete, but is good enough for pickNaN.  */
+    a_cls = (!floatx80_is_any_nan(a)
+             ? float_class_normal
+             : floatx80_is_signaling_nan(a, status)
+             ? float_class_snan
+             : float_class_qnan);
+    b_cls = (!floatx80_is_any_nan(b)
+             ? float_class_normal
+             : floatx80_is_signaling_nan(b, status)
+             ? float_class_snan
+             : float_class_qnan);
+
+    if (is_snan(a_cls) || is_snan(b_cls)) {
+        float_raise(float_flag_invalid, status);
+    }
+
+    if (status->default_nan_mode) {
+        return floatx80_default_nan(status);
+    }
+
+    if (a.low < b.low) {
+        aIsLargerSignificand = 0;
+    } else if (b.low < a.low) {
+        aIsLargerSignificand = 1;
+    } else {
+        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
+    }
+
+    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
+        if (is_snan(b_cls)) {
+            return floatx80_silence_nan(b, status);
+        }
+        return b;
+    } else {
+        if (is_snan(a_cls)) {
+            return floatx80_silence_nan(a, status);
+        }
+        return a;
+    }
+}
+
 /*----------------------------------------------------------------------------
 | Takes an abstract floating-point value having sign `zSign', exponent `zExp',
 | and extended significand formed by the concatenation of `zSig0' and `zSig1',
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ floatx80 floatx80_silence_nan(floatx80 a, float_status *status)
     return a;
 }
 
-/*----------------------------------------------------------------------------
-| Takes two extended double-precision floating-point values `a' and `b', one
-| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
-| `b' is a signaling NaN, the invalid exception is raised.
-*----------------------------------------------------------------------------*/
-
-floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
-{
-    bool aIsLargerSignificand;
-    FloatClass a_cls, b_cls;
-
-    /* This is not complete, but is good enough for pickNaN.  */
-    a_cls = (!floatx80_is_any_nan(a)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(a, status)
-             ? float_class_snan
-             : float_class_qnan);
-    b_cls = (!floatx80_is_any_nan(b)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(b, status)
-             ? float_class_snan
-             : float_class_qnan);
-
-    if (is_snan(a_cls) || is_snan(b_cls)) {
-        float_raise(float_flag_invalid, status);
-    }
-
-    if (status->default_nan_mode) {
-        return floatx80_default_nan(status);
-    }
-
-    if (a.low < b.low) {
-        aIsLargerSignificand = 0;
-    } else if (b.low < a.low) {
-        aIsLargerSignificand = 1;
-    } else {
-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
-    }
-
-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
-        if (is_snan(b_cls)) {
-            return floatx80_silence_nan(b, status);
-        }
-        return b;
-    } else {
-        if (is_snan(a_cls)) {
-            return floatx80_silence_nan(a, status);
-        }
-        return a;
-    }
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the quadruple-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Unpacking and repacking the parts may be slightly more work
than we did before, but we get to reuse more code.  For a
code path handling exceptional values, this is an improvement.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241203203949.483774-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat.c | 43 +++++--------------------------------------
 1 file changed, 5 insertions(+), 38 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
 
 floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
 {
-    bool aIsLargerSignificand;
-    FloatClass a_cls, b_cls;
+    FloatParts128 pa, pb, *pr;
 
-    /* This is not complete, but is good enough for pickNaN.  */
-    a_cls = (!floatx80_is_any_nan(a)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(a, status)
-             ? float_class_snan
-             : float_class_qnan);
-    b_cls = (!floatx80_is_any_nan(b)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(b, status)
-             ? float_class_snan
-             : float_class_qnan);
-
-    if (is_snan(a_cls) || is_snan(b_cls)) {
-        float_raise(float_flag_invalid, status);
-    }
-
-    if (status->default_nan_mode) {
+    if (!floatx80_unpack_canonical(&pa, a, status) ||
+        !floatx80_unpack_canonical(&pb, b, status)) {
         return floatx80_default_nan(status);
     }
 
