Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[PULL 00/21] target-arm queue
-The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:
+Mostly straightforward bugfixes. The new Xilinx devices are
 arguably 'new feature', but they're fixing a regression where
 our changes to PSCI in commit 3f37979bf mean that EL3 guest
 code now needs to talk to a proper emulated power-controller
 device to turn on secondary CPUs; and it's not yet rc1 and
 they only affect the Xilinx board, so it seems OK to me.
-  Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)
+thanks
 -- PMM
 The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:
   Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318
-for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:
+for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:
-  tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)
+  util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix coverity nit in int_to_float code
+ * Fix sve2 ldnt1 and stnt1
- * Don't set Invalid for float-to-int(MAXINT)
+ * Fix pauth_check_trap vs SEL2
- * Fix fp_status_f16 tininess before rounding
+ * Fix handling of LPAE block descriptors
- * Add various missing insns from the v8.2-FP16 extension
+ * hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
- * Fix sqrt_f16 exception raising
+ * hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
- * sdcard: Correct CRC16 offset in sd_function_switch()
+ * nsis installer: List emulators in alphabetical order
- * tcg: Optionally log FPU state in TCG -d cpu logging
+ * nsis installer: Suppress "ANSI targets are deprecated" warning
  * nsis installer: Fix mouse-over descriptions for emulators
  * hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
  * Improve M-profile vector table access logging
  * Xilinx ZynqMP: model CRF and APU control
  * Fix compile issues on modern Solaris
 ----------------------------------------------------------------
-Alex Bennée (5):
+Andrew Deason (3):
-      fpu/softfloat: int_to_float ensure r fully initialised
+      util/osdep: Avoid madvise proto on modern Solaris
-      target/arm: Implement FCMP for fp16
+      hw/i386/acpi-build: Avoid 'sun' identifier
-      target/arm: Implement FCSEL for fp16
+      util/osdep: Remove some early cruft
       target/arm: Implement FMOV (immediate) for fp16
       target/arm: Fix sqrt_f16 exception raising
-Peter Maydell (3):
+Edgar E. Iglesias (6):
-      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+      hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
-      target/arm: Fix fp_status_f16 tininess before rounding
+      target/arm: Make rvbar settable after realize
-      tcg: Optionally log FPU state in TCG -d cpu logging
+      hw/misc: Add a model of the Xilinx ZynqMP CRF
       hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
       hw/misc: Add a model of the Xilinx ZynqMP APU Control
       hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control
-Philippe Mathieu-Daudé (1):
+Eric Auger (2):
-      sdcard: Correct CRC16 offset in sd_function_switch()
+      hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
       hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
-Richard Henderson (7):
+Peter Maydell (8):
-      target/arm: Implement FMOV (general) for fp16
+      target/arm: Fix handling of LPAE block descriptors
-      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+      hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
-      target/arm: Implement FCVT (scalar, integer) for fp16
+      hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
-      target/arm: Implement FCVT (scalar, fixed-point) for fp16
+      nsis installer: List emulators in alphabetical order
-      target/arm: Introduce and use read_fp_hreg
+      nsis installer: Suppress "ANSI targets are deprecated" warning
-      target/arm: Implement FP data-processing (2 source) for fp16
+      nsis installer: Fix mouse-over descriptions for emulators
-      target/arm: Implement FP data-processing (3 source) for fp16
+      target/arm: Log M-profile vector table accesses
       target/arm: Log fault address for M-profile faults
- include/qemu/log.h         |   1 +
+Richard Henderson (2):
- target/arm/helper-a64.h    |   2 +
+      target/arm: Fix sve2 ldnt1 and stnt1
- target/arm/helper.h        |   6 +
+      target/arm: Fix pauth_check_trap vs SEL2
  accel/tcg/cpu-exec.c       |   9 +-
  fpu/softfloat.c            |   6 +-
  hw/sd/sd.c                 |   2 +-
  target/arm/cpu.c           |   2 +
  target/arm/helper-a64.c    |  10 ++
  target/arm/helper.c        |  38 +++-
  target/arm/translate-a64.c | 421 ++++++++++++++++++++++++++++++++++++++-------
  util/log.c                 |   2 +
 files changed, 428 insertions(+), 71 deletions(-)
+ meson.build                            |  23 ++-
+ include/hw/arm/xlnx-zynqmp.h           |   4 +
+ include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 ++++++++++++
+ include/hw/misc/xlnx-zynqmp-crf.h      | 211 ++++++++++++++++++++++++++
+ include/qemu/osdep.h                   |   8 +
+ target/arm/cpu.h                       |   3 +-
+ target/arm/sve.decode                  |   5 +-
+ hw/arm/virt.c                          |   7 +-
+ hw/arm/xlnx-zynqmp.c                   |  46 +++++-
+ hw/dma/xlnx_csu_dma.c                  |   1 +
+ hw/i386/acpi-build.c                   |   4 +-
+ hw/misc/npcm7xx_clk.c                  |   4 +-
+ hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++++++++
+ hw/misc/xlnx-zynqmp-crf.c              | 266 +++++++++++++++++++++++++++++++++
+ target/arm/cpu.c                       |  17 ++-
+ target/arm/helper.c                    |  20 ++-
+ target/arm/m_helper.c                  |  11 ++
+ target/arm/pauth_helper.c              |   2 +-
+ target/arm/translate-sve.c             |  51 ++++++-
+ tests/tcg/aarch64/test-826.c           |  50 +++++++
+ util/osdep.c                           |  10 --
+ hw/intc/Kconfig                        |   2 +-
+ hw/intc/meson.build                    |   4 +-
+ hw/misc/meson.build                    |   2 +
+ qemu.nsi                               |   8 +-
+ scripts/nsis.py                        |  17 ++-
+ tests/tcg/aarch64/Makefile.target      |   4 +
+ tests/tcg/configure.sh                 |   4 +
+files changed, 1084 insertions(+), 46 deletions(-)
+ create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+ create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
+ create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
+ create mode 100644 hw/misc/xlnx-zynqmp-crf.c
+ create mode 100644 tests/tcg/aarch64/test-826.c

-[Qemu-devel] [PULL 09/16] target/arm: Implement FP data-processing (2 source) for fp16
+[PULL 01/21] target/arm: Fix sve2 ldnt1 and stnt1
 From: Richard Henderson <richard.henderson@linaro.org>
-We missed all of the scalar fp16 binary operations.
+For both ldnt1 and stnt1, the meaning of the Rn and Rm are different
+from ld1 and st1: the vector and integer registers are reversed, and
-Cc: qemu-stable@nongnu.org
+the integer register 31 refers to XZR instead of SP.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Secondly, the 64-bit version of ldnt1 was being interpreted as
 -bit unpacked unscaled offset instead of 64-bit unscaled offset,
 which discarded the upper 32 bits of the address coming from
 the vector argument.
 Thirdly, validate that the memory element size is in range for the
 vector element size for ldnt1.  For ld1, we do this via independent
 decode patterns, but for ldnt1 we need to do it manually.
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
+Message-id: 20220308031655.240710-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
+ target/arm/sve.decode             |  5 ++-
-file changed, 65 insertions(+)
+ target/arm/translate-sve.c        | 51 +++++++++++++++++++++++++++++--
+ tests/tcg/aarch64/test-826.c      | 50 ++++++++++++++++++++++++++++++
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+ tests/tcg/aarch64/Makefile.target |  4 +++
  tests/tcg/configure.sh            |  4 +++
 files changed, 109 insertions(+), 5 deletions(-)
  create mode 100644 tests/tcg/aarch64/test-826.c
 diff --git a/target/arm/sve.decode b/target/arm/sve.decode
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/sve.decode
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/sve.decode
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
-     tcg_temp_free_i64(tcg_res);
  ### SVE2 Memory Gather Load Group
 -# SVE2 64-bit gather non-temporal load
 -#   (scalar plus unpacked 32-bit unscaled offsets)
 +# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)
  LDNT1_zprz      1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \
 -                &rprr_gather_load xs=0 esz=3 scale=0 ff=0
 +                &rprr_gather_load xs=2 esz=3 scale=0 ff=0
  # SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)
  LDNT1_zprz      1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \
 diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)
  static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)
  {
 +    gen_helper_gvec_mem_scatter *fn = NULL;
 +    bool be = s->be_data == MO_BE;
 +    bool mte = s->mte_active[0];
 +
 +    if (a->esz < a->msz + !a->u) {
 +        return false;
 +    }
      if (!dc_isar_feature(aa64_sve2, s)) {
          return false;
      }
 -    return trans_LD1_zprz(s, a);
 +    if (!sve_access_check(s)) {
 +        return true;
 +    }
 +
 +    switch (a->esz) {
 +    case MO_32:
 +        fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];
 +        break;
 +    case MO_64:
 +        fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];
 +        break;
 +    }
 +    assert(fn != NULL);
 +
 +    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
 +               cpu_reg(s, a->rm), a->msz, false, fn);
 +    return true;
  }
-+/* Floating-point data-processing (2 source) - half precision */
+ /* Indexed by [mte][be][xs][msz].  */
-+static void handle_fp_2src_half(DisasContext *s, int opcode,
+@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)
-+                                int rd, int rn, int rm)
-+{
+ static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)
-+    TCGv_i32 tcg_op1;
+ {
-+    TCGv_i32 tcg_op2;
++    gen_helper_gvec_mem_scatter *fn;
-+    TCGv_i32 tcg_res;
++    bool be = s->be_data == MO_BE;
-+    TCGv_ptr fpst;
++    bool mte = s->mte_active[0];
 +
-+    tcg_res = tcg_temp_new_i32();
++    if (a->esz < a->msz) {
-+    fpst = get_fpstatus_ptr(true);
++        return false;
-+    tcg_op1 = read_fp_hreg(s, rn);
++    }
-+    tcg_op2 = read_fp_hreg(s, rm);
+     if (!dc_isar_feature(aa64_sve2, s)) {
-+
+         return false;
-+    switch (opcode) {
+     }
-+    case 0x0: /* FMUL */
+-    return trans_ST1_zprz(s, a);
-+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
++    if (!sve_access_check(s)) {
-+        break;
++        return true;
-+    case 0x1: /* FDIV */
++    }
-+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
++
-+        break;
++    switch (a->esz) {
-+    case 0x2: /* FADD */
++    case MO_32:
-+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
++        fn = scatter_store_fn32[mte][be][0][a->msz];
 +        break;
-+    case 0x3: /* FSUB */
++    case MO_64:
-+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
++        fn = scatter_store_fn64[mte][be][2][a->msz];
 +        break;
 +    case 0x4: /* FMAX */
 +        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x5: /* FMIN */
 +        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x6: /* FMAXNM */
 +        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x7: /* FMINNM */
 +        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        break;
 +    case 0x8: /* FNMUL */
 +        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
 +        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
-+    write_fp_sreg(s, rd, tcg_res);
++    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
-+
++               cpu_reg(s, a->rm), a->msz, true, fn);
-+    tcg_temp_free_ptr(fpst);
++    return true;
-+    tcg_temp_free_i32(tcg_op1);
+ }
-+    tcg_temp_free_i32(tcg_op2);
-+    tcg_temp_free_i32(tcg_res);
+ /*
 diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/tcg/aarch64/test-826.c
@@ -XXX,XX +XXX,XX @@
 +#include <sys/mman.h>
 +#include <unistd.h>
 +#include <signal.h>
 +#include <stdlib.h>
 +#include <stdio.h>
 +#include <assert.h>
 +
 +static void *expected;
 +
 +void sigsegv(int sig, siginfo_t *info, void *vuc)
 +{
 +    ucontext_t *uc = vuc;
 +
 +    assert(info->si_addr == expected);
 +    uc->uc_mcontext.pc += 4;
 +}
 +
- /* Floating point data-processing (2 source)
++int main()
-  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
++{
-  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
++    struct sigaction sa = {
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
++        .sa_sigaction = sigsegv,
-         }
++        .sa_flags = SA_SIGINFO
-         handle_fp_2src_double(s, opcode, rd, rn, rm);
++    };
-         break;
++
-+    case 3:
++    void *page;
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
++    long ofs;
-+            unallocated_encoding(s);
++
-+            return;
++    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
-+        }
++        perror("sigaction");
-+        if (!fp_access_check(s)) {
++        return EXIT_FAILURE;
-+            return;
++    }
-+        }
++
-+        handle_fp_2src_half(s, opcode, rd, rn, rm);
++    page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
-+        break;
++    if (page == MAP_FAILED) {
-     default:
++        perror("mmap");
-         unallocated_encoding(s);
++        return EXIT_FAILURE;
-     }
++    }
 +
 +    ofs = 0x124;
 +    expected = page + ofs;
 +
 +    asm("ptrue p0.d, vl1\n\t"
 +        "dup z0.d, %0\n\t"
 +        "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"
 +        "dup z1.d, %1\n\t"
 +        "ldnt1h {z0.d}, p0/z, [z1.d, %0]"
 +        : : "r"(page), "r"(ofs) : "v0", "v1");
 +
 +    return EXIT_SUCCESS;
 +}
 diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/tcg/aarch64/Makefile.target
 +++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls
  EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls
  endif
 +endif
 +ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)
 +AARCH64_TESTS += test-826
 +test-826: CFLAGS+=-march=armv8.1-a+sve2
  endif
  TESTS += $(AARCH64_TESTS)
 diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/tcg/configure.sh
 +++ b/tests/tcg/configure.sh
@@ -XXX,XX +XXX,XX @@ for target in $target_list; do
                               -march=armv8.1-a+sve -o $TMPE $TMPC; then
                    echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak
                fi
 +              if do_compiler "$target_compiler" $target_compiler_cflags \
 +                             -march=armv8.1-a+sve2 -o $TMPE $TMPC; then
 +                  echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak
 +              fi
                if do_compiler "$target_compiler" $target_compiler_cflags \
                               -march=armv8.3-a -o $TMPE $TMPC; then
                    echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 05/16] target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
+[PULL 02/21] target/arm: Fix pauth_check_trap vs SEL2
 From: Richard Henderson <richard.henderson@linaro.org>
-No sense in emitting code after the exception.
+When arm_is_el2_enabled was introduced, we missed
 updating pauth_check_trap.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788
+Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180512003217.9105-3-richard.henderson@linaro.org
+Message-id: 20220315021205.342768-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 2 +-
+ target/arm/pauth_helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/pauth_helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/pauth_helper.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
-         default:
-             /* all other sf/type/rmode combinations are invalid */
+ static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)
-             unallocated_encoding(s);
+ {
--            break;
+-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-+            return;
++    if (el < 2 && arm_is_el2_enabled(env)) {
-         }
+         uint64_t hcr = arm_hcr_el2_eff(env);
+         bool trap = !(hcr & HCR_API);
-         if (!fp_access_check(s)) {
+         if (el == 0) {
 --
-.17.0
+.25.1

-New patch
+[PULL 03/21] target/arm: Fix handling of LPAE block descriptors
+LPAE descriptors come in three forms:
+ * table descriptors, giving the address of the next level page table
+ * page descriptors, which occur only at level 3 and describe the
+   mapping of one page (which might be 4K, 16K or 64K)
+ * block descriptors, which occur at higher page table levels, and
+   describe the mapping of huge pages
+QEMU's page-table-walk code treats block and page entries
+identically, simply ORing in a number of bits from the input virtual
+address that depends on the level of the page table that we stopped
+at; we depend on the previous masking of descaddr with descaddrmask
+to have already cleared out the low bits of the descriptor word.
+This is not quite right: the address field in a block descriptor is
+smaller, and so there are bits which are valid address bits in a page
+descriptor or a table descriptor but which are not supposed to be
+part of the address in a block descriptor, and descaddrmask does not
+clear them.  We previously mostly got away with this because those
+descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)
+block descriptor bit 16 is defined to be the nT bit.  No emulated
+QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might
+see it when using KVM or hvf.
+Explicitly zero out all the descaddr bits we're about to OR vaddr
+bits into.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 10 ++++++++--
+file changed, 8 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+             indexmask = indexmask_grainsize;
+             continue;
+         }
+-        /* Block entry at level 1 or 2, or page entry at level 3.
++        /*
++         * Block entry at level 1 or 2, or page entry at level 3.
+          * These are basically the same thing, although the number
+-         * of bits we pull in from the vaddr varies.
++         * of bits we pull in from the vaddr varies. Note that although
++         * descaddrmask masks enough of the low bits of the descriptor
++         * to give a correct page or table address, the address field
++         * in a block descriptor is smaller; so we need to explicitly
++         * clear the lower bits here before ORing in the low vaddr bits.
+          */
+         page_size = (1ULL << ((stride * (4 - level)) + 3));
++        descaddr &= ~(page_size - 1);
+         descaddr |= (address & (page_size - 1));
+         /* Extract attributes from the descriptor */
+         attrs = extract64(descriptor, 2, 10)
+--
+.25.1

-[Qemu-devel] [PULL 08/16] target/arm: Introduce and use read_fp_hreg
+[PULL 04/21] hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
-From: Richard Henderson <richard.henderson@linaro.org>
+In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its
 own class struct, but forgot to update the TypeInfo::class_size
 accordingly.  This meant that not enough memory was allocated for the
 class struct, and the initialization of xcdc->read in the class init
 function wrote off the end of the memory. Add the missing line.
-Cc: qemu-stable@nongnu.org
+Found by running 'check-qtest-aarch64' with a clang
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+address-sanitizer build, which complains:
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8
-Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
+WRITE of size 8 at 0x61000000ab00 thread T0
     #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16
     #1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9
     #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
     #3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)
     #4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5
     #5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5
     #6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24
     #7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35
     #8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5
     #9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5
     #10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
     #11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)
 x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)
 allocated by thread T0 here:
     #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)
     #1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)
     #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
 Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 30 ++++++++++++++----------------
+ hw/dma/xlnx_csu_dma.c | 1 +
-file changed, 14 insertions(+), 16 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/dma/xlnx_csu_dma.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/dma/xlnx_csu_dma.c
-@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {
-     return v;
+     .parent        = TYPE_SYS_BUS_DEVICE,
- }
+     .instance_size = sizeof(XlnxCSUDMA),
+     .class_init    = xlnx_csu_dma_class_init,
-+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
++    .class_size    = sizeof(XlnxCSUDMAClass),
-+{
+     .instance_init = xlnx_csu_dma_init,
-+    TCGv_i32 v = tcg_temp_new_i32();
+     .interfaces = (InterfaceInfo[]) {
-+
+         { TYPE_STREAM_SINK },
 +    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
 +    return v;
 +}
 +
  /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
   * If SVE is not enabled, then there are only 128 bits in the vector.
   */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
  static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
  {
      TCGv_ptr fpst = NULL;
 -    TCGv_i32 tcg_op = tcg_temp_new_i32();
 +    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
      TCGv_i32 tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
      switch (opcode) {
      case 0x0: /* FMOV */
          tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
          tcg_temp_free_i64(tcg_op2);
          tcg_temp_free_i64(tcg_res);
      } else {
 -        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
 -        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
 +        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
          TCGv_i64 tcg_res = tcg_temp_new_i64();
 -        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
          gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
          gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
      fpst = get_fpstatus_ptr(true);
 -    tcg_op1 = tcg_temp_new_i32();
 -    tcg_op2 = tcg_temp_new_i32();
 +    tcg_op1 = read_fp_hreg(s, rn);
 +    tcg_op2 = read_fp_hreg(s, rm);
      tcg_res = tcg_temp_new_i32();
 -    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
 -    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
 -
      switch (fpopcode) {
      case 0x03: /* FMULX */
          gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
      }
      if (is_scalar) {
 -        TCGv_i32 tcg_op = tcg_temp_new_i32();
 +        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
          TCGv_i32 tcg_res = tcg_temp_new_i32();
 -        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
 -
          switch (fpop) {
          case 0x1a: /* FCVTNS */
          case 0x1b: /* FCVTMS */
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 16/16] tcg: Optionally log FPU state in TCG -d cpu logging
+[PULL 05/21] hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
-Usually the logging of the CPU state produced by -d cpu is sufficient
+In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().
-to diagnose problems, but sometimes you want to see the state of
+Use g_autofree so we free it rather than leaking it.
-the floating point registers as well. We don't want to enable that
-by default as it adds a lot of extra data to the log; instead,
+(Detected with the clang leak sanitizer.)
 allow it to be optionally enabled via -d fpu.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org
 ---
- include/qemu/log.h   | 1 +
+ hw/misc/npcm7xx_clk.c | 4 ++--
- accel/tcg/cpu-exec.c | 9 ++++++---
+file changed, 2 insertions(+), 2 deletions(-)
  util/log.c           | 2 ++
 files changed, 9 insertions(+), 3 deletions(-)
-diff --git a/include/qemu/log.h b/include/qemu/log.h
+diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/log.h
+--- a/hw/misc/npcm7xx_clk.c
-+++ b/include/qemu/log.h
++++ b/hw/misc/npcm7xx_clk.c
-@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)
- #define CPU_LOG_PAGE       (1 << 14)
+     NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
- /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
- #define CPU_LOG_TB_OP_IND  (1 << 16)
+     for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
-+#define CPU_LOG_TB_FPU     (1 << 17)
+-        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
+-                g_strdup_printf("clock-in[%d]", i),
- /* Lock output for a series of related logs.  Since this is not needed
++        g_autofree char *s = g_strdup_printf("clock-in[%d]", i);
-  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
++        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
+                 npcm7xx_clk_update_sel_cb, sel, ClockUpdate);
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/cpu-exec.c
 +++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
      if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
          && qemu_log_in_addr_range(itb->pc)) {
          qemu_log_lock();
 +        int flags = 0;
 +        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
 +            flags |= CPU_DUMP_FPU;
 +        }
  #if defined(TARGET_I386)
 -        log_cpu_state(cpu, CPU_DUMP_CCOP);
 -#else
 -        log_cpu_state(cpu, 0);
 +        flags |= CPU_DUMP_CCOP;
  #endif
 +        log_cpu_state(cpu, flags);
          qemu_log_unlock();
      }
- #endif /* DEBUG_DISAS */
+     sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
 diff --git a/util/log.c b/util/log.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/log.c
 +++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
        "show trace before each executed TB (lots of logs)" },
      { CPU_LOG_TB_CPU, "cpu",
        "show CPU registers before entering a TB (lots of logs)" },
 +    { CPU_LOG_TB_FPU, "fpu",
 +      "include FPU registers in the 'cpu' logging" },
      { CPU_LOG_MMU, "mmu",
        "log MMU-related activities" },
      { CPU_LOG_PCALL, "pcall",
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 02/16] fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
+[PULL 06/21] nsis installer: List emulators in alphabetical order
-In float-to-integer conversion, if the floating point input
+We currently list the emulators in the Windows installer's dialog
-converts exactly to the largest or smallest integer that
+in an essentially random order (it's whatever glob.glob() returns
-fits in to the result type, this is not an overflow.
+them to, which is filesystem-implementation-dependent). Add a
-In this situation we were producing the correct result value,
+call to sorted() so they appear in alphabetical order.
 but were incorrectly setting the Invalid flag.
 For example for Arm A64, "FCVTAS w0, d0" on an input of
 x41dfffffffc00000 should produce 0x7fffffff and set no flags.
-Fix the boundary case to take the right half of the if()
-statements.
-This fixes a regression from 2.11 introduced by the softfloat
-refactoring.
-Cc: qemu-stable@nongnu.org
-Fixes: ab52f973a50
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
+Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Reviewed-by: John Snow <jsnow@redhat.com>
 Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org
 ---
- fpu/softfloat.c | 4 ++--
+ scripts/nsis.py | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/scripts/nsis.py b/scripts/nsis.py
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/scripts/nsis.py
-+++ b/fpu/softfloat.c
++++ b/scripts/nsis.py
-@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
+@@ -XXX,XX +XXX,XX @@ def main():
-             r = UINT64_MAX;
+         with open(
-         }
+             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
-         if (p.sign) {
+         ) as nsh:
--            if (r < -(uint64_t) min) {
+-            for exe in glob.glob(
-+            if (r <= -(uint64_t) min) {
++            for exe in sorted(glob.glob(
-                 return -r;
+                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
-             } else {
+-            ):
-                 s->float_exception_flags = orig_flags | float_flag_invalid;
++            )):
-                 return min;
+                 exe = os.path.basename(exe)
-             }
+                 arch = exe[12:-4]
-         } else {
+                 nsh.write(
 -            if (r < max) {
 +            if (r <= max) {
                  return r;
              } else {
                  s->float_exception_flags = orig_flags | float_flag_invalid;
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 15/16] sdcard: Correct CRC16 offset in sd_function_switch()
+[PULL 07/21] nsis installer: Suppress "ANSI targets are deprecated" warning
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+When we build our Windows installer, it emits the warning:
-Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":
+   warning 7998: ANSI targets are deprecated
-  The block length is predefined to 512 bits
+Fix this by making our installer a Unicode installer instead.  These
 won't work on Win95/98/ME, but we already do not support those.
-and "4.10.2 SD Status":
+See
 https://nsis.sourceforge.io/Docs/Chapter4.html#aunicodetarget
 for the documentation of the Unicode directive.
-  The SD Status contains status bits that are related to the SD Memory Card
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-  proprietary features and may be used for future application-specific usage.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-  The size of the SD Status is one data block of 512 bit. The content of this
+Reviewed-by: Stefan Weil <sw@weilnetz.de>
-  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.
+Message-id: 20220305105743.2384766-3-peter.maydell@linaro.org
 ---
  qemu.nsi | 3 +++
 file changed, 3 insertions(+)
-Thus the 16-bit CRC goes at offset 64.
+diff --git a/qemu.nsi b/qemu.nsi
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180509060104.4458-3-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/sd/sd.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/sd/sd.c b/hw/sd/sd.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/qemu.nsi
-+++ b/hw/sd/sd.c
++++ b/qemu.nsi
-@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
+@@ -XXX,XX +XXX,XX @@
-         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
+ !define OUTFILE "qemu-setup.exe"
-     }
+ !endif
-     memset(&sd->data[17], 0, 47);
--    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
++; Build a unicode installer
-+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
++Unicode true
- }
++
+ ; Use maximum compression.
- static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
+ SetCompressor /SOLID lzma
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 14/16] target/arm: Fix sqrt_f16 exception raising
+[PULL 08/21] nsis installer: Fix mouse-over descriptions for emulators
-From: Alex Bennée <alex.bennee@linaro.org>
+We use the nsis.py script to write out an installer script Section
 for each emulator executable, so the exact set of Sections depends on
 which executables were built.  However the part of qemu.nsi which
 specifies mouse-over descriptions for each Section still has a
 hard-coded and very outdated list (with just i386 and alpha).  This
 causes two problems.  Firstly, if you build the installer for a
 configuration where you didn't build the i386 binaries you get
 warnings like this:
   warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)
   warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)
 (this happens in our gitlab CI jobs, for instance).
 Secondly, most of the emulators in the generated installer don't have
 any mouseover text.
-We are meant to explicitly pass fpst, not cpu_env.
+Make nsis.py generate a second output file which has the necessary
 MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can
 include that at the right point in qemu.nsi to set the mouse-over
 text.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: John Snow <jsnow@redhat.com>
+Message-id: 20220305105743.2384766-4-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 3 ++-
+ qemu.nsi        |  5 +----
-file changed, 2 insertions(+), 1 deletion(-)
+ scripts/nsis.py | 13 ++++++++++++-
 files changed, 13 insertions(+), 5 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/qemu.nsi b/qemu.nsi
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/qemu.nsi
-+++ b/target/arm/translate-a64.c
++++ b/qemu.nsi
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
+@@ -XXX,XX +XXX,XX @@ SectionEnd
-         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
+ ; Descriptions (mouse-over).
-         break;
+ !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
-     case 0x3: /* FSQRT */
+     !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
--        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
-+        fpst = get_fpstatus_ptr(true);
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
-+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
-         break;
+-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
-     case 0x8: /* FRINTN */
++!include "${BINDIR}\system-mui-text.nsh"
-     case 0x9: /* FRINTP */
+     !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
  !ifdef DLLDIR
      !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
 diff --git a/scripts/nsis.py b/scripts/nsis.py
 index XXXXXXX..XXXXXXX 100644
 --- a/scripts/nsis.py
 +++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
          subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])
          with open(
              os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
 -        ) as nsh:
 +        ) as nsh, open(
 +            os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"
 +        ) as muinsh:
              for exe in sorted(glob.glob(
                  os.path.join(destdir + args.prefix, "qemu-system-*.exe")
              )):
@@ -XXX,XX +XXX,XX @@ def main():
                          arch, exe
                      )
                  )
 +                if arch.endswith('w'):
 +                    desc = arch[:-1] + " emulation (GUI)."
 +                else:
 +                    desc = arch + " emulation."
 +
 +                muinsh.write(
 +                    """
 +                !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"
 +                """.format(arch, desc))
          for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):
              signcode(exe)
 --
-.17.0
+.25.1

-New patch
+[PULL 09/21] hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
+From: Eric Auger <eric.auger@redhat.com>
+CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3
+specific files. So let's rename it into CONFIG_ARM_GICV3_TCG
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20220308182452.223473-2-eric.auger@redhat.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/intc/Kconfig     | 2 +-
+ hw/intc/meson.build | 4 ++--
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/Kconfig
++++ b/hw/intc/Kconfig
+@@ -XXX,XX +XXX,XX @@ config APIC
+     select MSI_NONBROKEN
+     select I8259
+-config ARM_GIC_TCG
++config ARM_GICV3_TCG
+     bool
+     default y
+     depends on ARM_GIC && TCG
+diff --git a/hw/intc/meson.build b/hw/intc/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/meson.build
++++ b/hw/intc/meson.build
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
+   'arm_gicv3_common.c',
+   'arm_gicv3_its_common.c',
+ ))
+-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
++softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(
+   'arm_gicv3.c',
+   'arm_gicv3_dist.c',
+   'arm_gicv3_its.c',
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
+ specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
+ specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
+ specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
+-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
++specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))
+ specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
+ specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
+ specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
+--
+.25.1