-    if (a.low < b.low) {
-        aIsLargerSignificand = 0;
-    } else if (b.low < a.low) {
-        aIsLargerSignificand = 1;
-    } else {
-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
-    }
-
-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
-        if (is_snan(b_cls)) {
-            return floatx80_silence_nan(b, status);
-        }
-        return b;
-    } else {
-        if (is_snan(a_cls)) {
-            return floatx80_silence_nan(a, status);
-        }
-        return a;
-    }
+    pr = parts_pick_nan(&pa, &pb, status);
+    return floatx80_round_pack_canonical(pr, status);
 }
 
 /*----------------------------------------------------------------------------
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Inline pickNaN into its only caller.  This makes one assert
redundant with the immediately preceding IF.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc      | 82 +++++++++++++++++++++++++----
 fpu/softfloat-specialize.c.inc | 96 ----------------------------------
 2 files changed, 73 insertions(+), 105 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
 static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
                                      float_status *s)
 {
+    int cmp, which;
+
     if (is_snan(a->cls) || is_snan(b->cls)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
     if (s->default_nan_mode) {
         parts_default_nan(a, s);
-    } else {
-        int cmp = frac_cmp(a, b);
-        if (cmp == 0) {
-            cmp = a->sign < b->sign;
-        }
+        return a;
+    }
 
-        if (pickNaN(a->cls, b->cls, cmp > 0, s)) {
-            a = b;
-        }
+    cmp = frac_cmp(a, b);
+    if (cmp == 0) {
+        cmp = a->sign < b->sign;
+    }
+
+    switch (s->float_2nan_prop_rule) {
+    case float_2nan_prop_s_ab:
         if (is_snan(a->cls)) {
-            parts_silence_nan(a, s);
+            which = 0;
+        } else if (is_snan(b->cls)) {
+            which = 1;
+        } else if (is_qnan(a->cls)) {
+            which = 0;
+        } else {
+            which = 1;
         }
+        break;
+    case float_2nan_prop_s_ba:
+        if (is_snan(b->cls)) {
+            which = 1;
+        } else if (is_snan(a->cls)) {
+            which = 0;
+        } else if (is_qnan(b->cls)) {
+            which = 1;
+        } else {
+            which = 0;
+        }
+        break;
+    case float_2nan_prop_ab:
+        which = is_nan(a->cls) ? 0 : 1;
+        break;
+    case float_2nan_prop_ba:
+        which = is_nan(b->cls) ? 1 : 0;
+        break;
+    case float_2nan_prop_x87:
+        /*
+         * This implements x87 NaN propagation rules:
+         * SNaN + QNaN => return the QNaN
+         * two SNaNs => return the one with the larger significand, silenced
+         * two QNaNs => return the one with the larger significand
+         * SNaN and a non-NaN => return the SNaN, silenced
+         * QNaN and a non-NaN => return the QNaN
+         *
+         * If we get down to comparing significands and they are the same,
+         * return the NaN with the positive sign bit (if any).
+         */
+        if (is_snan(a->cls)) {
+            if (is_snan(b->cls)) {
+                which = cmp > 0 ? 0 : 1;
+            } else {
+                which = is_qnan(b->cls) ? 1 : 0;
+            }
+        } else if (is_qnan(a->cls)) {
+            if (is_snan(b->cls) || !is_qnan(b->cls)) {
+                which = 0;
+            } else {
+                which = cmp > 0 ? 0 : 1;
+            }
+        } else {
+            which = 1;
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (which) {
+        a = b;
+    }
+    if (is_snan(a->cls)) {
+        parts_silence_nan(a, s);
     }
     return a;
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ bool float32_is_signaling_nan(float32 a_, float_status *status)
     }
 }
 