-[Qemu-devel] [PULL 04/16] target/arm: Implement FMOV (general) for fp16
+[PULL 10/21] hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Eric Auger <eric.auger@redhat.com>
-Adding the fp16 moves to/from general registers.
+In TCG mode, if gic-version=max we always select GICv3 even if
 CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.
 This also brings the benefit of fixing qos tests errors for tests
 using gic-version=max with CONFIG_ARM_GICV3_TCG unset.
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Andrew Jones <drjones@redhat.com>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20220308182452.223473-3-eric.auger@redhat.com
 Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 21 +++++++++++++++++++++
+ hw/arm/virt.c | 7 ++++++-
-file changed, 21 insertions(+)
+file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/arm/virt.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
+@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
-             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
+         vms->gic_version = VIRT_GIC_VERSION_2;
-             clear_vec_high(s, true, rd);
+         break;
-             break;
+     case VIRT_GIC_VERSION_MAX:
-+        case 3:
+-        vms->gic_version = VIRT_GIC_VERSION_3;
-+            /* 16 bit */
++        if (module_object_class_by_name("arm-gicv3")) {
-+            tmp = tcg_temp_new_i64();
++            /* CONFIG_ARM_GICV3_TCG was set */
-+            tcg_gen_ext16u_i64(tmp, tcg_rn);
++            vms->gic_version = VIRT_GIC_VERSION_3;
-+            write_fp_dreg(s, rd, tmp);
++        } else {
-+            tcg_temp_free_i64(tmp);
++            vms->gic_version = VIRT_GIC_VERSION_2;
-+            break;
++        }
-+        default:
+         break;
-+            g_assert_not_reached();
+     case VIRT_GIC_VERSION_HOST:
-         }
+         error_report("gic-version=host requires KVM");
      } else {
          TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
              /* 64 bits from top half */
              tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
              break;
 +        case 3:
 +            /* 16 bit */
 +            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          case 0xa: /* 64 bit */
          case 0xd: /* 64 bit to top half of quad */
              break;
 +        case 0x6: /* 16-bit float, 32-bit int */
 +        case 0xe: /* 16-bit float, 64-bit int */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
          default:
              /* all other sf/type/rmode combinations are invalid */
              unallocated_encoding(s);
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 03/16] target/arm: Fix fp_status_f16 tininess before rounding
+[PULL 11/21] target/arm: Log M-profile vector table accesses
-In commit d81ce0ef2c4f105 we added an extra float_status field
+Currently the CPU_LOG_INT logging misses some useful information
-fp_status_fp16 for Arm, but forgot to initialize it correctly
+about loads from the vector table.  Add logging where we load vector
-by setting it to float_tininess_before_rounding. This currently
+table entries.  This is particularly helpful for cases where the user
-will only cause problems for the new V8_FP16 feature, since the
+has accidentally not put a vector table in their image at all, which
-float-to-float conversion code doesn't use it yet. The effect
+can result in confusing guest crashes at startup.
 would be that we failed to set the Underflow IEEE exception flag
 in all the cases where we should.
-Add the missing initialization.
+Here's an example of the new logging for a case where
 the vector table contains garbage:
-Fixes: d81ce0ef2c4f105
+Loaded reset SP 0x0 PC 0x0 from vector table
-Cc: qemu-stable@nongnu.org
+Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table
 Taking exception 3 [Prefetch Abort] on CPU 0
 ...with CFSR.IACCVIOL
 ...BusFault with BFSR.STKERR
 ...taking pending nonsecure exception 3
 ...loading from element 3 of non-secure vector table at 0xc
 ...loaded new PC 0x20000558
 ----------------
 IN:
 x20000558:  08000079  stmdaeq  r0, {r0, r3, r4, r5, r6}
 (The double reset logging is the result of our long-standing
 "CPUs all get reset twice" weirdness; it looks a bit ugly
 but it'll go away if we ever fix that :-))
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220315204306.2797684-2-peter.maydell@linaro.org
 Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
 ---
- target/arm/cpu.c | 2 ++
+ target/arm/cpu.c      | 5 +++++
-file changed, 2 insertions(+)
+ target/arm/m_helper.c | 5 +++++
 files changed, 10 insertions(+)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+@@ -XXX,XX +XXX,XX @@
-                               &env->vfp.fp_status);
+ #include "qemu/osdep.h"
-     set_float_detect_tininess(float_tininess_before_rounding,
+ #include "qemu/qemu-print.h"
-                               &env->vfp.standard_fp_status);
+ #include "qemu/timer.h"
-+    set_float_detect_tininess(float_tininess_before_rounding,
++#include "qemu/log.h"
-+                              &env->vfp.fp_status_f16);
+ #include "qemu-common.h"
- #ifndef CONFIG_USER_ONLY
+ #include "target/arm/idau.h"
-     if (kvm_enabled()) {
+ #include "qemu/module.h"
-         kvm_arm_reset_vcpu(cpu);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
              initial_pc = ldl_phys(s->as, vecbase + 4);
          }
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "Loaded reset SP 0x%x PC 0x%x from vector table\n",
 +                      initial_msp, initial_pc);
 +
          env->regs[13] = initial_msp & 0xFFFFFFFC;
          env->regs[15] = initial_pc & ~1;
          env->thumb = initial_pc & 1;
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
      ARMMMUIdx mmu_idx;
      bool exc_secure;
 +    qemu_log_mask(CPU_LOG_INT,
 +                  "...loading from element %d of %s vector table at 0x%x\n",
 +                  exc, targets_secure ? "secure" : "non-secure", addr);
 +
      mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
      /*
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
          goto load_fail;
      }
      *pvec = vector_entry;
 +    qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
      return true;
  load_fail:
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 13/16] target/arm: Implement FMOV (immediate) for fp16
+[PULL 12/21] target/arm: Log fault address for M-profile faults
-From: Alex Bennée <alex.bennee@linaro.org>
+For M-profile, the fault address is not always exposed to the guest
 in a fault register (for instance the BFAR bus fault address register
 is only updated for bus faults on data accesses, not instruction
 accesses).  Currently we log the address only if we're putting it
 into a particular guest-visible register.  Since we always have it,
 log it generically, to make logs of i-side faults a bit clearer.
-All the hard work is already done by vfp_expand_imm, we just need to
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-make sure we pick up the correct size.
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org
 ---
  target/arm/m_helper.c | 6 ++++++
 file changed, 6 insertions(+)
-Cc: qemu-stable@nongnu.org
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Tested-by: Alex Bennée <alex.bennee@linaro.org>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
 [rth: Merge unallocated_encoding check with TCGMemOp conversion.]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 20 +++++++++++++++++---
 file changed, 17 insertions(+), 3 deletions(-)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/m_helper.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
- {
+          * Note that for M profile we don't have a guest facing FSR, but
-     int rd = extract32(insn, 0, 5);
+          * the env->exception.fsr will be populated by the code that
-     int imm8 = extract32(insn, 13, 8);
+          * raises the fault, in the A profile short-descriptor format.
--    int is_double = extract32(insn, 22, 2);
++         *
-+    int type = extract32(insn, 22, 2);
++         * Log the exception.vaddress now regardless of subtype, because
-     uint64_t imm;
++         * logging below only logs it when it goes into a guest visible
-     TCGv_i64 tcg_res;
++         * register.
-+    TCGMemOp sz;
+          */
++        qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
--    if (is_double > 1) {
++                      (uint32_t)env->exception.vaddress);
-+    switch (type) {
+         switch (env->exception.fsr & 0xf) {
-+    case 0:
+         case M_FAKE_FSR_NSC_EXEC:
-+        sz = MO_32;
+             /*
 +        break;
 +    case 1:
 +        sz = MO_64;
 +        break;
 +    case 3:
 +        sz = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
          return;
      }
 -    imm = vfp_expand_imm(MO_32 + is_double, imm8);
 +    imm = vfp_expand_imm(sz, imm8);
      tcg_res = tcg_const_i64(imm);
      write_fp_dreg(s, rd, tcg_res);
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 12/16] target/arm: Implement FCSEL for fp16
+[PULL 13/21] hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
-From: Alex Bennée <alex.bennee@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-These were missed out from the rest of the half-precision work.
+Add an unimplemented SERDES (Serializer/Deserializer) area.
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
 [rth: Fix erroneous check vs type]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
+ include/hw/arm/xlnx-zynqmp.h | 2 +-
-file changed, 25 insertions(+), 6 deletions(-)
+ hw/arm/xlnx-zynqmp.c         | 5 +++++
 files changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/target/arm/translate-a64.c
++++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
-     unsigned int mos, type, rm, cond, rn, rd;
+ /*
-     TCGv_i64 t_true, t_false, t_zero;
+  * Unimplemented mmio regions needed to boot some images.
-     DisasCompare64 c;
+  */
-+    TCGMemOp sz;
+-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
++#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
-     mos = extract32(insn, 29, 3);
--    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+ struct XlnxZynqMPState {
-+    type = extract32(insn, 22, 2);
+     /*< private >*/
-     rm = extract32(insn, 16, 5);
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-     cond = extract32(insn, 12, 4);
+index XXXXXXX..XXXXXXX 100644
-     rn = extract32(insn, 5, 5);
+--- a/hw/arm/xlnx-zynqmp.c
-     rd = extract32(insn, 0, 5);
++++ b/hw/arm/xlnx-zynqmp.c
+@@ -XXX,XX +XXX,XX @@
--    if (mos || type > 1) {
+ #define QSPI_DMA_ADDR       0xff0f0800
-+    if (mos) {
+ #define NUM_QSPI_IRQ_LINES  2
-+        unallocated_encoding(s);
-+        return;
++/* Serializer/Deserializer.  */
-+    }
++#define SERDES_ADDR         0xfd400000
 +#define SERDES_SIZE         0x20000
 +
-+    switch (type) {
+ #define DP_ADDR             0xfd4a0000
-+    case 0:
+ #define DP_IRQ              113
-+        sz = MO_32;
-+        break;
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
-+    case 1:
+         hwaddr size;
-+        sz = MO_64;
+     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
-+        break;
+         { .name = "apu", APU_ADDR, APU_SIZE },
-+    case 3:
++        { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
-+        sz = MO_16;
+     };
-+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+     unsigned int nr;
-+            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
          return;
      }
 -    /* Zero extend sreg inputs to 64 bits now.  */
 +    /* Zero extend sreg & hreg inputs to 64 bits now.  */
      t_true = tcg_temp_new_i64();
      t_false = tcg_temp_new_i64();
 -    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
 -    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
 +    read_vec_element(s, t_true, rn, 0, sz);
 +    read_vec_element(s, t_false, rm, 0, sz);
      a64_test_cc(&c, cond);
      t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
      tcg_temp_free_i64(t_false);
      a64_free_cc(&c);
 -    /* Note that sregs write back zeros to the high bits,
 +    /* Note that sregs & hregs write back zeros to the high bits,
         and we've already done the zero-extension.  */
      write_fp_dreg(s, rd, t_true);
      tcg_temp_free_i64(t_true);
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 06/16] target/arm: Implement FCVT (scalar, integer) for fp16
+[PULL 14/21] target/arm: Make rvbar settable after realize
-From: Richard Henderson <richard.henderson@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Cc: qemu-stable@nongnu.org
+Make the rvbar property settable after realize. This is done
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+in preparation to model the ZynqMP's runtime configurable rvbar.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
+Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h        |  6 +++
+ target/arm/cpu.h    |  3 ++-
- target/arm/helper.c        | 38 ++++++++++++++-
+ target/arm/cpu.c    | 12 +++++++-----
- target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
+ target/arm/helper.c | 10 +++++++---
-files changed, 122 insertions(+), 18 deletions(-)
+files changed, 16 insertions(+), 9 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/target/arm/cpu.h
-+++ b/target/arm/helper.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
+             uint64_t vbar_el[4];
- DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
+         };
- DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+         uint32_t mvbar; /* (monitor) vector base address register */
-+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
++        uint64_t rvbar; /* rvbar sampled from rvbar property at reset */
-+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+         struct { /* FCSE PID. */
-+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+             uint32_t fcseidr_ns;
-+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
+             uint32_t fcseidr_s;
- DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
- DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
- DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
+     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
+     uint32_t dcz_blocksize;
- DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
+-    uint64_t rvbar;
- DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
++    uint64_t rvbar_prop; /* Property/input signals.  */
- DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
-+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+     /* Configurable aspects of GIC cpu interface (which is part of the CPU) */
-+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
+     int gic_num_lrs; /* number of list registers */
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
- DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
+index XXXXXXX..XXXXXXX 100644
- DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
+--- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
          } else {
              env->pstate = PSTATE_MODE_EL1h;
          }
 -        env->pc = cpu->rvbar;
 +
 +        /* Sample rvbar at reset.  */
 +        env->cp15.rvbar = cpu->rvbar_prop;
 +        env->pc = env->cp15.rvbar;
  #endif
      } else {
  #if defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_cbar_property =
  static Property arm_cpu_reset_hivecs_property =
              DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
 -static Property arm_cpu_rvbar_property =
 -            DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);
 -
  #ifndef CONFIG_USER_ONLY
  static Property arm_cpu_has_el2_property =
              DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
      }
      if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 -        qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);
 +        object_property_add_uint64_ptr(obj, "rvbar",
 +                                       &cpu->rvbar_prop,
 +                                       OBJ_PROP_FLAG_READWRITE);
      }
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
- #undef VFP_CONV_FIX_A64
+             ARMCPRegInfo rvbar = {
+                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
- /* Conversion to/from f16 can overflow to infinity before/after scaling.
+                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
-- * Therefore we convert to f64 (which does not round), scale,
+-                .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
-- * and then convert f64 to f16 (which may round).
++                .access = PL1_R,
-+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
++                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
-+ * vice versa for conversion to integer.
+             };
-+ *
+             define_one_arm_cp_reg(cpu, &rvbar);
 + * For 16- and 32-bit integers, the conversion to f64 never rounds.
 + * For 64-bit integers, any integer that would cause rounding will also
 + * overflow to f16 infinity, so there is no double rounding problem.
   */
  static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
      return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
  }
 +float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
 +}
 +
 +float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
 +{
 +    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
 +}
 +
  static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
  {
      if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
      return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
  }
 +uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
 +uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
 +{
 +    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
 +}
 +
  /* Set the current fp rounding mode and return the old one.
   * The argument is a softfloat float_round_ value.
   */
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                             bool itof, int rmode, int scale, int sf, int type)
  {
      bool is_signed = !(opcode & 1);
 -    bool is_double = type;
      TCGv_ptr tcg_fpstatus;
 -    TCGv_i32 tcg_shift;
 +    TCGv_i32 tcg_shift, tcg_single;
 +    TCGv_i64 tcg_double;
 -    tcg_fpstatus = get_fpstatus_ptr(false);
 +    tcg_fpstatus = get_fpstatus_ptr(type == 3);
      tcg_shift = tcg_const_i32(64 - scale);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              tcg_int = tcg_extend;
          }
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
--        if (is_double) {
+             ARMCPRegInfo rvbar = {
--            TCGv_i64 tcg_double = tcg_temp_new_i64();
+                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
-+        switch (type) {
+                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
-+        case 1: /* float64 */
+-                .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
-+            tcg_double = tcg_temp_new_i64();
++                .access = PL2_R,
-             if (is_signed) {
++                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
-                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
+             };
-                                      tcg_shift, tcg_fpstatus);
+             define_one_arm_cp_reg(cpu, &rvbar);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_dreg(s, rd, tcg_double);
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = tcg_temp_new_i32();
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = tcg_temp_new_i32();
              if (is_signed) {
                  gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                       tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
              }
              write_fp_sreg(s, rd, tcg_single);
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = tcg_temp_new_i32();
 +            if (is_signed) {
 +                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            } else {
 +                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
 +                                     tcg_shift, tcg_fpstatus);
 +            }
 +            write_fp_sreg(s, rd, tcg_single);
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
-     } else {
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         TCGv_i64 tcg_int = cpu_reg(s, rd);
+         ARMCPRegInfo el3_regs[] = {
-@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
+             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
-         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
+-              .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
++              .access = PL3_R,
--        if (is_double) {
++              .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
--            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
++            },
-+        switch (type) {
+             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
-+        case 1: /* float64 */
+               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
-+            tcg_double = read_fp_dreg(s, rn);
+               .access = PL3_RW,
              if (is_signed) {
                  if (!sf) {
                      gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                           tcg_shift, tcg_fpstatus);
                  }
              }
 +            if (!sf) {
 +                tcg_gen_ext32u_i64(tcg_int, tcg_int);
 +            }
              tcg_temp_free_i64(tcg_double);
 -        } else {
 -            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
 +            break;
 +
 +        case 0: /* float32 */
 +            tcg_single = read_fp_sreg(s, rn);
              if (sf) {
                  if (is_signed) {
                      gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                  tcg_temp_free_i32(tcg_dest);
              }
              tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        case 3: /* float16 */
 +            tcg_single = read_fp_sreg(s, rn);
 +            if (sf) {
 +                if (is_signed) {
 +                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_touqh(tcg_int, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +            } else {
 +                TCGv_i32 tcg_dest = tcg_temp_new_i32();
 +                if (is_signed) {
 +                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                } else {
 +                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
 +                                         tcg_shift, tcg_fpstatus);
 +                }
 +                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
 +                tcg_temp_free_i32(tcg_dest);
 +            }
 +            tcg_temp_free_i32(tcg_single);
 +            break;
 +
 +        default:
 +            g_assert_not_reached();
          }
          gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
          tcg_temp_free_i32(tcg_rmode);
 -
 -        if (!sf) {
 -            tcg_gen_ext32u_i64(tcg_int, tcg_int);
 -        }
      }
      tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
          /* actual FP conversions */
          bool itof = extract32(opcode, 1, 1);
 -        if (type > 1 || (rmode != 0 && opcode > 1)) {
 +        if (rmode != 0 && opcode > 1) {
 +            unallocated_encoding(s);
 +            return;
 +        }
 +        switch (type) {
 +        case 0: /* float32 */
 +        case 1: /* float64 */
 +            break;
 +        case 3: /* float16 */
 +            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +                break;
 +            }
 +            /* fallthru */
 +        default:
              unallocated_encoding(s);
              return;
          }
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 07/16] target/arm: Implement FCVT (scalar, fixed-point) for fp16
+[PULL 15/21] hw/misc: Add a model of the Xilinx ZynqMP CRF
-From: Richard Henderson <richard.henderson@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Cc: qemu-stable@nongnu.org
+Add a model of the Xilinx ZynqMP CRF. At the moment this
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+is mostly a stub model.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Message-id: 20220316164645.2303510-4-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 17 +++++++++++++++--
+ include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++
-file changed, 15 insertions(+), 2 deletions(-)
+ hw/misc/xlnx-zynqmp-crf.c         | 266 ++++++++++++++++++++++++++++++
  hw/misc/meson.build               |   1 +
 files changed, 478 insertions(+)
  create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
  create mode 100644 hw/misc/xlnx-zynqmp-crf.c
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/hw/misc/xlnx-zynqmp-crf.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU model of the CRF - Clock Reset FPD.
 + *
 + * Copyright (c) 2022 Xilinx Inc.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + */
 +#ifndef HW_MISC_XLNX_ZYNQMP_CRF_H
 +#define HW_MISC_XLNX_ZYNQMP_CRF_H
 +
 +#include "hw/sysbus.h"
 +#include "hw/register.h"
 +
 +#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"
 +OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPCRF, XLNX_ZYNQMP_CRF)
 +
 +REG32(ERR_CTRL, 0x0)
 +    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
 +REG32(IR_STATUS, 0x4)
 +    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_MASK, 0x8)
 +    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_ENABLE, 0xc)
 +    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
 +REG32(IR_DISABLE, 0x10)
 +    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
 +REG32(CRF_WPROT, 0x1c)
 +    FIELD(CRF_WPROT, ACTIVE, 0, 1)
 +REG32(APLL_CTRL, 0x20)
 +    FIELD(APLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(APLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(APLL_CTRL, CLKOUTDIV, 17, 1)
 +    FIELD(APLL_CTRL, DIV2, 16, 1)
 +    FIELD(APLL_CTRL, FBDIV, 8, 7)
 +    FIELD(APLL_CTRL, BYPASS, 3, 1)
 +    FIELD(APLL_CTRL, RESET, 0, 1)
 +REG32(APLL_CFG, 0x24)
 +    FIELD(APLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(APLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(APLL_CFG, LFHF, 10, 2)
 +    FIELD(APLL_CFG, CP, 5, 4)
 +    FIELD(APLL_CFG, RES, 0, 4)
 +REG32(APLL_FRAC_CFG, 0x28)
 +    FIELD(APLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(APLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(APLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(APLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(APLL_FRAC_CFG, DATA, 0, 16)
 +REG32(DPLL_CTRL, 0x2c)
 +    FIELD(DPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(DPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(DPLL_CTRL, CLKOUTDIV, 17, 1)
 +    FIELD(DPLL_CTRL, DIV2, 16, 1)
 +    FIELD(DPLL_CTRL, FBDIV, 8, 7)
 +    FIELD(DPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(DPLL_CTRL, RESET, 0, 1)
 +REG32(DPLL_CFG, 0x30)
 +    FIELD(DPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(DPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(DPLL_CFG, LFHF, 10, 2)
 +    FIELD(DPLL_CFG, CP, 5, 4)
 +    FIELD(DPLL_CFG, RES, 0, 4)
 +REG32(DPLL_FRAC_CFG, 0x34)
 +    FIELD(DPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(DPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(DPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(DPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(DPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(VPLL_CTRL, 0x38)
 +    FIELD(VPLL_CTRL, POST_SRC, 24, 3)
 +    FIELD(VPLL_CTRL, PRE_SRC, 20, 3)
 +    FIELD(VPLL_CTRL, CLKOUTDIV, 17, 1)
 +    FIELD(VPLL_CTRL, DIV2, 16, 1)
 +    FIELD(VPLL_CTRL, FBDIV, 8, 7)
 +    FIELD(VPLL_CTRL, BYPASS, 3, 1)
 +    FIELD(VPLL_CTRL, RESET, 0, 1)
 +REG32(VPLL_CFG, 0x3c)
 +    FIELD(VPLL_CFG, LOCK_DLY, 25, 7)
 +    FIELD(VPLL_CFG, LOCK_CNT, 13, 10)
 +    FIELD(VPLL_CFG, LFHF, 10, 2)
 +    FIELD(VPLL_CFG, CP, 5, 4)
 +    FIELD(VPLL_CFG, RES, 0, 4)
 +REG32(VPLL_FRAC_CFG, 0x40)
 +    FIELD(VPLL_FRAC_CFG, ENABLED, 31, 1)
 +    FIELD(VPLL_FRAC_CFG, SEED, 22, 3)
 +    FIELD(VPLL_FRAC_CFG, ALGRTHM, 19, 1)
 +    FIELD(VPLL_FRAC_CFG, ORDER, 18, 1)
 +    FIELD(VPLL_FRAC_CFG, DATA, 0, 16)
 +REG32(PLL_STATUS, 0x44)
 +    FIELD(PLL_STATUS, VPLL_STABLE, 5, 1)
 +    FIELD(PLL_STATUS, DPLL_STABLE, 4, 1)
 +    FIELD(PLL_STATUS, APLL_STABLE, 3, 1)
 +    FIELD(PLL_STATUS, VPLL_LOCK, 2, 1)
 +    FIELD(PLL_STATUS, DPLL_LOCK, 1, 1)
 +    FIELD(PLL_STATUS, APLL_LOCK, 0, 1)
 +REG32(APLL_TO_LPD_CTRL, 0x48)
 +    FIELD(APLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(DPLL_TO_LPD_CTRL, 0x4c)
 +    FIELD(DPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(VPLL_TO_LPD_CTRL, 0x50)
 +    FIELD(VPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
 +REG32(ACPU_CTRL, 0x60)
 +    FIELD(ACPU_CTRL, CLKACT_HALF, 25, 1)
 +    FIELD(ACPU_CTRL, CLKACT_FULL, 24, 1)
 +    FIELD(ACPU_CTRL, DIVISOR0, 8, 6)
 +    FIELD(ACPU_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TRACE_CTRL, 0x64)
 +    FIELD(DBG_TRACE_CTRL, CLKACT, 24, 1)
 +    FIELD(DBG_TRACE_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_TRACE_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_FPD_CTRL, 0x68)
 +    FIELD(DBG_FPD_CTRL, CLKACT, 24, 1)
 +    FIELD(DBG_FPD_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_FPD_CTRL, SRCSEL, 0, 3)
 +REG32(DP_VIDEO_REF_CTRL, 0x70)
 +    FIELD(DP_VIDEO_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_VIDEO_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_VIDEO_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_VIDEO_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DP_AUDIO_REF_CTRL, 0x74)
 +    FIELD(DP_AUDIO_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_AUDIO_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_AUDIO_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_AUDIO_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DP_STC_REF_CTRL, 0x7c)
 +    FIELD(DP_STC_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DP_STC_REF_CTRL, DIVISOR1, 16, 6)
 +    FIELD(DP_STC_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DP_STC_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DDR_CTRL, 0x80)
 +    FIELD(DDR_CTRL, CLKACT, 24, 1)
 +    FIELD(DDR_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DDR_CTRL, SRCSEL, 0, 3)
 +REG32(GPU_REF_CTRL, 0x84)
 +    FIELD(GPU_REF_CTRL, PP1_CLKACT, 26, 1)
 +    FIELD(GPU_REF_CTRL, PP0_CLKACT, 25, 1)
 +    FIELD(GPU_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(GPU_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(GPU_REF_CTRL, SRCSEL, 0, 3)
 +REG32(SATA_REF_CTRL, 0xa0)
 +    FIELD(SATA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(SATA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(SATA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(PCIE_REF_CTRL, 0xb4)
 +    FIELD(PCIE_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(PCIE_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(PCIE_REF_CTRL, SRCSEL, 0, 3)
 +REG32(GDMA_REF_CTRL, 0xb8)
 +    FIELD(GDMA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(GDMA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(GDMA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(DPDMA_REF_CTRL, 0xbc)
 +    FIELD(DPDMA_REF_CTRL, CLKACT, 24, 1)
 +    FIELD(DPDMA_REF_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DPDMA_REF_CTRL, SRCSEL, 0, 3)
 +REG32(TOPSW_MAIN_CTRL, 0xc0)
 +    FIELD(TOPSW_MAIN_CTRL, CLKACT, 24, 1)
 +    FIELD(TOPSW_MAIN_CTRL, DIVISOR0, 8, 6)
 +    FIELD(TOPSW_MAIN_CTRL, SRCSEL, 0, 3)
 +REG32(TOPSW_LSBUS_CTRL, 0xc4)
 +    FIELD(TOPSW_LSBUS_CTRL, CLKACT, 24, 1)
 +    FIELD(TOPSW_LSBUS_CTRL, DIVISOR0, 8, 6)
 +    FIELD(TOPSW_LSBUS_CTRL, SRCSEL, 0, 3)
 +REG32(DBG_TSTMP_CTRL, 0xf8)
 +    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 6)
 +    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
 +REG32(RST_FPD_TOP, 0x100)
 +    FIELD(RST_FPD_TOP, PCIE_CFG_RESET, 19, 1)
 +    FIELD(RST_FPD_TOP, PCIE_BRIDGE_RESET, 18, 1)
 +    FIELD(RST_FPD_TOP, PCIE_CTRL_RESET, 17, 1)
 +    FIELD(RST_FPD_TOP, DP_RESET, 16, 1)
 +    FIELD(RST_FPD_TOP, SWDT_RESET, 15, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM5_RESET, 12, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM4_RESET, 11, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM3_RESET, 10, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM2_RESET, 9, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM1_RESET, 8, 1)
 +    FIELD(RST_FPD_TOP, AFI_FM0_RESET, 7, 1)
 +    FIELD(RST_FPD_TOP, GDMA_RESET, 6, 1)
 +    FIELD(RST_FPD_TOP, GPU_PP1_RESET, 5, 1)
 +    FIELD(RST_FPD_TOP, GPU_PP0_RESET, 4, 1)
 +    FIELD(RST_FPD_TOP, GPU_RESET, 3, 1)
 +    FIELD(RST_FPD_TOP, GT_RESET, 2, 1)
 +    FIELD(RST_FPD_TOP, SATA_RESET, 1, 1)
 +REG32(RST_FPD_APU, 0x104)
 +    FIELD(RST_FPD_APU, ACPU3_PWRON_RESET, 13, 1)
 +    FIELD(RST_FPD_APU, ACPU2_PWRON_RESET, 12, 1)
 +    FIELD(RST_FPD_APU, ACPU1_PWRON_RESET, 11, 1)
 +    FIELD(RST_FPD_APU, ACPU0_PWRON_RESET, 10, 1)
 +    FIELD(RST_FPD_APU, APU_L2_RESET, 8, 1)
 +    FIELD(RST_FPD_APU, ACPU3_RESET, 3, 1)
 +    FIELD(RST_FPD_APU, ACPU2_RESET, 2, 1)
 +    FIELD(RST_FPD_APU, ACPU1_RESET, 1, 1)
 +    FIELD(RST_FPD_APU, ACPU0_RESET, 0, 1)
 +REG32(RST_DDR_SS, 0x108)
 +    FIELD(RST_DDR_SS, DDR_RESET, 3, 1)
 +    FIELD(RST_DDR_SS, APM_RESET, 2, 1)
 +
 +#define CRF_R_MAX (R_RST_DDR_SS + 1)
 +
 +struct XlnxZynqMPCRF {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +    qemu_irq irq_ir;
 +
 +    RegisterInfoArray *reg_array;
 +    uint32_t regs[CRF_R_MAX];
 +    RegisterInfo regs_info[CRF_R_MAX];
 +};
 +
 +#endif
 diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/xlnx-zynqmp-crf.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU model of the CRF - Clock Reset FPD.
 + *
 + * Copyright (c) 2022 Xilinx Inc.
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/sysbus.h"
 +#include "hw/register.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "migration/vmstate.h"
 +#include "hw/irq.h"
 +#include "hw/misc/xlnx-zynqmp-crf.h"
 +#include "target/arm/arm-powerctl.h"
 +
 +#ifndef XLNX_ZYNQMP_CRF_ERR_DEBUG
 +#define XLNX_ZYNQMP_CRF_ERR_DEBUG 0
 +#endif
 +
 +#define CRF_MAX_CPU    4
 +
 +static void ir_update_irq(XlnxZynqMPCRF *s)
 +{
 +    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
 +    qemu_set_irq(s->irq_ir, pending);
 +}
 +
 +static void ir_status_postw(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    ir_update_irq(s);
 +}
 +
 +static uint64_t ir_enable_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_IR_MASK] &= ~val;
 +    ir_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t ir_disable_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_IR_MASK] |= val;
 +    ir_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t rst_fpd_apu_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
 +    uint32_t val = val64;
 +    uint32_t val_old = s->regs[R_RST_FPD_APU];
 +    unsigned int i;
 +
 +    for (i = 0; i < CRF_MAX_CPU; i++) {
 +        uint32_t mask = (1 << (R_RST_FPD_APU_ACPU0_RESET_SHIFT + i));
 +
 +        if ((val ^ val_old) & mask) {
 +            if (val & mask) {
 +                arm_set_cpu_off(i);
 +            } else {
 +                arm_set_cpu_on_and_reset(i);
 +            }
 +        }
 +    }
 +    return val64;
 +}
 +
 +static const RegisterAccessInfo crf_regs_info[] = {
 +    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
 +    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
 +        .w1c = 0x1,
 +        .post_write = ir_status_postw,
 +    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
 +        .reset = 0x1,
 +        .ro = 0x1,
 +    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
 +        .pre_write = ir_enable_prew,
 +    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
 +        .pre_write = ir_disable_prew,
 +    },{ .name = "CRF_WPROT",  .addr = A_CRF_WPROT,
 +    },{ .name = "APLL_CTRL",  .addr = A_APLL_CTRL,
 +        .reset = 0x12c09,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "APLL_CFG",  .addr = A_APLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "APLL_FRAC_CFG",  .addr = A_APLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "DPLL_CTRL",  .addr = A_DPLL_CTRL,
 +        .reset = 0x2c09,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "DPLL_CFG",  .addr = A_DPLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "DPLL_FRAC_CFG",  .addr = A_DPLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "VPLL_CTRL",  .addr = A_VPLL_CTRL,
 +        .reset = 0x12809,
 +        .rsvd = 0xf88c80f6,
 +    },{ .name = "VPLL_CFG",  .addr = A_VPLL_CFG,
 +        .rsvd = 0x1801210,
 +    },{ .name = "VPLL_FRAC_CFG",  .addr = A_VPLL_FRAC_CFG,
 +        .rsvd = 0x7e330000,
 +    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
 +        .reset = 0x3f,
 +        .rsvd = 0xc0,
 +        .ro = 0x3f,
 +    },{ .name = "APLL_TO_LPD_CTRL",  .addr = A_APLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "DPLL_TO_LPD_CTRL",  .addr = A_DPLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "VPLL_TO_LPD_CTRL",  .addr = A_VPLL_TO_LPD_CTRL,
 +        .reset = 0x400,
 +        .rsvd = 0xc0ff,
 +    },{ .name = "ACPU_CTRL",  .addr = A_ACPU_CTRL,
 +        .reset = 0x3000400,
 +        .rsvd = 0xfcffc0f8,
 +    },{ .name = "DBG_TRACE_CTRL",  .addr = A_DBG_TRACE_CTRL,
 +        .reset = 0x2500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DBG_FPD_CTRL",  .addr = A_DBG_FPD_CTRL,
 +        .reset = 0x1002500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DP_VIDEO_REF_CTRL",  .addr = A_DP_VIDEO_REF_CTRL,
 +        .reset = 0x1002300,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DP_AUDIO_REF_CTRL",  .addr = A_DP_AUDIO_REF_CTRL,
 +        .reset = 0x1032300,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DP_STC_REF_CTRL",  .addr = A_DP_STC_REF_CTRL,
 +        .reset = 0x1203200,
 +        .rsvd = 0xfec0c0f8,
 +    },{ .name = "DDR_CTRL",  .addr = A_DDR_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "GPU_REF_CTRL",  .addr = A_GPU_REF_CTRL,
 +        .reset = 0x1500,
 +        .rsvd = 0xf8ffc0f8,
 +    },{ .name = "SATA_REF_CTRL",  .addr = A_SATA_REF_CTRL,
 +        .reset = 0x1001600,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "PCIE_REF_CTRL",  .addr = A_PCIE_REF_CTRL,
 +        .reset = 0x1500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "GDMA_REF_CTRL",  .addr = A_GDMA_REF_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DPDMA_REF_CTRL",  .addr = A_DPDMA_REF_CTRL,
 +        .reset = 0x1000500,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "TOPSW_MAIN_CTRL",  .addr = A_TOPSW_MAIN_CTRL,
 +        .reset = 0x1000400,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "TOPSW_LSBUS_CTRL",  .addr = A_TOPSW_LSBUS_CTRL,
 +        .reset = 0x1000800,
 +        .rsvd = 0xfeffc0f8,
 +    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
 +        .reset = 0xa00,
 +        .rsvd = 0xffffc0f8,
 +    },
 +    {   .name = "RST_FPD_TOP",  .addr = A_RST_FPD_TOP,
 +        .reset = 0xf9ffe,
 +        .rsvd = 0xf06001,
 +    },{ .name = "RST_FPD_APU",  .addr = A_RST_FPD_APU,
 +        .reset = 0x3d0f,
 +        .rsvd = 0xc2f0,
 +        .pre_write = rst_fpd_apu_prew,
 +    },{ .name = "RST_DDR_SS",  .addr = A_RST_DDR_SS,
 +        .reset = 0xf,
 +        .rsvd = 0xf3,
 +    }
 +};
 +
 +static void crf_reset_enter(Object *obj, ResetType type)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
 +    unsigned int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 +        register_reset(&s->regs_info[i]);
 +    }
 +}
 +
 +static void crf_reset_hold(Object *obj)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
 +    ir_update_irq(s);
 +}
 +
 +static const MemoryRegionOps crf_ops = {
 +    .read = register_read_memory,
 +    .write = register_write_memory,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static void crf_init(Object *obj)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +
 +    s->reg_array =
 +        register_init_block32(DEVICE(obj), crf_regs_info,
 +                              ARRAY_SIZE(crf_regs_info),
 +                              s->regs_info, s->regs,
 +                              &crf_ops,
 +                              XLNX_ZYNQMP_CRF_ERR_DEBUG,
 +                              CRF_R_MAX * 4);
 +    sysbus_init_mmio(sbd, &s->reg_array->mem);
 +    sysbus_init_irq(sbd, &s->irq_ir);
 +}
 +
 +static void crf_finalize(Object *obj)
 +{
 +    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
 +    register_finalize_block(s->reg_array);
 +}
 +
 +static const VMStateDescription vmstate_crf = {
 +    .name = TYPE_XLNX_ZYNQMP_CRF,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCRF, CRF_R_MAX),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static void crf_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->vmsd = &vmstate_crf;
 +    rc->phases.enter = crf_reset_enter;
 +    rc->phases.hold = crf_reset_hold;
 +}
 +
 +static const TypeInfo crf_info = {
 +    .name              = TYPE_XLNX_ZYNQMP_CRF,
 +    .parent            = TYPE_SYS_BUS_DEVICE,
 +    .instance_size     = sizeof(XlnxZynqMPCRF),
 +    .class_init        = crf_class_init,
 +    .instance_init     = crf_init,
 +    .instance_finalize = crf_finalize,
 +};
 +
 +static void crf_register_types(void)
 +{
 +    type_register_static(&crf_info);
 +}
 +
 +type_init(crf_register_types)
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/misc/meson.build
-+++ b/target/arm/translate-a64.c
++++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
-     bool sf = extract32(insn, 31, 1);
+ ))
-     bool itof;
+ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+ softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
--    if (sbit || (type > 1)
++specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
--        || (!sf && scale < 32)) {
+ softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
-+    if (sbit || (!sf && scale < 32)) {
+   'xlnx-versal-xramc.c',
-+        unallocated_encoding(s);
+   'xlnx-versal-pmc-iou-slcr.c',
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0: /* float32 */
 +    case 1: /* float64 */
 +        break;
 +    case 3: /* float16 */
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 11/16] target/arm: Implement FCMP for fp16
+[PULL 16/21] hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
-From: Alex Bennée <alex.bennee@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-These where missed out from the rest of the half-precision work.
+Connect the ZynqMP CRF - Clock Reset FPD device.
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220316164645.2303510-5-edgar.iglesias@gmail.com
 Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
 [rth: Diagnose lack of FP16 before fp_access_check]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper-a64.h    |  2 +
+ include/hw/arm/xlnx-zynqmp.h |  2 ++
- target/arm/helper-a64.c    | 10 +++++
+ hw/arm/xlnx-zynqmp.c         | 16 ++++++++++++++++
- target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
+files changed, 18 insertions(+)
 files changed, 83 insertions(+), 17 deletions(-)
-diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.h
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/target/arm/helper-a64.h
++++ b/include/hw/arm/xlnx-zynqmp.h
 @@ -XXX,XX +XXX,XX @@
- DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
+ #include "hw/nvram/xlnx-bbram.h"
- DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
+ #include "hw/nvram/xlnx-zynqmp-efuse.h"
- DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+ #include "hw/or-irq.h"
-+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
++#include "hw/misc/xlnx-zynqmp-crf.h"
-+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
- DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
+ #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
- DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
+ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
- DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
+@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
      XlnxCSUDMA qspi_dma;
      qemu_or_irq qspi_irq_orgate;
 +    XlnxZynqMPCRF crf;
      char *boot_cpu;
      ARMCPU *boot_cpu_ptr;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper-a64.c
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/target/arm/helper-a64.c
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
+@@ -XXX,XX +XXX,XX @@
-     return flags;
+ #define QSPI_DMA_ADDR       0xff0f0800
  #define NUM_QSPI_IRQ_LINES  2
 +#define CRF_ADDR            0xfd1a0000
 +#define CRF_IRQ             120
 +
  /* Serializer/Deserializer.  */
  #define SERDES_ADDR         0xfd400000
  #define SERDES_SIZE         0x20000
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
      sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
  }
-+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
++static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
 +{
-+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
++    SysBusDevice *sbd;
 +
 +    object_initialize_child(OBJECT(s), "crf", &s->crf, TYPE_XLNX_ZYNQMP_CRF);
 +    sbd = SYS_BUS_DEVICE(&s->crf);
 +
 +    sysbus_realize(sbd, &error_fatal);
 +    sysbus_mmio_map(sbd, 0, CRF_ADDR);
 +    sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
 +}
 +
-+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
 +{
 +    return float_rel_to_flags(float16_compare(x, y, fp_status));
 +}
 +
  uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
  {
-     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
+     static const struct UnimpInfo {
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+     xlnx_zynqmp_create_bbram(s, gic_spi);
-+++ b/target/arm/translate-a64.c
+     xlnx_zynqmp_create_efuse(s, gic_spi);
-@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
++    xlnx_zynqmp_create_crf(s, gic_spi);
-     }
+     xlnx_zynqmp_create_unimp_mmio(s);
- }
+     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
 -static void handle_fp_compare(DisasContext *s, bool is_double,
 +static void handle_fp_compare(DisasContext *s, int size,
                                unsigned int rn, unsigned int rm,
                                bool cmp_with_zero, bool signal_all_nans)
  {
      TCGv_i64 tcg_flags = tcg_temp_new_i64();
 -    TCGv_ptr fpst = get_fpstatus_ptr(false);
 +    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 -    if (is_double) {
 +    if (size == MO_64) {
          TCGv_i64 tcg_vn, tcg_vm;
          tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
          tcg_temp_free_i64(tcg_vn);
          tcg_temp_free_i64(tcg_vm);
      } else {
 -        TCGv_i32 tcg_vn, tcg_vm;
 +        TCGv_i32 tcg_vn = tcg_temp_new_i32();
 +        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 -        tcg_vn = read_fp_sreg(s, rn);
 +        read_vec_element_i32(s, tcg_vn, rn, 0, size);
          if (cmp_with_zero) {
 -            tcg_vm = tcg_const_i32(0);
 +            tcg_gen_movi_i32(tcg_vm, 0);
          } else {
 -            tcg_vm = read_fp_sreg(s, rm);
 +            read_vec_element_i32(s, tcg_vm, rm, 0, size);
          }
 -        if (signal_all_nans) {
 -            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 -        } else {
 -            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +
 +        switch (size) {
 +        case MO_32:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        case MO_16:
 +            if (signal_all_nans) {
 +                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            } else {
 +                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
 +            }
 +            break;
 +        default:
 +            g_assert_not_reached();
          }
 +
          tcg_temp_free_i32(tcg_vn);
          tcg_temp_free_i32(tcg_vm);
      }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
  static void disas_fp_compare(DisasContext *s, uint32_t insn)
  {
      unsigned int mos, type, rm, op, rn, opc, op2r;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      op = extract32(insn, 14, 2);
      rn = extract32(insn, 5, 5);
      opc = extract32(insn, 3, 2);
      op2r = extract32(insn, 0, 3);
 -    if (mos || op || op2r || type > 1) {
 +    if (mos || op || op2r) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
          return;
      }
 -    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
 +    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
  }
  /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
      unsigned int mos, type, rm, cond, rn, op, nzcv;
      TCGv_i64 tcg_flags;
      TCGLabel *label_continue = NULL;
 +    int size;
      mos = extract32(insn, 29, 3);
 -    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
 +    type = extract32(insn, 22, 2);
      rm = extract32(insn, 16, 5);
      cond = extract32(insn, 12, 4);
      rn = extract32(insn, 5, 5);
      op = extract32(insn, 4, 1);
      nzcv = extract32(insn, 0, 4);
 -    if (mos || type > 1) {
 +    if (mos) {
 +        unallocated_encoding(s);
 +        return;
 +    }
 +
 +    switch (type) {
 +    case 0:
 +        size = MO_32;
 +        break;
 +    case 1:
 +        size = MO_64;
 +        break;
 +    case 3:
 +        size = MO_16;
 +        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
 +            break;
 +        }
 +        /* fallthru */
 +    default:
          unallocated_encoding(s);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
          gen_set_label(label_match);
      }
 -    handle_fp_compare(s, type, rn, rm, false, op);
 +    handle_fp_compare(s, size, rn, rm, false, op);
      if (cond < 0x0e) {
          gen_set_label(label_continue);
 --
-.17.0
+.25.1

-New patch
+[PULL 17/21] hw/misc: Add a model of the Xilinx ZynqMP APU Control
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Add a model of the Xilinx ZynqMP APU Control.
+Reviewed-by: Luc Michel <luc@lmichel.fr>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20220316164645.2303510-6-edgar.iglesias@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 +++++++++
+ hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++
+ hw/misc/meson.build                    |   1 +
+files changed, 347 insertions(+)
+ create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+ create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
+diff --git a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QEMU model of ZynqMP APU Control.
++ *
++ * Copyright (c) 2013-2022 Xilinx Inc
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
++ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ *
++ */
++#ifndef HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
++#define HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
++
++#include "hw/sysbus.h"
++#include "hw/register.h"
++#include "target/arm/cpu.h"
++
++#define TYPE_XLNX_ZYNQMP_APU_CTRL "xlnx.apu-ctrl"
++OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPAPUCtrl, XLNX_ZYNQMP_APU_CTRL)
++
++REG32(APU_ERR_CTRL, 0x0)
++    FIELD(APU_ERR_CTRL, PSLVERR, 0, 1)
++REG32(ISR, 0x10)
++    FIELD(ISR, INV_APB, 0, 1)
++REG32(IMR, 0x14)
++    FIELD(IMR, INV_APB, 0, 1)
++REG32(IEN, 0x18)
++    FIELD(IEN, INV_APB, 0, 1)
++REG32(IDS, 0x1c)
++    FIELD(IDS, INV_APB, 0, 1)
++REG32(CONFIG_0, 0x20)
++    FIELD(CONFIG_0, CFGTE, 24, 4)
++    FIELD(CONFIG_0, CFGEND, 16, 4)
++    FIELD(CONFIG_0, VINITHI, 8, 4)
++    FIELD(CONFIG_0, AA64NAA32, 0, 4)
++REG32(CONFIG_1, 0x24)
++    FIELD(CONFIG_1, L2RSTDISABLE, 29, 1)
++    FIELD(CONFIG_1, L1RSTDISABLE, 28, 1)
++    FIELD(CONFIG_1, CP15DISABLE, 0, 4)
++REG32(RVBARADDR0L, 0x40)
++    FIELD(RVBARADDR0L, ADDR, 2, 30)
++REG32(RVBARADDR0H, 0x44)
++    FIELD(RVBARADDR0H, ADDR, 0, 8)
++REG32(RVBARADDR1L, 0x48)
++    FIELD(RVBARADDR1L, ADDR, 2, 30)
++REG32(RVBARADDR1H, 0x4c)
++    FIELD(RVBARADDR1H, ADDR, 0, 8)
++REG32(RVBARADDR2L, 0x50)
++    FIELD(RVBARADDR2L, ADDR, 2, 30)
++REG32(RVBARADDR2H, 0x54)
++    FIELD(RVBARADDR2H, ADDR, 0, 8)
++REG32(RVBARADDR3L, 0x58)
++    FIELD(RVBARADDR3L, ADDR, 2, 30)
++REG32(RVBARADDR3H, 0x5c)
++    FIELD(RVBARADDR3H, ADDR, 0, 8)
++REG32(ACE_CTRL, 0x60)
++    FIELD(ACE_CTRL, AWQOS, 16, 4)
++    FIELD(ACE_CTRL, ARQOS, 0, 4)
++REG32(SNOOP_CTRL, 0x80)
++    FIELD(SNOOP_CTRL, ACE_INACT, 4, 1)
++    FIELD(SNOOP_CTRL, ACP_INACT, 0, 1)
++REG32(PWRCTL, 0x90)
++    FIELD(PWRCTL, CLREXMONREQ, 17, 1)
++    FIELD(PWRCTL, L2FLUSHREQ, 16, 1)
++    FIELD(PWRCTL, CPUPWRDWNREQ, 0, 4)
++REG32(PWRSTAT, 0x94)
++    FIELD(PWRSTAT, CLREXMONACK, 17, 1)
++    FIELD(PWRSTAT, L2FLUSHDONE, 16, 1)
++    FIELD(PWRSTAT, DBGNOPWRDWN, 0, 4)
++
++#define APU_R_MAX ((R_PWRSTAT) + 1)
++
++#define APU_MAX_CPU    4
++
++struct XlnxZynqMPAPUCtrl {
++    SysBusDevice busdev;
++
++    ARMCPU *cpus[APU_MAX_CPU];
++    /* WFIs towards PMU. */
++    qemu_irq wfi_out[4];
++    /* CPU Power status towards INTC Redirect. */
++    qemu_irq cpu_power_status[4];
++    qemu_irq irq_imr;
++
++    uint8_t cpu_pwrdwn_req;
++    uint8_t cpu_in_wfi;
++
++    RegisterInfoArray *reg_array;
++    uint32_t regs[APU_R_MAX];
++    RegisterInfo regs_info[APU_R_MAX];
++};
++
++#endif
+diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QEMU model of the ZynqMP APU Control.
++ *
++ * Copyright (c) 2013-2022 Xilinx Inc
++ * SPDX-License-Identifier: GPL-2.0-or-later
++ *
++ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
++ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/error.h"
++#include "qemu/log.h"
++#include "migration/vmstate.h"
++#include "hw/qdev-properties.h"
++#include "hw/sysbus.h"
++#include "hw/irq.h"
++#include "hw/register.h"
++
++#include "qemu/bitops.h"
++#include "qapi/qmp/qerror.h"
++
++#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
++
++#ifndef XILINX_ZYNQMP_APU_ERR_DEBUG
++#define XILINX_ZYNQMP_APU_ERR_DEBUG 0
++#endif
++
++static void update_wfi_out(void *opaque)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
++    unsigned int i, wfi_pending;
++
++    wfi_pending = s->cpu_pwrdwn_req & s->cpu_in_wfi;
++    for (i = 0; i < APU_MAX_CPU; i++) {
++        qemu_set_irq(s->wfi_out[i], !!(wfi_pending & (1 << i)));
++    }
++}
++
++static void zynqmp_apu_rvbar_post_write(RegisterInfo *reg, uint64_t val)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    int i;
++
++    for (i = 0; i < APU_MAX_CPU; ++i) {
++        uint64_t rvbar = s->regs[R_RVBARADDR0L + 2 * i] +
++                         ((uint64_t)s->regs[R_RVBARADDR0H + 2 * i] << 32);
++        if (s->cpus[i]) {
++            object_property_set_int(OBJECT(s->cpus[i]), "rvbar", rvbar,
++                                    &error_abort);
++        }
++    }
++}
++
++static void zynqmp_apu_pwrctl_post_write(RegisterInfo *reg, uint64_t val)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    unsigned int i, new;
++
++    for (i = 0; i < APU_MAX_CPU; i++) {
++        new = val & (1 << i);
++        /* Check if CPU's CPUPWRDNREQ has changed. If yes, update GPIOs. */
++        if (new != (s->cpu_pwrdwn_req & (1 << i))) {
++            qemu_set_irq(s->cpu_power_status[i], !!new);
++        }
++        s->cpu_pwrdwn_req &= ~(1 << i);
++        s->cpu_pwrdwn_req |= new;
++    }
++    update_wfi_out(s);
++}
++
++static void imr_update_irq(XlnxZynqMPAPUCtrl *s)
++{
++    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
++    qemu_set_irq(s->irq_imr, pending);
++}
++
++static void isr_postw(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    imr_update_irq(s);
++}
++
++static uint64_t ien_prew(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    uint32_t val = val64;
++
++    s->regs[R_IMR] &= ~val;
++    imr_update_irq(s);
++    return 0;
++}
++
++static uint64_t ids_prew(RegisterInfo *reg, uint64_t val64)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
++    uint32_t val = val64;
++
++    s->regs[R_IMR] |= val;
++    imr_update_irq(s);
++    return 0;
++}
++
++static const RegisterAccessInfo zynqmp_apu_regs_info[] = {
++#define RVBAR_REGDEF(n) \
++    {   .name = "RVBAR CPU " #n " Low",  .addr = A_RVBARADDR ## n ## L,    \
++            .reset = 0xffff0000ul,                                         \
++            .post_write = zynqmp_apu_rvbar_post_write,                     \
++    },{ .name = "RVBAR CPU " #n " High", .addr = A_RVBARADDR ## n ## H,    \
++            .post_write = zynqmp_apu_rvbar_post_write,                     \
++    }
++    {   .name = "ERR_CTRL",  .addr = A_APU_ERR_CTRL,
++    },{ .name = "ISR",  .addr = A_ISR,
++        .w1c = 0x1,
++        .post_write = isr_postw,
++    },{ .name = "IMR",  .addr = A_IMR,
++        .reset = 0x1,
++        .ro = 0x1,
++    },{ .name = "IEN",  .addr = A_IEN,
++        .pre_write = ien_prew,
++    },{ .name = "IDS",  .addr = A_IDS,
++        .pre_write = ids_prew,
++    },{ .name = "CONFIG_0",  .addr = A_CONFIG_0,
++        .reset = 0xf0f,
++    },{ .name = "CONFIG_1",  .addr = A_CONFIG_1,
++    },
++    RVBAR_REGDEF(0),
++    RVBAR_REGDEF(1),
++    RVBAR_REGDEF(2),
++    RVBAR_REGDEF(3),
++    { .name = "ACE_CTRL",  .addr = A_ACE_CTRL,
++        .reset = 0xf000f,
++    },{ .name = "SNOOP_CTRL",  .addr = A_SNOOP_CTRL,
++    },{ .name = "PWRCTL",  .addr = A_PWRCTL,
++        .post_write = zynqmp_apu_pwrctl_post_write,
++    },{ .name = "PWRSTAT",  .addr = A_PWRSTAT,
++        .ro = 0x3000f,
++    }
++};
++
++static void zynqmp_apu_reset_enter(Object *obj, ResetType type)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    int i;
++
++    for (i = 0; i < APU_R_MAX; ++i) {
++        register_reset(&s->regs_info[i]);
++    }
++
++    s->cpu_pwrdwn_req = 0;
++    s->cpu_in_wfi = 0;
++}
++
++static void zynqmp_apu_reset_hold(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++
++    update_wfi_out(s);
++    imr_update_irq(s);
++}
++
++static const MemoryRegionOps zynqmp_apu_ops = {
++    .read = register_read_memory,
++    .write = register_write_memory,
++    .endianness = DEVICE_LITTLE_ENDIAN,
++    .valid = {
++        .min_access_size = 4,
++        .max_access_size = 4,
++    }
++};
++
++static void zynqmp_apu_handle_wfi(void *opaque, int irq, int level)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
++
++    s->cpu_in_wfi = deposit32(s->cpu_in_wfi, irq, 1, level);
++    update_wfi_out(s);
++}
++
++static void zynqmp_apu_init(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    int i;
++
++    s->reg_array =
++        register_init_block32(DEVICE(obj), zynqmp_apu_regs_info,
++                              ARRAY_SIZE(zynqmp_apu_regs_info),
++                              s->regs_info, s->regs,
++                              &zynqmp_apu_ops,
++                              XILINX_ZYNQMP_APU_ERR_DEBUG,
++                              APU_R_MAX * 4);
++    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->reg_array->mem);
++    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq_imr);
++
++    for (i = 0; i < APU_MAX_CPU; ++i) {
++        g_autofree gchar *prop_name = g_strdup_printf("cpu%d", i);
++        object_property_add_link(obj, prop_name, TYPE_ARM_CPU,
++                                 (Object **)&s->cpus[i],
++                                 qdev_prop_allow_set_link_before_realize,
++                                 OBJ_PROP_LINK_STRONG);
++    }
++
++    /* wfi_out is used to connect to PMU GPIs. */
++    qdev_init_gpio_out_named(DEVICE(obj), s->wfi_out, "wfi_out", 4);
++    /* CPU_POWER_STATUS is used to connect to INTC redirect. */
++    qdev_init_gpio_out_named(DEVICE(obj), s->cpu_power_status,
++                             "CPU_POWER_STATUS", 4);
++    /* wfi_in is used as input from CPUs as wfi request. */
++    qdev_init_gpio_in_named(DEVICE(obj), zynqmp_apu_handle_wfi, "wfi_in", 4);
++}
++
++static void zynqmp_apu_finalize(Object *obj)
++{
++    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
++    register_finalize_block(s->reg_array);
++}
++
++static const VMStateDescription vmstate_zynqmp_apu = {
++    .name = TYPE_XLNX_ZYNQMP_APU_CTRL,
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .fields = (VMStateField[]) {
++        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPAPUCtrl, APU_R_MAX),
++        VMSTATE_END_OF_LIST(),
++    }
++};
++
++static void zynqmp_apu_class_init(ObjectClass *klass, void *data)
++{
++    ResettableClass *rc = RESETTABLE_CLASS(klass);
++    DeviceClass *dc = DEVICE_CLASS(klass);
++
++    dc->vmsd = &vmstate_zynqmp_apu;
++
++    rc->phases.enter = zynqmp_apu_reset_enter;
++    rc->phases.hold = zynqmp_apu_reset_hold;
++}
++
++static const TypeInfo zynqmp_apu_info = {
++    .name              = TYPE_XLNX_ZYNQMP_APU_CTRL,
++    .parent            = TYPE_SYS_BUS_DEVICE,
++    .instance_size     = sizeof(XlnxZynqMPAPUCtrl),
++    .class_init        = zynqmp_apu_class_init,
++    .instance_init     = zynqmp_apu_init,
++    .instance_finalize = zynqmp_apu_finalize,
++};
++
++static void zynqmp_apu_register_types(void)
++{
++    type_register_static(&zynqmp_apu_info);
++}
++
++type_init(zynqmp_apu_register_types)
+diff --git a/hw/misc/meson.build b/hw/misc/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/meson.build
++++ b/hw/misc/meson.build
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
+ softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
+ softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
+ specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
++specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
+ softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
+   'xlnx-versal-xramc.c',
+   'xlnx-versal-pmc-iou-slcr.c',
+--
+.25.1