-/*----------------------------------------------------------------------------
-| Select which NaN to propagate for a two-input operation.
-| IEEE754 doesn't specify all the details of this, so the
-| algorithm is target-specific.
-| The routine is passed various bits of information about the
-| two NaNs and should return 0 to select NaN a and 1 for NaN b.
-| Note that signalling NaNs are always squashed to quiet NaNs
-| by the caller, by calling floatXX_silence_nan() before
-| returning them.
-|
-| aIsLargerSignificand is only valid if both a and b are NaNs
-| of some kind, and is true if a has the larger significand,
-| or if both a and b have the same significand but a is
-| positive but b is negative. It is only needed for the x87
-| tie-break rule.
-*----------------------------------------------------------------------------*/
-
-static int pickNaN(FloatClass a_cls, FloatClass b_cls,
-                   bool aIsLargerSignificand, float_status *status)
-{
-    /*
-     * We guarantee not to require the target to tell us how to
-     * pick a NaN if we're always returning the default NaN.
-     * But if we're not in default-NaN mode then the target must
-     * specify via set_float_2nan_prop_rule().
-     */
-    assert(!status->default_nan_mode);
-
-    switch (status->float_2nan_prop_rule) {
-    case float_2nan_prop_s_ab:
-        if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-        break;
-    case float_2nan_prop_s_ba:
-        if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_qnan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-        break;
-    case float_2nan_prop_ab:
-        if (is_nan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-        break;
-    case float_2nan_prop_ba:
-        if (is_nan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-        break;
-    case float_2nan_prop_x87:
-        /*
-         * This implements x87 NaN propagation rules:
-         * SNaN + QNaN => return the QNaN
-         * two SNaNs => return the one with the larger significand, silenced
-         * two QNaNs => return the one with the larger significand
-         * SNaN and a non-NaN => return the SNaN, silenced
-         * QNaN and a non-NaN => return the QNaN
-         *
-         * If we get down to comparing significands and they are the same,
-         * return the NaN with the positive sign bit (if any).
-         */
-        if (is_snan(a_cls)) {
-            if (is_snan(b_cls)) {
-                return aIsLargerSignificand ? 0 : 1;
-            }
-            return is_qnan(b_cls) ? 1 : 0;
-        } else if (is_qnan(a_cls)) {
-            if (is_snan(b_cls) || !is_qnan(b_cls)) {
-                return 0;
-            } else {
-                return aIsLargerSignificand ? 0 : 1;
-            }
-        } else {
-            return 1;
-        }
-    default:
-        g_assert_not_reached();
-    }
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the double-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Remember if there was an SNaN, and use that to simplify
float_2nan_prop_s_{ab,ba} to only the snan component.
Then, fall through to the corresponding
float_2nan_prop_{ab,ba} case to handle any remaining
nans, which must be quiet.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Move the fractional comparison to the end of the
float_2nan_prop_x87 case.  This is not required for
any other 2nan propagation rule.  Reorganize the
x87 case itself to break out of the switch when the
fractional comparison is not required.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
         return a;
     }
 
-    cmp = frac_cmp(a, b);
-    if (cmp == 0) {
-        cmp = a->sign < b->sign;
-    }
-
     switch (s->float_2nan_prop_rule) {
     case float_2nan_prop_s_ab:
         if (have_snan) {
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
          * return the NaN with the positive sign bit (if any).
          */
         if (is_snan(a->cls)) {
-            if (is_snan(b->cls)) {
-                which = cmp > 0 ? 0 : 1;
-            } else {
+            if (!is_snan(b->cls)) {
                 which = is_qnan(b->cls) ? 1 : 0;
+                break;
             }
         } else if (is_qnan(a->cls)) {
             if (is_snan(b->cls) || !is_qnan(b->cls)) {
                 which = 0;
-            } else {
-                which = cmp > 0 ? 0 : 1;
+                break;
             }
         } else {
             which = 1;
+            break;
         }
+        cmp = frac_cmp(a, b);
+        if (cmp == 0) {
+            cmp = a->sign < b->sign;
+        }
+        which = cmp > 0 ? 0 : 1;
         break;
     default:
         g_assert_not_reached();
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace the "index" selecting between A and B with a result variable
of the proper type.  This improves clarity within the function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
                                      float_status *s)
 {
     bool have_snan = false;
-    int cmp, which;
+    FloatPartsN *ret;
+    int cmp;
 