-[Qemu-devel] [PULL 10/16] target/arm: Implement FP data-processing (3 source) for fp16
+[PULL 18/21] hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control
-From: Richard Henderson <richard.henderson@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-We missed all of the scalar fp16 fma operations.
+Connect the ZynqMP APU Control device.
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Luc Michel <luc@lmichel.fr>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
+Message-id: 20220316164645.2303510-7-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
+ include/hw/arm/xlnx-zynqmp.h |  4 +++-
-file changed, 48 insertions(+)
+ hw/arm/xlnx-zynqmp.c         | 25 +++++++++++++++++++++++--
 files changed, 26 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/include/hw/arm/xlnx-zynqmp.h
-+++ b/target/arm/translate-a64.c
++++ b/include/hw/arm/xlnx-zynqmp.h
-@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
+@@ -XXX,XX +XXX,XX @@
-     tcg_temp_free_i64(tcg_res);
+ #include "hw/nvram/xlnx-bbram.h"
  #include "hw/nvram/xlnx-zynqmp-efuse.h"
  #include "hw/or-irq.h"
 +#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
  #include "hw/misc/xlnx-zynqmp-crf.h"
  #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
  /*
   * Unimplemented mmio regions needed to boot some images.
   */
 -#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
 +#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
  struct XlnxZynqMPState {
      /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
      XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
      XlnxCSUDMA qspi_dma;
      qemu_or_irq qspi_irq_orgate;
 +    XlnxZynqMPAPUCtrl apu_ctrl;
      XlnxZynqMPCRF crf;
      char *boot_cpu;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
  #define DPDMA_IRQ           116
  #define APU_ADDR            0xfd5c0000
 -#define APU_SIZE            0x100
 +#define APU_IRQ             153
  #define IPI_ADDR            0xFF300000
  #define IPI_IRQ             64
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
      sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
  }
-+/* Floating-point data-processing (3 source) - half precision */
++static void xlnx_zynqmp_create_apu_ctrl(XlnxZynqMPState *s, qemu_irq *gic)
 +static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
 +                                int rd, int rn, int rm, int ra)
 +{
-+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
++    SysBusDevice *sbd;
-+    TCGv_i32 tcg_res = tcg_temp_new_i32();
++    int i;
 +    TCGv_ptr fpst = get_fpstatus_ptr(true);
 +
-+    tcg_op1 = read_fp_hreg(s, rn);
++    object_initialize_child(OBJECT(s), "apu-ctrl", &s->apu_ctrl,
-+    tcg_op2 = read_fp_hreg(s, rm);
++                            TYPE_XLNX_ZYNQMP_APU_CTRL);
-+    tcg_op3 = read_fp_hreg(s, ra);
++    sbd = SYS_BUS_DEVICE(&s->apu_ctrl);
 +
-+    /* These are fused multiply-add, and must be done as one
++    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
-+     * floating point operation with no rounding between the
++        g_autofree gchar *name = g_strdup_printf("cpu%d", i);
-+     * multiplication and addition steps.
++
-+     * NB that doing the negations here as separate steps is
++        object_property_set_link(OBJECT(&s->apu_ctrl), name,
-+     * correct : an input NaN should come out with its sign bit
++                                 OBJECT(&s->apu_cpu[i]), &error_abort);
 +     * flipped if it is a negated-input.
 +     */
 +    if (o1 == true) {
 +        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
 +    }
 +
-+    if (o0 != o1) {
++    sysbus_realize(sbd, &error_fatal);
-+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
++    sysbus_mmio_map(sbd, 0, APU_ADDR);
-+    }
++    sysbus_connect_irq(sbd, 0, gic[APU_IRQ]);
 +
 +    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
 +
 +    write_fp_sreg(s, rd, tcg_res);
 +
 +    tcg_temp_free_ptr(fpst);
 +    tcg_temp_free_i32(tcg_op1);
 +    tcg_temp_free_i32(tcg_op2);
 +    tcg_temp_free_i32(tcg_op3);
 +    tcg_temp_free_i32(tcg_res);
 +}
 +
- /* Floating point data-processing (3 source)
+ static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
-  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
+ {
-  * +---+---+---+-----------+------+----+------+----+------+------+------+
+     SysBusDevice *sbd;
-@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
-         }
+         hwaddr base;
-         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
+         hwaddr size;
-         break;
+     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
-+    case 3:
+-        { .name = "apu", APU_ADDR, APU_SIZE },
-+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+         { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
-+            unallocated_encoding(s);
+     };
-+            return;
+     unsigned int nr;
-+        }
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
-+        if (!fp_access_check(s)) {
-+            return;
+     xlnx_zynqmp_create_bbram(s, gic_spi);
-+        }
+     xlnx_zynqmp_create_efuse(s, gic_spi);
-+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
++    xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
-+        break;
+     xlnx_zynqmp_create_crf(s, gic_spi);
-     default:
+     xlnx_zynqmp_create_unimp_mmio(s);
-         unallocated_encoding(s);
      }
 --
-.17.0
+.25.1

-[Qemu-devel] [PULL 01/16] fpu/softfloat: int_to_float ensure r fully initialised
+[PULL 19/21] util/osdep: Avoid madvise proto on modern Solaris
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Andrew Deason <adeason@sinenomine.net>
-Reported by Coverity (CID1390635). We ensure this for uint_to_float
+On older Solaris releases (before Solaris 11), we didn't get a
-later on so we might as well mirror that.
+prototype for madvise, and so util/osdep.c provides its own prototype.
 Some time between the public Solaris 11.4 release and Solaris 11.4.42
 CBE, we started getting an madvise prototype that looks like this:
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+    extern int madvise(void *, size_t, int);
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 which conflicts with the prototype in util/osdeps.c. Instead of always
 declaring this prototype, check if we're missing the madvise()
 prototype, and only declare it ourselves if the prototype is missing.
 Move the prototype to include/qemu/osdep.h, the normal place to handle
 platform-specific header quirks.
 The 'missing_madvise_proto' meson check contains an obviously wrong
 prototype for madvise. So if that code compiles and links, we must be
 missing the actual prototype for madvise.
 Signed-off-by: Andrew Deason <adeason@sinenomine.net>
 Message-id: 20220316035227.3702-2-adeason@sinenomine.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- fpu/softfloat.c | 2 +-
+ meson.build          | 23 +++++++++++++++++++++--
-file changed, 1 insertion(+), 1 deletion(-)
+ include/qemu/osdep.h |  8 ++++++++
  util/osdep.c         |  3 ---
 files changed, 29 insertions(+), 5 deletions(-)
-diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/fpu/softfloat.c
+--- a/meson.build
-+++ b/fpu/softfloat.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ FLOAT_TO_UINT(64, 64)
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
+   #error Not supported
- static FloatParts int_to_float(int64_t a, float_status *status)
+   #endif
- {
+   }'''))
--    FloatParts r;
+-config_host_data.set('CONFIG_MADVISE', cc.links(gnu_source_prefix + '''
-+    FloatParts r = {};
++
-     if (a == 0) {
++has_madvise = cc.links(gnu_source_prefix + '''
-         r.cls = float_class_zero;
+   #include <sys/types.h>
-         r.sign = false;
+   #include <sys/mman.h>
    #include <stddef.h>
 -  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }'''))
 +  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }''')
 +missing_madvise_proto = false
 +if has_madvise
 +  # Some platforms (illumos and Solaris before Solaris 11) provide madvise()
 +  # but forget to prototype it. In this case, has_madvise will be true (the
 +  # test program links despite a compile warning). To detect the
 +  # missing-prototype case, we try again with a definitely-bogus prototype.
 +  # This will only compile if the system headers don't provide the prototype;
 +  # otherwise the conflicting prototypes will cause a compiler error.
 +  missing_madvise_proto = cc.links(gnu_source_prefix + '''
 +    #include <sys/types.h>
 +    #include <sys/mman.h>
 +    #include <stddef.h>
 +    extern int madvise(int);
 +    int main(void) { return madvise(0); }''')
 +endif
 +config_host_data.set('CONFIG_MADVISE', has_madvise)
 +config_host_data.set('HAVE_MADVISE_WITHOUT_PROTOTYPE', missing_madvise_proto)
 +
  config_host_data.set('CONFIG_MEMFD', cc.links(gnu_source_prefix + '''
    #include <sys/mman.h>
    int main(void) { return memfd_create("foo", MFD_ALLOW_SEALING); }'''))
 diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/osdep.h
 +++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
  #define SIGIO SIGPOLL
  #endif
 +#ifdef HAVE_MADVISE_WITHOUT_PROTOTYPE
 +/*
 + * See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for discussion
 + * about Solaris missing the madvise() prototype.
 + */
 +extern int madvise(char *, size_t, int);
 +#endif
 +
  #if defined(CONFIG_LINUX)
  #ifndef BUS_MCEERR_AR
  #define BUS_MCEERR_AR 4
 diff --git a/util/osdep.c b/util/osdep.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/osdep.c
 +++ b/util/osdep.c
@@ -XXX,XX +XXX,XX @@
  #ifdef CONFIG_SOLARIS
  #include <sys/statvfs.h>
 -/* See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for
 -   discussion about Solaris header problems */
 -extern int madvise(char *, size_t, int);
  #endif
  #include "qemu-common.h"
 --
-.17.0
+.25.1

-New patch
+[PULL 20/21] hw/i386/acpi-build: Avoid 'sun' identifier
+From: Andrew Deason <adeason@sinenomine.net>
+On Solaris, 'sun' is #define'd to 1, which causes errors if a variable
+is named 'sun'. Slightly change the name of the var for the Slot User
+Number so we can build on Solaris.
+Reviewed-by: Ani Sinha <ani@anisinha.ca>
+Signed-off-by: Andrew Deason <adeason@sinenomine.net>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Message-id: 20220316035227.3702-3-adeason@sinenomine.net
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/i386/acpi-build.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/i386/acpi-build.c
++++ b/hw/i386/acpi-build.c
+@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
+     Aml *bnum = aml_arg(4);
+     Aml *func = aml_arg(2);
+     Aml *rev = aml_arg(1);
+-    Aml *sun = aml_arg(5);
++    Aml *sunum = aml_arg(5);
+     method = aml_method("PDSM", 6, AML_SERIALIZED);
+@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
+     UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
+     ifctx = aml_if(aml_equal(aml_arg(0), UUID));
+     {
+-        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sun), acpi_index));
++        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
+         ifctx1 = aml_if(aml_equal(func, zero));
+         {
+             uint8_t byte_list[1];
+--
+.25.1

-New patch
+[PULL 21/21] util/osdep: Remove some early cruft
+From: Andrew Deason <adeason@sinenomine.net>
+The include for statvfs.h has not been needed since all statvfs calls
+were removed in commit 4a1418e07bdc ("Unbreak large mem support by
+removing kqemu").
+The comment mentioning CONFIG_BSD hasn't made sense since an include
+for config-host.h was removed in commit aafd75841001 ("util: Clean up
+includes").
+Remove this cruft.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Andrew Deason <adeason@sinenomine.net>
+Message-id: 20220316035227.3702-4-adeason@sinenomine.net
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ util/osdep.c | 7 -------
+file changed, 7 deletions(-)
+diff --git a/util/osdep.c b/util/osdep.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/osdep.c
++++ b/util/osdep.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+ #include "qapi/error.h"
+-
+-/* Needed early for CONFIG_BSD etc. */
+-
+-#ifdef CONFIG_SOLARIS
+-#include <sys/statvfs.h>
+-#endif
+-
+ #include "qemu-common.h"
+ #include "qemu/cutils.h"
+ #include "qemu/sockets.h"
+--
+.25.1

The following changes since commit ad1b4ec39caa5b3f17cbd8160283a03a3dcfe2ae:

Merge remote-tracking branch 'remotes/kraxel/tags/input-20180515-pull-request' into staging (2018-05-15 12:50:06 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180515

for you to fetch changes up to ae7651804748c6b479d5ae09aeac4edb9c44f76e:

tcg: Optionally log FPU state in TCG -d cpu logging (2018-05-15 14:58:44 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix coverity nit in int_to_float code
 * Don't set Invalid for float-to-int(MAXINT)
 * Fix fp_status_f16 tininess before rounding
 * Add various missing insns from the v8.2-FP16 extension
 * Fix sqrt_f16 exception raising
 * sdcard: Correct CRC16 offset in sd_function_switch()
 * tcg: Optionally log FPU state in TCG -d cpu logging

----------------------------------------------------------------
Alex Bennée (5):
      fpu/softfloat: int_to_float ensure r fully initialised
      target/arm: Implement FCMP for fp16
      target/arm: Implement FCSEL for fp16
      target/arm: Implement FMOV (immediate) for fp16
      target/arm: Fix sqrt_f16 exception raising

Peter Maydell (3):
      fpu/softfloat: Don't set Invalid for float-to-int(MAXINT)
      target/arm: Fix fp_status_f16 tininess before rounding
      tcg: Optionally log FPU state in TCG -d cpu logging

Philippe Mathieu-Daudé (1):
      sdcard: Correct CRC16 offset in sd_function_switch()

Richard Henderson (7):
      target/arm: Implement FMOV (general) for fp16
      target/arm: Early exit after unallocated_encoding in disas_fp_int_conv
      target/arm: Implement FCVT (scalar, integer) for fp16
      target/arm: Implement FCVT (scalar, fixed-point) for fp16
      target/arm: Introduce and use read_fp_hreg
      target/arm: Implement FP data-processing (2 source) for fp16
      target/arm: Implement FP data-processing (3 source) for fp16

In float-to-integer conversion, if the floating point input
converts exactly to the largest or smallest integer that
fits in to the result type, this is not an overflow.
In this situation we were producing the correct result value,
but were incorrectly setting the Invalid flag.
For example for Arm A64, "FCVTAS w0, d0" on an input of
0x41dfffffffc00000 should produce 0x7fffffff and set no flags.

Fix the boundary case to take the right half of the if()
statements.

This fixes a regression from 2.11 introduced by the softfloat
refactoring.

Cc: qemu-stable@nongnu.org
Fixes: ab52f973a50
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510140141.12120-1-peter.maydell@linaro.org
---
 fpu/softfloat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static int64_t round_to_int_and_pack(FloatParts in, int rmode,
             r = UINT64_MAX;
         }
         if (p.sign) {
-            if (r < -(uint64_t) min) {
+            if (r <= -(uint64_t) min) {
                 return -r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
                 return min;
             }
         } else {
-            if (r < max) {
+            if (r <= max) {
                 return r;
             } else {
                 s->float_exception_flags = orig_flags | float_flag_invalid;
-- 
2.17.0

In commit d81ce0ef2c4f105 we added an extra float_status field
fp_status_fp16 for Arm, but forgot to initialize it correctly
by setting it to float_tininess_before_rounding. This currently
will only cause problems for the new V8_FP16 feature, since the
float-to-float conversion code doesn't use it yet. The effect
would be that we failed to set the Underflow IEEE exception flag
in all the cases where we should.

Add the missing initialization.

Fixes: d81ce0ef2c4f105
Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180512004311.9299-16-richard.henderson@linaro.org
---
 target/arm/cpu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
                               &env->vfp.fp_status);
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->vfp.standard_fp_status);
+    set_float_detect_tininess(float_tininess_before_rounding,
+                              &env->vfp.fp_status_f16);
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
         kvm_arm_reset_vcpu(cpu);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Adding the fp16 moves to/from general registers.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             tcg_gen_st_i64(tcg_rn, cpu_env, fp_reg_hi_offset(s, rd));
             clear_vec_high(s, true, rd);
             break;
+        case 3:
+            /* 16 bit */
+            tmp = tcg_temp_new_i64();
+            tcg_gen_ext16u_i64(tmp, tcg_rn);
+            write_fp_dreg(s, rd, tmp);
+            tcg_temp_free_i64(tmp);
+            break;
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_rd = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fmov(DisasContext *s, int rd, int rn, int type, bool itof)
             /* 64 bits from top half */
             tcg_gen_ld_i64(tcg_rd, cpu_env, fp_reg_hi_offset(s, rn));
             break;
+        case 3:
+            /* 16 bit */
+            tcg_gen_ld16u_i64(tcg_rd, cpu_env, fp_reg_offset(s, rn, MO_16));
+            break;
+        default:
+            g_assert_not_reached();
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         case 0xa: /* 64 bit */
         case 0xd: /* 64 bit to top half of quad */
             break;
+        case 0x6: /* 16-bit float, 32-bit int */
+        case 0xe: /* 16-bit float, 64-bit int */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
         default:
             /* all other sf/type/rmode combinations are invalid */
             unallocated_encoding(s);
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  6 +++
 target/arm/helper.c        | 38 ++++++++++++++-
 target/arm/translate-a64.c | 96 +++++++++++++++++++++++++++++++-------
 3 files changed, 122 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_touhd_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_tould_round_to_zero, i64, f64, i32, ptr)
 DEF_HELPER_3(vfp_touhh, i32, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toulh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_toslh, i32, f16, i32, ptr)
+DEF_HELPER_3(vfp_touqh, i64, f16, i32, ptr)
+DEF_HELPER_3(vfp_tosqh, i64, f16, i32, ptr)
 DEF_HELPER_3(vfp_toshs, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosls, i32, f32, i32, ptr)
 DEF_HELPER_3(vfp_tosqs, i64, f32, i32, ptr)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_3(vfp_ultod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_uqtod, f64, i64, i32, ptr)
 DEF_HELPER_3(vfp_sltoh, f16, i32, i32, ptr)
 DEF_HELPER_3(vfp_ultoh, f16, i32, i32, ptr)
+DEF_HELPER_3(vfp_sqtoh, f16, i64, i32, ptr)
+DEF_HELPER_3(vfp_uqtoh, f16, i64, i32, ptr)
 
 DEF_HELPER_FLAGS_2(set_rmode, TCG_CALL_NO_RWG, i32, i32, ptr)
 DEF_HELPER_FLAGS_2(set_neon_rmode, TCG_CALL_NO_RWG, i32, i32, env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ VFP_CONV_FIX_A64(uq, s, 32, 64, uint64)
 #undef VFP_CONV_FIX_A64
 
 /* Conversion to/from f16 can overflow to infinity before/after scaling.
- * Therefore we convert to f64 (which does not round), scale,
- * and then convert f64 to f16 (which may round).
+ * Therefore we convert to f64, scale, and then convert f64 to f16; or
+ * vice versa for conversion to integer.
+ *
+ * For 16- and 32-bit integers, the conversion to f64 never rounds.
+ * For 64-bit integers, any integer that would cause rounding will also
+ * overflow to f16 infinity, so there is no double rounding problem.
  */
 
 static float16 do_postscale_fp16(float64 f, int shift, float_status *fpst)
@@ -XXX,XX +XXX,XX @@ float16 HELPER(vfp_ultoh)(uint32_t x, uint32_t shift, void *fpst)
     return do_postscale_fp16(uint32_to_float64(x, fpst), shift, fpst);
 }
 
+float16 HELPER(vfp_sqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(int64_to_float64(x, fpst), shift, fpst);
+}
+
+float16 HELPER(vfp_uqtoh)(uint64_t x, uint32_t shift, void *fpst)
+{
+    return do_postscale_fp16(uint64_to_float64(x, fpst), shift, fpst);
+}
+
 static float64 do_prescale_fp16(float16 f, int shift, float_status *fpst)
 {
     if (unlikely(float16_is_any_nan(f))) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(vfp_touhh)(float16 x, uint32_t shift, void *fpst)
     return float64_to_uint16(do_prescale_fp16(x, shift, fpst), fpst);
 }
 
+uint32_t HELPER(vfp_toslh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint32_t HELPER(vfp_toulh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint32(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_tosqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_int64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
+uint64_t HELPER(vfp_touqh)(float16 x, uint32_t shift, void *fpst)
+{
+    return float64_to_uint64(do_prescale_fp16(x, shift, fpst), fpst);
+}
+
 /* Set the current fp rounding mode and return the old one.
  * The argument is a softfloat float_round_ value.
  */
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                            bool itof, int rmode, int scale, int sf, int type)
 {
     bool is_signed = !(opcode & 1);
-    bool is_double = type;
     TCGv_ptr tcg_fpstatus;
-    TCGv_i32 tcg_shift;
+    TCGv_i32 tcg_shift, tcg_single;
+    TCGv_i64 tcg_double;
 
-    tcg_fpstatus = get_fpstatus_ptr(false);
+    tcg_fpstatus = get_fpstatus_ptr(type == 3);
 
     tcg_shift = tcg_const_i32(64 - scale);
 
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             tcg_int = tcg_extend;
         }
 
-        if (is_double) {
-            TCGv_i64 tcg_double = tcg_temp_new_i64();
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = tcg_temp_new_i64();
             if (is_signed) {
                 gen_helper_vfp_sqtod(tcg_double, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_dreg(s, rd, tcg_double);
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = tcg_temp_new_i32();
+            break;
+
+        case 0: /* float32 */
+            tcg_single = tcg_temp_new_i32();
             if (is_signed) {
                 gen_helper_vfp_sqtos(tcg_single, tcg_int,
                                      tcg_shift, tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
             }
             write_fp_sreg(s, rd, tcg_single);
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = tcg_temp_new_i32();
+            if (is_signed) {
+                gen_helper_vfp_sqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            } else {
+                gen_helper_vfp_uqtoh(tcg_single, tcg_int,
+                                     tcg_shift, tcg_fpstatus);
+            }
+            write_fp_sreg(s, rd, tcg_single);
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
     } else {
         TCGv_i64 tcg_int = cpu_reg(s, rd);
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
 
-        if (is_double) {
-            TCGv_i64 tcg_double = read_fp_dreg(s, rn);
+        switch (type) {
+        case 1: /* float64 */
+            tcg_double = read_fp_dreg(s, rn);
             if (is_signed) {
                 if (!sf) {
                     gen_helper_vfp_tosld(tcg_int, tcg_double,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                                          tcg_shift, tcg_fpstatus);
                 }
             }
+            if (!sf) {
+                tcg_gen_ext32u_i64(tcg_int, tcg_int);
+            }
             tcg_temp_free_i64(tcg_double);
-        } else {
-            TCGv_i32 tcg_single = read_fp_sreg(s, rn);
+            break;
+
+        case 0: /* float32 */
+            tcg_single = read_fp_sreg(s, rn);
             if (sf) {
                 if (is_signed) {
                     gen_helper_vfp_tosqs(tcg_int, tcg_single,
@@ -XXX,XX +XXX,XX @@ static void handle_fpfpcvt(DisasContext *s, int rd, int rn, int opcode,
                 tcg_temp_free_i32(tcg_dest);
             }
             tcg_temp_free_i32(tcg_single);
+            break;
+
+        case 3: /* float16 */
+            tcg_single = read_fp_sreg(s, rn);
+            if (sf) {
+                if (is_signed) {
+                    gen_helper_vfp_tosqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_touqh(tcg_int, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+            } else {
+                TCGv_i32 tcg_dest = tcg_temp_new_i32();
+                if (is_signed) {
+                    gen_helper_vfp_toslh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                } else {
+                    gen_helper_vfp_toulh(tcg_dest, tcg_single,
+                                         tcg_shift, tcg_fpstatus);
+                }
+                tcg_gen_extu_i32_i64(tcg_int, tcg_dest);
+                tcg_temp_free_i32(tcg_dest);
+            }
+            tcg_temp_free_i32(tcg_single);
+            break;
+
+        default:
+            g_assert_not_reached();
         }
 
         gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
         tcg_temp_free_i32(tcg_rmode);
-
-        if (!sf) {
-            tcg_gen_ext32u_i64(tcg_int, tcg_int);
-        }
     }
 
     tcg_temp_free_ptr(tcg_fpstatus);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_int_conv(DisasContext *s, uint32_t insn)
         /* actual FP conversions */
         bool itof = extract32(opcode, 1, 1);
 
-        if (type > 1 || (rmode != 0 && opcode > 1)) {
+        if (rmode != 0 && opcode > 1) {
+            unallocated_encoding(s);
+            return;
+        }
+        switch (type) {
+        case 0: /* float32 */
+        case 1: /* float64 */
+            break;
+        case 3: /* float16 */
+            if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+                break;
+            }
+            /* fallthru */
+        default:
             unallocated_encoding(s);
             return;
         }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_fixed_conv(DisasContext *s, uint32_t insn)
     bool sf = extract32(insn, 31, 1);
     bool itof;
 
-    if (sbit || (type > 1)
-        || (!sf && scale < 32)) {
+    if (sbit || (!sf && scale < 32)) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0: /* float32 */
+    case 1: /* float64 */
+        break;
+    case 3: /* float16 */
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 30 ++++++++++++++----------------
 1 file changed, 14 insertions(+), 16 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 read_fp_sreg(DisasContext *s, int reg)
     return v;
 }
 
+static TCGv_i32 read_fp_hreg(DisasContext *s, int reg)
+{
+    TCGv_i32 v = tcg_temp_new_i32();
+
+    tcg_gen_ld16u_i32(v, cpu_env, fp_reg_offset(s, reg, MO_16));
+    return v;
+}
+
 /* Clear the bits above an N-bit vector, for N = (is_q ? 128 : 64).
  * If SVE is not enabled, then there are only 128 bits in the vector.
  */
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
 static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
 {
     TCGv_ptr fpst = NULL;
-    TCGv_i32 tcg_op = tcg_temp_new_i32();
+    TCGv_i32 tcg_op = read_fp_hreg(s, rn);
     TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
     switch (opcode) {
     case 0x0: /* FMOV */
         tcg_gen_mov_i32(tcg_res, tcg_op);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_diff(DisasContext *s, uint32_t insn)
         tcg_temp_free_i64(tcg_op2);
         tcg_temp_free_i64(tcg_res);
     } else {
-        TCGv_i32 tcg_op1 = tcg_temp_new_i32();
-        TCGv_i32 tcg_op2 = tcg_temp_new_i32();
+        TCGv_i32 tcg_op1 = read_fp_hreg(s, rn);
+        TCGv_i32 tcg_op2 = read_fp_hreg(s, rm);
         TCGv_i64 tcg_res = tcg_temp_new_i64();
 
-        read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-        read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
         gen_helper_neon_mull_s16(tcg_res, tcg_op1, tcg_op2);
         gen_helper_neon_addl_saturate_s32(tcg_res, cpu_env, tcg_res, tcg_res);
 
@@ -XXX,XX +XXX,XX @@ static void disas_simd_scalar_three_reg_same_fp16(DisasContext *s,
 
     fpst = get_fpstatus_ptr(true);
 
-    tcg_op1 = tcg_temp_new_i32();
-    tcg_op2 = tcg_temp_new_i32();
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
     tcg_res = tcg_temp_new_i32();
 
-    read_vec_element_i32(s, tcg_op1, rn, 0, MO_16);
-    read_vec_element_i32(s, tcg_op2, rm, 0, MO_16);
-
     switch (fpopcode) {
     case 0x03: /* FMULX */
         gen_helper_advsimd_mulxh(tcg_res, tcg_op1, tcg_op2, fpst);
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     }
 
     if (is_scalar) {
-        TCGv_i32 tcg_op = tcg_temp_new_i32();
+        TCGv_i32 tcg_op = read_fp_hreg(s, rn);
         TCGv_i32 tcg_res = tcg_temp_new_i32();
 
-        read_vec_element_i32(s, tcg_op, rn, 0, MO_16);
-
         switch (fpop) {
         case 0x1a: /* FCVTNS */
         case 0x1b: /* FCVTMS */
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 binary operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 65 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 65 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_2src_double(DisasContext *s, int opcode,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (2 source) - half precision */
+static void handle_fp_2src_half(DisasContext *s, int opcode,
+                                int rd, int rn, int rm)
+{
+    TCGv_i32 tcg_op1;
+    TCGv_i32 tcg_op2;
+    TCGv_i32 tcg_res;
+    TCGv_ptr fpst;
+
+    tcg_res = tcg_temp_new_i32();
+    fpst = get_fpstatus_ptr(true);
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+
+    switch (opcode) {
+    case 0x0: /* FMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x1: /* FDIV */
+        gen_helper_advsimd_divh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x2: /* FADD */
+        gen_helper_advsimd_addh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x3: /* FSUB */
+        gen_helper_advsimd_subh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x4: /* FMAX */
+        gen_helper_advsimd_maxh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x5: /* FMIN */
+        gen_helper_advsimd_minh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x6: /* FMAXNM */
+        gen_helper_advsimd_maxnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x7: /* FMINNM */
+        gen_helper_advsimd_minnumh(tcg_res, tcg_op1, tcg_op2, fpst);
+        break;
+    case 0x8: /* FNMUL */
+        gen_helper_advsimd_mulh(tcg_res, tcg_op1, tcg_op2, fpst);
+        tcg_gen_xori_i32(tcg_res, tcg_res, 0x8000);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (2 source)
  *   31  30  29 28       24 23  22  21 20  16 15    12 11 10 9    5 4    0
  * +---+---+---+-----------+------+---+------+--------+-----+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_2src(DisasContext *s, uint32_t insn)
         }
         handle_fp_2src_double(s, opcode, rd, rn, rm);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_2src_half(s, opcode, rd, rn, rm);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Richard Henderson <richard.henderson@linaro.org>

We missed all of the scalar fp16 fma operations.