     if (is_snan(a->cls) || is_snan(b->cls)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
     switch (s->float_2nan_prop_rule) {
     case float_2nan_prop_s_ab:
         if (have_snan) {
-            which = is_snan(a->cls) ? 0 : 1;
+            ret = is_snan(a->cls) ? a : b;
             break;
         }
         /* fall through */
     case float_2nan_prop_ab:
-        which = is_nan(a->cls) ? 0 : 1;
+        ret = is_nan(a->cls) ? a : b;
         break;
     case float_2nan_prop_s_ba:
         if (have_snan) {
-            which = is_snan(b->cls) ? 1 : 0;
+            ret = is_snan(b->cls) ? b : a;
             break;
         }
         /* fall through */
     case float_2nan_prop_ba:
-        which = is_nan(b->cls) ? 1 : 0;
+        ret = is_nan(b->cls) ? b : a;
         break;
     case float_2nan_prop_x87:
         /*
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
          */
         if (is_snan(a->cls)) {
             if (!is_snan(b->cls)) {
-                which = is_qnan(b->cls) ? 1 : 0;
+                ret = is_qnan(b->cls) ? b : a;
                 break;
             }
         } else if (is_qnan(a->cls)) {
             if (is_snan(b->cls) || !is_qnan(b->cls)) {
-                which = 0;
+                ret = a;
                 break;
             }
         } else {
-            which = 1;
+            ret = b;
             break;
         }
         cmp = frac_cmp(a, b);
         if (cmp == 0) {
             cmp = a->sign < b->sign;
         }
-        which = cmp > 0 ? 0 : 1;
+        ret = cmp > 0 ? a : b;
         break;
     default:
         g_assert_not_reached();
     }
 
-    if (which) {
-        a = b;
+    if (is_snan(ret->cls)) {
+        parts_silence_nan(ret, s);
     }
-    if (is_snan(a->cls)) {
-        parts_silence_nan(a, s);
-    }
-    return a;
+    return ret;
 }
 
 static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-- 
2.34.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

I'm migrating to Qualcomm's new open source email infrastructure, so
update my email address, and update the mailmap to match.

Signed-off-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241205114047.1125842-1-leif.lindholm@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 2 +-
 .mailmap    | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
 SBSA-REF
 M: Radoslaw Biernacki <rad@semihalf.com>
 M: Peter Maydell <peter.maydell@linaro.org>
-R: Leif Lindholm <quic_llindhol@quicinc.com>
+R: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
 R: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
 James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Juan Quintela <quintela@trasno.org> <quintela@redhat.com>
-Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
-Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <quic_llindhol@quicinc.com>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif.lindholm@linaro.org>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif@nuviainc.com>
 Luc Michel <luc@lmichel.fr> <luc.michel@git.antfield.fr>
 Luc Michel <luc@lmichel.fr> <luc.michel@greensocs.com>
 Luc Michel <luc@lmichel.fr> <lmichel@kalray.eu>
-- 
2.34.1

From: Vikram Garhwal <vikram.garhwal@bytedance.com>

Previously, maintainer role was paused due to inactive email id. Commit id:
c009d715721861984c4987bcc78b7ee183e86d75.

Signed-off-by: Vikram Garhwal <vikram.garhwal@bytedance.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20241204184205.12952-1-vikram.garhwal@bytedance.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: tests/qtest/fuzz-sb16-test.c
 
 Xilinx CAN
 M: Francisco Iglesias <francisco.iglesias@amd.com>
+M: Vikram Garhwal <vikram.garhwal@bytedance.com>
 S: Maintained
 F: hw/net/can/xlnx-*
 F: include/hw/net/xlnx-*
@@ -XXX,XX +XXX,XX @@ F: include/hw/rx/
 CAN bus subsystem and hardware
 M: Pavel Pisa <pisa@cmp.felk.cvut.cz>
 M: Francisco Iglesias <francisco.iglesias@amd.com>
+M: Vikram Garhwal <vikram.garhwal@bytedance.com>
 S: Maintained
 W: https://canbus.pages.fel.cvut.cz/
 F: net/can/*
-- 
2.34.1