Cc: qemu-stable@nongnu.org
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 48 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_3src_double(DisasContext *s, bool o0, bool o1,
     tcg_temp_free_i64(tcg_res);
 }
 
+/* Floating-point data-processing (3 source) - half precision */
+static void handle_fp_3src_half(DisasContext *s, bool o0, bool o1,
+                                int rd, int rn, int rm, int ra)
+{
+    TCGv_i32 tcg_op1, tcg_op2, tcg_op3;
+    TCGv_i32 tcg_res = tcg_temp_new_i32();
+    TCGv_ptr fpst = get_fpstatus_ptr(true);
+
+    tcg_op1 = read_fp_hreg(s, rn);
+    tcg_op2 = read_fp_hreg(s, rm);
+    tcg_op3 = read_fp_hreg(s, ra);
+
+    /* These are fused multiply-add, and must be done as one
+     * floating point operation with no rounding between the
+     * multiplication and addition steps.
+     * NB that doing the negations here as separate steps is
+     * correct : an input NaN should come out with its sign bit
+     * flipped if it is a negated-input.
+     */
+    if (o1 == true) {
+        tcg_gen_xori_i32(tcg_op3, tcg_op3, 0x8000);
+    }
+
+    if (o0 != o1) {
+        tcg_gen_xori_i32(tcg_op1, tcg_op1, 0x8000);
+    }
+
+    gen_helper_advsimd_muladdh(tcg_res, tcg_op1, tcg_op2, tcg_op3, fpst);
+
+    write_fp_sreg(s, rd, tcg_res);
+
+    tcg_temp_free_ptr(fpst);
+    tcg_temp_free_i32(tcg_op1);
+    tcg_temp_free_i32(tcg_op2);
+    tcg_temp_free_i32(tcg_op3);
+    tcg_temp_free_i32(tcg_res);
+}
+
 /* Floating point data-processing (3 source)
  *   31  30  29 28       24 23  22  21  20  16  15  14  10 9    5 4    0
  * +---+---+---+-----------+------+----+------+----+------+------+------+
@@ -XXX,XX +XXX,XX @@ static void disas_fp_3src(DisasContext *s, uint32_t insn)
         }
         handle_fp_3src_double(s, o0, o1, rd, rn, rm, ra);
         break;
+    case 3:
+        if (!arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            unallocated_encoding(s);
+            return;
+        }
+        if (!fp_access_check(s)) {
+            return;
+        }
+        handle_fp_3src_half(s, o0, o1, rd, rn, rm, ra);
+        break;
     default:
         unallocated_encoding(s);
     }
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These where missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-9-richard.henderson@linaro.org
[rth: Diagnose lack of FP16 before fp_access_check]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper-a64.h    |  2 +
 target/arm/helper-a64.c    | 10 +++++
 target/arm/translate-a64.c | 88 ++++++++++++++++++++++++++++++--------
 3 files changed, 83 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper-a64.h b/target/arm/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.h
+++ b/target/arm/helper-a64.h
@@ -XXX,XX +XXX,XX @@
 DEF_HELPER_FLAGS_2(udiv64, TCG_CALL_NO_RWG_SE, i64, i64, i64)
 DEF_HELPER_FLAGS_2(sdiv64, TCG_CALL_NO_RWG_SE, s64, s64, s64)
 DEF_HELPER_FLAGS_1(rbit64, TCG_CALL_NO_RWG_SE, i64, i64)
+DEF_HELPER_3(vfp_cmph_a64, i64, f16, f16, ptr)
+DEF_HELPER_3(vfp_cmpeh_a64, i64, f16, f16, ptr)
 DEF_HELPER_3(vfp_cmps_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpes_a64, i64, f32, f32, ptr)
 DEF_HELPER_3(vfp_cmpd_a64, i64, f64, f64, ptr)
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t float_rel_to_flags(int res)
     return flags;
 }
 
+uint64_t HELPER(vfp_cmph_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare_quiet(x, y, fp_status));
+}
+
+uint64_t HELPER(vfp_cmpeh_a64)(float16 x, float16 y, void *fp_status)
+{
+    return float_rel_to_flags(float16_compare(x, y, fp_status));
+}
+
 uint64_t HELPER(vfp_cmps_a64)(float32 x, float32 y, void *fp_status)
 {
     return float_rel_to_flags(float32_compare_quiet(x, y, fp_status));
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_data_proc_reg(DisasContext *s, uint32_t insn)
     }
 }
 
-static void handle_fp_compare(DisasContext *s, bool is_double,
+static void handle_fp_compare(DisasContext *s, int size,
                               unsigned int rn, unsigned int rm,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = get_fpstatus_ptr(false);
+    TCGv_ptr fpst = get_fpstatus_ptr(size == MO_16);
 
-    if (is_double) {
+    if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
 
         tcg_vn = read_fp_dreg(s, rn);
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
         tcg_temp_free_i64(tcg_vn);
         tcg_temp_free_i64(tcg_vm);
     } else {
-        TCGv_i32 tcg_vn, tcg_vm;
+        TCGv_i32 tcg_vn = tcg_temp_new_i32();
+        TCGv_i32 tcg_vm = tcg_temp_new_i32();
 
-        tcg_vn = read_fp_sreg(s, rn);
+        read_vec_element_i32(s, tcg_vn, rn, 0, size);
         if (cmp_with_zero) {
-            tcg_vm = tcg_const_i32(0);
+            tcg_gen_movi_i32(tcg_vm, 0);
         } else {
-            tcg_vm = read_fp_sreg(s, rm);
+            read_vec_element_i32(s, tcg_vm, rm, 0, size);
         }
-        if (signal_all_nans) {
-            gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
-        } else {
-            gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+
+        switch (size) {
+        case MO_32:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpes_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmps_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        case MO_16:
+            if (signal_all_nans) {
+                gen_helper_vfp_cmpeh_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            } else {
+                gen_helper_vfp_cmph_a64(tcg_flags, tcg_vn, tcg_vm, fpst);
+            }
+            break;
+        default:
+            g_assert_not_reached();
         }
+
         tcg_temp_free_i32(tcg_vn);
         tcg_temp_free_i32(tcg_vm);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, bool is_double,
 static void disas_fp_compare(DisasContext *s, uint32_t insn)
 {
     unsigned int mos, type, rm, op, rn, opc, op2r;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     op = extract32(insn, 14, 2);
     rn = extract32(insn, 5, 5);
     opc = extract32(insn, 3, 2);
     op2r = extract32(insn, 0, 3);
 
-    if (mos || op || op2r || type > 1) {
+    if (mos || op || op2r) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_compare(DisasContext *s, uint32_t insn)
         return;
     }
 
-    handle_fp_compare(s, type, rn, rm, opc & 1, opc & 2);
+    handle_fp_compare(s, size, rn, rm, opc & 1, opc & 2);
 }
 
 /* Floating point conditional compare
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, op, nzcv;
     TCGv_i64 tcg_flags;
     TCGLabel *label_continue = NULL;
+    int size;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     op = extract32(insn, 4, 1);
     nzcv = extract32(insn, 0, 4);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        size = MO_32;
+        break;
+    case 1:
+        size = MO_64;
+        break;
+    case 3:
+        size = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_ccomp(DisasContext *s, uint32_t insn)
         gen_set_label(label_match);
     }
 
-    handle_fp_compare(s, type, rn, rm, false, op);
+    handle_fp_compare(s, size, rn, rm, false, op);
 
     if (cond < 0x0e) {
         gen_set_label(label_continue);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

These were missed out from the rest of the half-precision work.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-10-richard.henderson@linaro.org
[rth: Fix erroneous check vs type]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     unsigned int mos, type, rm, cond, rn, rd;
     TCGv_i64 t_true, t_false, t_zero;
     DisasCompare64 c;
+    TCGMemOp sz;
 
     mos = extract32(insn, 29, 3);
-    type = extract32(insn, 22, 2); /* 0 = single, 1 = double */
+    type = extract32(insn, 22, 2);
     rm = extract32(insn, 16, 5);
     cond = extract32(insn, 12, 4);
     rn = extract32(insn, 5, 5);
     rd = extract32(insn, 0, 5);
 
-    if (mos || type > 1) {
+    if (mos) {
+        unallocated_encoding(s);
+        return;
+    }
+
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
         return;
     }
 
-    /* Zero extend sreg inputs to 64 bits now.  */
+    /* Zero extend sreg & hreg inputs to 64 bits now.  */
     t_true = tcg_temp_new_i64();
     t_false = tcg_temp_new_i64();
-    read_vec_element(s, t_true, rn, 0, type ? MO_64 : MO_32);
-    read_vec_element(s, t_false, rm, 0, type ? MO_64 : MO_32);
+    read_vec_element(s, t_true, rn, 0, sz);
+    read_vec_element(s, t_false, rm, 0, sz);
 
     a64_test_cc(&c, cond);
     t_zero = tcg_const_i64(0);
@@ -XXX,XX +XXX,XX @@ static void disas_fp_csel(DisasContext *s, uint32_t insn)
     tcg_temp_free_i64(t_false);
     a64_free_cc(&c);
 
-    /* Note that sregs write back zeros to the high bits,
+    /* Note that sregs & hregs write back zeros to the high bits,
        and we've already done the zero-extension.  */
     write_fp_dreg(s, rd, t_true);
     tcg_temp_free_i64(t_true);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

All the hard work is already done by vfp_expand_imm, we just need to
make sure we pick up the correct size.

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180512003217.9105-11-richard.henderson@linaro.org
[rth: Merge unallocated_encoding check with TCGMemOp conversion.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
 {
     int rd = extract32(insn, 0, 5);
     int imm8 = extract32(insn, 13, 8);
-    int is_double = extract32(insn, 22, 2);
+    int type = extract32(insn, 22, 2);
     uint64_t imm;
     TCGv_i64 tcg_res;
+    TCGMemOp sz;
 
-    if (is_double > 1) {
+    switch (type) {
+    case 0:
+        sz = MO_32;
+        break;
+    case 1:
+        sz = MO_64;
+        break;
+    case 3:
+        sz = MO_16;
+        if (arm_dc_feature(s, ARM_FEATURE_V8_FP16)) {
+            break;
+        }
+        /* fallthru */
+    default:
         unallocated_encoding(s);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void disas_fp_imm(DisasContext *s, uint32_t insn)
         return;
     }
 
-    imm = vfp_expand_imm(MO_32 + is_double, imm8);
+    imm = vfp_expand_imm(sz, imm8);
 
     tcg_res = tcg_const_i64(imm);
     write_fp_dreg(s, rd, tcg_res);
-- 
2.17.0

From: Alex Bennée <alex.bennee@linaro.org>

We are meant to explicitly pass fpst, not cpu_env.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180512003217.9105-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_fp_1src_half(DisasContext *s, int opcode, int rd, int rn)
         tcg_gen_xori_i32(tcg_res, tcg_op, 0x8000);
         break;
     case 0x3: /* FSQRT */
-        gen_helper_sqrt_f16(tcg_res, tcg_op, cpu_env);
+        fpst = get_fpstatus_ptr(true);
+        gen_helper_sqrt_f16(tcg_res, tcg_op, fpst);
         break;
     case 0x8: /* FRINTN */
     case 0x9: /* FRINTP */
-- 
2.17.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Per the Physical Layer Simplified Spec. "4.3.10.4 Switch Function Status":

The block length is predefined to 512 bits

and "4.10.2 SD Status":

The SD Status contains status bits that are related to the SD Memory Card
  proprietary features and may be used for future application-specific usage.
  The size of the SD Status is one data block of 512 bit. The content of this
  register is transmitted to the Host over the DAT bus along with a 16-bit CRC.

Thus the 16-bit CRC goes at offset 64.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180509060104.4458-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ static void sd_function_switch(SDState *sd, uint32_t arg)
         sd->data[14 + (i >> 1)] = new_func << ((i * 4) & 4);
     }
     memset(&sd->data[17], 0, 47);
-    stw_be_p(sd->data + 65, sd_crc16(sd->data, 64));
+    stw_be_p(sd->data + 64, sd_crc16(sd->data, 64));
 }
 
 static inline bool sd_wp_addr(SDState *sd, uint64_t addr)
-- 
2.17.0

Usually the logging of the CPU state produced by -d cpu is sufficient
to diagnose problems, but sometimes you want to see the state of
the floating point registers as well. We don't want to enable that
by default as it adds a lot of extra data to the log; instead,
allow it to be optionally enabled via -d fpu.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20180510130024.31678-1-peter.maydell@linaro.org
---
 include/qemu/log.h   | 1 +
 accel/tcg/cpu-exec.c | 9 ++++++---
 util/log.c           | 2 ++
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/include/qemu/log.h b/include/qemu/log.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -XXX,XX +XXX,XX @@ static inline bool qemu_log_separate(void)
 #define CPU_LOG_PAGE       (1 << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
 #define CPU_LOG_TB_OP_IND  (1 << 16)
+#define CPU_LOG_TB_FPU     (1 << 17)
 
 /* Lock output for a series of related logs.  Since this is not needed
  * for a single qemu_log / qemu_log_mask / qemu_log_mask_and_addr, we
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static inline tcg_target_ulong cpu_tb_exec(CPUState *cpu, TranslationBlock *itb)
     if (qemu_loglevel_mask(CPU_LOG_TB_CPU)
         && qemu_log_in_addr_range(itb->pc)) {
         qemu_log_lock();
+        int flags = 0;
+        if (qemu_loglevel_mask(CPU_LOG_TB_FPU)) {
+            flags |= CPU_DUMP_FPU;
+        }
 #if defined(TARGET_I386)
-        log_cpu_state(cpu, CPU_DUMP_CCOP);
-#else
-        log_cpu_state(cpu, 0);
+        flags |= CPU_DUMP_CCOP;
 #endif
+        log_cpu_state(cpu, flags);
         qemu_log_unlock();
     }
 #endif /* DEBUG_DISAS */
diff --git a/util/log.c b/util/log.c
index XXXXXXX..XXXXXXX 100644
--- a/util/log.c
+++ b/util/log.c
@@ -XXX,XX +XXX,XX @@ const QEMULogItem qemu_log_items[] = {
       "show trace before each executed TB (lots of logs)" },
     { CPU_LOG_TB_CPU, "cpu",
       "show CPU registers before entering a TB (lots of logs)" },
+    { CPU_LOG_TB_FPU, "fpu",
+      "include FPU registers in the 'cpu' logging" },
     { CPU_LOG_MMU, "mmu",
       "log MMU-related activities" },
     { CPU_LOG_PCALL, "pcall",
-- 
2.17.0

Mostly straightforward bugfixes. The new Xilinx devices are
arguably 'new feature', but they're fixing a regression where
our changes to PSCI in commit 3f37979bf mean that EL3 guest
code now needs to talk to a proper emulated power-controller
device to turn on secondary CPUs; and it's not yet rc1 and
they only affect the Xilinx board, so it seems OK to me.

thanks
-- PMM

The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:

Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220318

for you to fetch changes up to 79d54c9eac04c554e3c081589542f801ace71797:

util/osdep: Remove some early cruft (2022-03-18 11:32:13 +0000)

----------------------------------------------------------------
target-arm queue:
 * Fix sve2 ldnt1 and stnt1
 * Fix pauth_check_trap vs SEL2
 * Fix handling of LPAE block descriptors
 * hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
 * hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
 * nsis installer: List emulators in alphabetical order
 * nsis installer: Suppress "ANSI targets are deprecated" warning
 * nsis installer: Fix mouse-over descriptions for emulators
 * hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset
 * Improve M-profile vector table access logging
 * Xilinx ZynqMP: model CRF and APU control
 * Fix compile issues on modern Solaris

----------------------------------------------------------------
Andrew Deason (3):
      util/osdep: Avoid madvise proto on modern Solaris
      hw/i386/acpi-build: Avoid 'sun' identifier
      util/osdep: Remove some early cruft

Edgar E. Iglesias (6):
      hw/arm/xlnx-zynqmp: Add an unimplemented SERDES area
      target/arm: Make rvbar settable after realize
      hw/misc: Add a model of the Xilinx ZynqMP CRF
      hw/arm/xlnx-zynqmp: Connect the ZynqMP CRF
      hw/misc: Add a model of the Xilinx ZynqMP APU Control
      hw/arm/xlnx-zynqmp: Connect the ZynqMP APU Control

Eric Auger (2):
      hw/intc: Rename CONFIG_ARM_GIC_TCG into CONFIG_ARM_GICV3_TCG
      hw/arm/virt: Fix gic-version=max when CONFIG_ARM_GICV3_TCG is unset

Peter Maydell (8):
      target/arm: Fix handling of LPAE block descriptors
      hw/dma/xlnx_csu_dma: Set TYPE_XLNX_CSU_DMA class_size
      hw/misc/npcm7xx_clk: Don't leak string in npcm7xx_clk_sel_init()
      nsis installer: List emulators in alphabetical order
      nsis installer: Suppress "ANSI targets are deprecated" warning
      nsis installer: Fix mouse-over descriptions for emulators
      target/arm: Log M-profile vector table accesses
      target/arm: Log fault address for M-profile faults

Richard Henderson (2):
      target/arm: Fix sve2 ldnt1 and stnt1
      target/arm: Fix pauth_check_trap vs SEL2

meson.build                            |  23 ++-
 include/hw/arm/xlnx-zynqmp.h           |   4 +
 include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 ++++++++++++
 include/hw/misc/xlnx-zynqmp-crf.h      | 211 ++++++++++++++++++++++++++
 include/qemu/osdep.h                   |   8 +
 target/arm/cpu.h                       |   3 +-
 target/arm/sve.decode                  |   5 +-
 hw/arm/virt.c                          |   7 +-
 hw/arm/xlnx-zynqmp.c                   |  46 +++++-
 hw/dma/xlnx_csu_dma.c                  |   1 +
 hw/i386/acpi-build.c                   |   4 +-
 hw/misc/npcm7xx_clk.c                  |   4 +-
 hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++++++++
 hw/misc/xlnx-zynqmp-crf.c              | 266 +++++++++++++++++++++++++++++++++
 target/arm/cpu.c                       |  17 ++-
 target/arm/helper.c                    |  20 ++-
 target/arm/m_helper.c                  |  11 ++
 target/arm/pauth_helper.c              |   2 +-
 target/arm/translate-sve.c             |  51 ++++++-
 tests/tcg/aarch64/test-826.c           |  50 +++++++
 util/osdep.c                           |  10 --
 hw/intc/Kconfig                        |   2 +-
 hw/intc/meson.build                    |   4 +-
 hw/misc/meson.build                    |   2 +
 qemu.nsi                               |   8 +-
 scripts/nsis.py                        |  17 ++-
 tests/tcg/aarch64/Makefile.target      |   4 +
 tests/tcg/configure.sh                 |   4 +
 28 files changed, 1084 insertions(+), 46 deletions(-)
 create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
 create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
 create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c
 create mode 100644 hw/misc/xlnx-zynqmp-crf.c
 create mode 100644 tests/tcg/aarch64/test-826.c

From: Richard Henderson <richard.henderson@linaro.org>

For both ldnt1 and stnt1, the meaning of the Rn and Rm are different
from ld1 and st1: the vector and integer registers are reversed, and
the integer register 31 refers to XZR instead of SP.

Secondly, the 64-bit version of ldnt1 was being interpreted as
32-bit unpacked unscaled offset instead of 64-bit unscaled offset,
which discarded the upper 32 bits of the address coming from
the vector argument.

Thirdly, validate that the memory element size is in range for the
vector element size for ldnt1.  For ld1, we do this via independent
decode patterns, but for ldnt1 we need to do it manually.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/826
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220308031655.240710-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve.decode             |  5 ++-
 target/arm/translate-sve.c        | 51 +++++++++++++++++++++++++++++--
 tests/tcg/aarch64/test-826.c      | 50 ++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  4 +++
 tests/tcg/configure.sh            |  4 +++
 5 files changed, 109 insertions(+), 5 deletions(-)
 create mode 100644 tests/tcg/aarch64/test-826.c

diff --git a/target/arm/sve.decode b/target/arm/sve.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve.decode
+++ b/target/arm/sve.decode
@@ -XXX,XX +XXX,XX @@ USDOT_zzzz      01000100 .. 0 ..... 011 110 ..... .....  @rda_rn_rm
 
 ### SVE2 Memory Gather Load Group
 
-# SVE2 64-bit gather non-temporal load
-#   (scalar plus unpacked 32-bit unscaled offsets)
+# SVE2 64-bit gather non-temporal load (scalar plus 64-bit unscaled offsets)
 LDNT1_zprz      1100010 msz:2 00 rm:5 1 u:1 0 pg:3 rn:5 rd:5 \
-                &rprr_gather_load xs=0 esz=3 scale=0 ff=0
+                &rprr_gather_load xs=2 esz=3 scale=0 ff=0
 
 # SVE2 32-bit gather non-temporal load (scalar plus 32-bit unscaled offsets)
 LDNT1_zprz      1000010 msz:2 00 rm:5 10 u:1 pg:3 rn:5 rd:5 \
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_LD1_zpiz(DisasContext *s, arg_LD1_zpiz *a)
 
 static bool trans_LDNT1_zprz(DisasContext *s, arg_LD1_zprz *a)
 {
+    gen_helper_gvec_mem_scatter *fn = NULL;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (a->esz < a->msz + !a->u) {
+        return false;
+    }
     if (!dc_isar_feature(aa64_sve2, s)) {
         return false;
     }
-    return trans_LD1_zprz(s, a);
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    switch (a->esz) {
+    case MO_32:
+        fn = gather_load_fn32[mte][be][0][0][a->u][a->msz];
+        break;
+    case MO_64:
+        fn = gather_load_fn64[mte][be][0][2][a->u][a->msz];
+        break;
+    }
+    assert(fn != NULL);
+
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), a->msz, false, fn);
+    return true;
 }
 
 /* Indexed by [mte][be][xs][msz].  */
@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a)
 
 static bool trans_STNT1_zprz(DisasContext *s, arg_ST1_zprz *a)
 {
+    gen_helper_gvec_mem_scatter *fn;
+    bool be = s->be_data == MO_BE;
+    bool mte = s->mte_active[0];
+
+    if (a->esz < a->msz) {
+        return false;
+    }
     if (!dc_isar_feature(aa64_sve2, s)) {
         return false;
     }
-    return trans_ST1_zprz(s, a);
+    if (!sve_access_check(s)) {
+        return true;
+    }
+
+    switch (a->esz) {
+    case MO_32:
+        fn = scatter_store_fn32[mte][be][0][a->msz];
+        break;
+    case MO_64:
+        fn = scatter_store_fn64[mte][be][2][a->msz];
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    do_mem_zpz(s, a->rd, a->pg, a->rn, 0,
+               cpu_reg(s, a->rm), a->msz, true, fn);
+    return true;
 }
 
 /*
diff --git a/tests/tcg/aarch64/test-826.c b/tests/tcg/aarch64/test-826.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/test-826.c
@@ -XXX,XX +XXX,XX @@
+#include <sys/mman.h>
+#include <unistd.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <assert.h>
+
+static void *expected;
+
+void sigsegv(int sig, siginfo_t *info, void *vuc)
+{
+    ucontext_t *uc = vuc;
+
+    assert(info->si_addr == expected);
+    uc->uc_mcontext.pc += 4;
+}
+
+int main()
+{
+    struct sigaction sa = {
+        .sa_sigaction = sigsegv,
+        .sa_flags = SA_SIGINFO
+    };
+
+    void *page;
+    long ofs;
+
+    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
+        perror("sigaction");
+        return EXIT_FAILURE;
+    }
+
+    page = mmap(0, getpagesize(), PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0);
+    if (page == MAP_FAILED) {
+        perror("mmap");
+        return EXIT_FAILURE;
+    }
+
+    ofs = 0x124;
+    expected = page + ofs;
+
+    asm("ptrue p0.d, vl1\n\t"
+        "dup z0.d, %0\n\t"
+        "ldnt1h {z1.d}, p0/z, [z0.d, %1]\n\t"
+        "dup z1.d, %1\n\t"
+        "ldnt1h {z0.d}, p0/z, [z1.d, %0]"
+        : : "r"(page), "r"(ofs) : "v0", "v1");
+
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-gdbstub-sve-ioctls: sve-ioctls
 
 EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls
 endif
+endif
 
+ifneq ($(DOCKER_IMAGE)$(CROSS_CC_HAS_SVE2),)
+AARCH64_TESTS += test-826
+test-826: CFLAGS+=-march=armv8.1-a+sve2
 endif
 
 TESTS += $(AARCH64_TESTS)
diff --git a/tests/tcg/configure.sh b/tests/tcg/configure.sh
index XXXXXXX..XXXXXXX 100755
--- a/tests/tcg/configure.sh
+++ b/tests/tcg/configure.sh
@@ -XXX,XX +XXX,XX @@ for target in $target_list; do
                              -march=armv8.1-a+sve -o $TMPE $TMPC; then
                   echo "CROSS_CC_HAS_SVE=y" >> $config_target_mak
               fi
+              if do_compiler "$target_compiler" $target_compiler_cflags \
+                             -march=armv8.1-a+sve2 -o $TMPE $TMPC; then
+                  echo "CROSS_CC_HAS_SVE2=y" >> $config_target_mak
+              fi
               if do_compiler "$target_compiler" $target_compiler_cflags \
                              -march=armv8.3-a -o $TMPE $TMPC; then
                   echo "CROSS_CC_HAS_ARMV8_3=y" >> $config_target_mak
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When arm_is_el2_enabled was introduced, we missed
updating pauth_check_trap.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/788
Fixes: e6ef0169264b ("target/arm: use arm_is_el2_enabled() where applicable")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220315021205.342768-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/pauth_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN pauth_trap(CPUARMState *env, int target_el,
 
 static void pauth_check_trap(CPUARMState *env, int el, uintptr_t ra)
 {
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         bool trap = !(hcr & HCR_API);
         if (el == 0) {
-- 
2.25.1

LPAE descriptors come in three forms:

* table descriptors, giving the address of the next level page table
 * page descriptors, which occur only at level 3 and describe the
   mapping of one page (which might be 4K, 16K or 64K)
 * block descriptors, which occur at higher page table levels, and
   describe the mapping of huge pages

QEMU's page-table-walk code treats block and page entries
identically, simply ORing in a number of bits from the input virtual
address that depends on the level of the page table that we stopped
at; we depend on the previous masking of descaddr with descaddrmask
to have already cleared out the low bits of the descriptor word.

This is not quite right: the address field in a block descriptor is
smaller, and so there are bits which are valid address bits in a page
descriptor or a table descriptor but which are not supposed to be
part of the address in a block descriptor, and descaddrmask does not
clear them.  We previously mostly got away with this because those
descriptor bits are RES0; however with FEAT_BBM (part of Armv8.4)
block descriptor bit 16 is defined to be the nT bit.  No emulated
QEMU CPU has FEAT_BBM yet, but if the host CPU has it then we might
see it when using KVM or hvf.

Explicitly zero out all the descaddr bits we're about to OR vaddr
bits into.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/790
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220304165628.2345765-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
             indexmask = indexmask_grainsize;
             continue;
         }
-        /* Block entry at level 1 or 2, or page entry at level 3.
+        /*
+         * Block entry at level 1 or 2, or page entry at level 3.
          * These are basically the same thing, although the number
-         * of bits we pull in from the vaddr varies.
+         * of bits we pull in from the vaddr varies. Note that although
+         * descaddrmask masks enough of the low bits of the descriptor
+         * to give a correct page or table address, the address field
+         * in a block descriptor is smaller; so we need to explicitly
+         * clear the lower bits here before ORing in the low vaddr bits.
          */
         page_size = (1ULL << ((stride * (4 - level)) + 3));
+        descaddr &= ~(page_size - 1);
         descaddr |= (address & (page_size - 1));
         /* Extract attributes from the descriptor */
         attrs = extract64(descriptor, 2, 10)
-- 
2.25.1

In commit 00f05c02f9e7342f we gave the TYPE_XLNX_CSU_DMA object its
own class struct, but forgot to update the TypeInfo::class_size
accordingly.  This meant that not enough memory was allocated for the
class struct, and the initialization of xcdc->read in the class init
function wrote off the end of the memory. Add the missing line.

Found by running 'check-qtest-aarch64' with a clang
address-sanitizer build, which complains:

==2542634==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x61000000ab00 at pc 0x559a20aebc29 bp 0x7fff97df74d0 sp 0x7fff97df74c8
WRITE of size 8 at 0x61000000ab00 thread T0
    #0 0x559a20aebc28 in xlnx_csu_dma_class_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../hw/dma/xlnx_csu_dma.c:722:16
    #1 0x559a21bf297c in type_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:365:9
    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5
    #3 0x7f09bcb641b7 in g_hash_table_foreach (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x401b7)
    #4 0x559a21bf3c27 in object_class_foreach /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1092:5
    #5 0x559a21bf3c27 in object_class_get_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1149:5
    #6 0x559a2081a2fd in select_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:1661:24
    #7 0x559a2081a2fd in qemu_create_machine /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:2146:35
    #8 0x559a2081a2fd in qemu_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/vl.c:3706:5
    #9 0x559a20720ed5 in main /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../softmmu/main.c:49:5
    #10 0x7f09baec00b2 in __libc_start_main /build/glibc-sMfBJT/glibc-2.31/csu/../csu/libc-start.c:308:16
    #11 0x559a2067673d in _start (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xf4b73d)

0x61000000ab00 is located 0 bytes to the right of 192-byte region [0x61000000aa40,0x61000000ab00)
allocated by thread T0 here:
    #0 0x559a206eeff2 in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/qemu-system-aarch64+0xfc3ff2)
    #1 0x7f09bcb7bef0 in g_malloc0 (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x57ef0)
    #2 0x559a21bf3442 in object_class_foreach_tramp /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/san/../../qom/object.c:1070:5

Fixes: 00f05c02f9e7342f ("hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20220308150207.2546272-1-peter.maydell@linaro.org
---
 hw/dma/xlnx_csu_dma.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo xlnx_csu_dma_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(XlnxCSUDMA),
     .class_init    = xlnx_csu_dma_class_init,
+    .class_size    = sizeof(XlnxCSUDMAClass),
     .instance_init = xlnx_csu_dma_init,
     .interfaces = (InterfaceInfo[]) {
         { TYPE_STREAM_SINK },
-- 
2.25.1

In npcm7xx_clk_sel_init() we allocate a string with g_strdup_printf().
Use g_autofree so we free it rather than leaking it.

(Detected with the clang leak sanitizer.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220308170302.2582820-1-peter.maydell@linaro.org
---
 hw/misc/npcm7xx_clk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm7xx_clk.c b/hw/misc/npcm7xx_clk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/npcm7xx_clk.c
+++ b/hw/misc/npcm7xx_clk.c
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_clk_sel_init(Object *obj)
     NPCM7xxClockSELState *sel = NPCM7XX_CLOCK_SEL(obj);
 
     for (i = 0; i < NPCM7XX_CLK_SEL_MAX_INPUT; ++i) {
-        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel),
-                g_strdup_printf("clock-in[%d]", i),
+        g_autofree char *s = g_strdup_printf("clock-in[%d]", i);
+        sel->clock_in[i] = qdev_init_clock_in(DEVICE(sel), s,
                 npcm7xx_clk_update_sel_cb, sel, ClockUpdate);
     }
     sel->clock_out = qdev_init_clock_out(DEVICE(sel), "clock-out");
-- 
2.25.1

We currently list the emulators in the Windows installer's dialog
in an essentially random order (it's whatever glob.glob() returns
them to, which is filesystem-implementation-dependent). Add a
call to sorted() so they appear in alphabetical order.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20220305105743.2384766-2-peter.maydell@linaro.org
---
 scripts/nsis.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py
index XXXXXXX..XXXXXXX 100644
--- a/scripts/nsis.py
+++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
         with open(
             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
         ) as nsh:
-            for exe in glob.glob(
+            for exe in sorted(glob.glob(
                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
-            ):
+            )):
                 exe = os.path.basename(exe)
                 arch = exe[12:-4]
                 nsh.write(
-- 
2.25.1

We use the nsis.py script to write out an installer script Section
for each emulator executable, so the exact set of Sections depends on
which executables were built.  However the part of qemu.nsi which
specifies mouse-over descriptions for each Section still has a
hard-coded and very outdated list (with just i386 and alpha).  This
causes two problems.  Firstly, if you build the installer for a
configuration where you didn't build the i386 binaries you get
warnings like this:
  warning 6000: unknown variable/constant "{Section_i386}" detected, ignoring (macro:_==:1)
  warning 6000: unknown variable/constant "{Section_i386w}" detected, ignoring (macro:_==:1)
(this happens in our gitlab CI jobs, for instance).
Secondly, most of the emulators in the generated installer don't have
any mouseover text.

Make nsis.py generate a second output file which has the necessary
MUI_DESCRIPTION_TEXT lines for each Section it creates, so we can
include that at the right point in qemu.nsi to set the mouse-over
text.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: John Snow <jsnow@redhat.com>
Message-id: 20220305105743.2384766-4-peter.maydell@linaro.org
---
 qemu.nsi        |  5 +----
 scripts/nsis.py | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/qemu.nsi b/qemu.nsi
index XXXXXXX..XXXXXXX 100644
--- a/qemu.nsi
+++ b/qemu.nsi
@@ -XXX,XX +XXX,XX @@ SectionEnd
 ; Descriptions (mouse-over).
 !insertmacro MUI_FUNCTION_DESCRIPTION_BEGIN
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionSystem}  "System emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alpha}  "Alpha system emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_alphaw} "Alpha system emulation (GUI)."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386}   "PC i386 system emulation."
-    !insertmacro MUI_DESCRIPTION_TEXT ${Section_i386w}  "PC i386 system emulation (GUI)."
+!include "${BINDIR}\system-mui-text.nsh"
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionTools} "Tools."
 !ifdef DLLDIR
     !insertmacro MUI_DESCRIPTION_TEXT ${SectionDll}   "Runtime Libraries (DLL)."
diff --git a/scripts/nsis.py b/scripts/nsis.py
index XXXXXXX..XXXXXXX 100644
--- a/scripts/nsis.py
+++ b/scripts/nsis.py
@@ -XXX,XX +XXX,XX @@ def main():
         subprocess.run(["make", "install", "DESTDIR=" + destdir + os.path.sep])
         with open(
             os.path.join(destdir + args.prefix, "system-emulations.nsh"), "w"
-        ) as nsh:
+        ) as nsh, open(
+            os.path.join(destdir + args.prefix, "system-mui-text.nsh"), "w"
+        ) as muinsh:
             for exe in sorted(glob.glob(
                 os.path.join(destdir + args.prefix, "qemu-system-*.exe")
             )):
@@ -XXX,XX +XXX,XX @@ def main():
                         arch, exe
                     )
                 )
+                if arch.endswith('w'):
+                    desc = arch[:-1] + " emulation (GUI)."
+                else:
+                    desc = arch + " emulation."
+
+                muinsh.write(
+                    """
+                !insertmacro MUI_DESCRIPTION_TEXT ${{Section_{0}}} "{1}"
+                """.format(arch, desc))
 
         for exe in glob.glob(os.path.join(destdir + args.prefix, "*.exe")):
             signcode(exe)
-- 
2.25.1

From: Eric Auger <eric.auger@redhat.com>

CONFIG_ARM_GIC_TCG actually guards the compilation of TCG GICv3
specific files. So let's rename it into CONFIG_ARM_GICV3_TCG

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20220308182452.223473-2-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/Kconfig     | 2 +-
 hw/intc/meson.build | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config APIC
     select MSI_NONBROKEN
     select I8259
 
-config ARM_GIC_TCG
+config ARM_GICV3_TCG
     bool
     default y
     depends on ARM_GIC && TCG
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gicv3_common.c',
   'arm_gicv3_its_common.c',
 ))
-softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
+softmmu_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files(
   'arm_gicv3.c',
   'arm_gicv3_dist.c',
   'arm_gicv3_its.c',
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
 specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
 specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
-specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
+specific_ss.add(when: 'CONFIG_ARM_GICV3_TCG', if_true: files('arm_gicv3_cpuif.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
 specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
 specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
-- 
2.25.1

From: Eric Auger <eric.auger@redhat.com>

In TCG mode, if gic-version=max we always select GICv3 even if
CONFIG_ARM_GICV3_TCG is unset. We shall rather select GICv2.
This also brings the benefit of fixing qos tests errors for tests
using gic-version=max with CONFIG_ARM_GICV3_TCG unset.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20220308182452.223473-3-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
         vms->gic_version = VIRT_GIC_VERSION_2;
         break;
     case VIRT_GIC_VERSION_MAX:
-        vms->gic_version = VIRT_GIC_VERSION_3;
+        if (module_object_class_by_name("arm-gicv3")) {
+            /* CONFIG_ARM_GICV3_TCG was set */
+            vms->gic_version = VIRT_GIC_VERSION_3;
+        } else {
+            vms->gic_version = VIRT_GIC_VERSION_2;
+        }
         break;
     case VIRT_GIC_VERSION_HOST:
         error_report("gic-version=host requires KVM");
-- 
2.25.1

Currently the CPU_LOG_INT logging misses some useful information
about loads from the vector table.  Add logging where we load vector
table entries.  This is particularly helpful for cases where the user
has accidentally not put a vector table in their image at all, which
can result in confusing guest crashes at startup.

Here's an example of the new logging for a case where
the vector table contains garbage:

Loaded reset SP 0x0 PC 0x0 from vector table
Loaded reset SP 0xd008f8df PC 0xf000bf00 from vector table
Taking exception 3 [Prefetch Abort] on CPU 0
...with CFSR.IACCVIOL
...BusFault with BFSR.STKERR
...taking pending nonsecure exception 3
...loading from element 3 of non-secure vector table at 0xc
...loaded new PC 0x20000558
----------------
IN:
0x20000558:  08000079  stmdaeq  r0, {r0, r3, r4, r5, r6}

(The double reset logging is the result of our long-standing
"CPUs all get reset twice" weirdness; it looks a bit ugly
but it'll go away if we ever fix that :-))

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220315204306.2797684-2-peter.maydell@linaro.org
---
 target/arm/cpu.c      | 5 +++++
 target/arm/m_helper.c | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
 #include "qemu/timer.h"
+#include "qemu/log.h"
 #include "qemu-common.h"
 #include "target/arm/idau.h"
 #include "qemu/module.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
             initial_pc = ldl_phys(s->as, vecbase + 4);
         }
 
+        qemu_log_mask(CPU_LOG_INT,
+                      "Loaded reset SP 0x%x PC 0x%x from vector table\n",
+                      initial_msp, initial_pc);
+
         env->regs[13] = initial_msp & 0xFFFFFFFC;
         env->regs[15] = initial_pc & ~1;
         env->thumb = initial_pc & 1;
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
     ARMMMUIdx mmu_idx;
     bool exc_secure;
 
+    qemu_log_mask(CPU_LOG_INT,
+                  "...loading from element %d of %s vector table at 0x%x\n",
+                  exc, targets_secure ? "secure" : "non-secure", addr);
+
     mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, targets_secure, true);
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
         goto load_fail;
     }
     *pvec = vector_entry;
+    qemu_log_mask(CPU_LOG_INT, "...loaded new PC 0x%x\n", *pvec);
     return true;
 
 load_fail:
-- 
2.25.1

For M-profile, the fault address is not always exposed to the guest
in a fault register (for instance the BFAR bus fault address register
is only updated for bus faults on data accesses, not instruction
accesses).  Currently we log the address only if we're putting it
into a particular guest-visible register.  Since we always have it,
log it generically, to make logs of i-side faults a bit clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220315204306.2797684-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          * Note that for M profile we don't have a guest facing FSR, but
          * the env->exception.fsr will be populated by the code that
          * raises the fault, in the A profile short-descriptor format.
+         *
+         * Log the exception.vaddress now regardless of subtype, because
+         * logging below only logs it when it goes into a guest visible
+         * register.
          */
+        qemu_log_mask(CPU_LOG_INT, "...at fault address 0x%x\n",
+                      (uint32_t)env->exception.vaddress);
         switch (env->exception.fsr & 0xf) {
         case M_FAKE_FSR_NSC_EXEC:
             /*
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add an unimplemented SERDES (Serializer/Deserializer) area.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h | 2 +-
 hw/arm/xlnx-zynqmp.c         | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
 
 struct XlnxZynqMPState {
     /*< private >*/
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define QSPI_DMA_ADDR       0xff0f0800
 #define NUM_QSPI_IRQ_LINES  2
 
+/* Serializer/Deserializer.  */
+#define SERDES_ADDR         0xfd400000
+#define SERDES_SIZE         0x20000
+
 #define DP_ADDR             0xfd4a0000
 #define DP_IRQ              113
 
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
         hwaddr size;
     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
         { .name = "apu", APU_ADDR, APU_SIZE },
+        { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
     };
     unsigned int nr;
 
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Make the rvbar property settable after realize. This is done
in preparation to model the ZynqMP's runtime configurable rvbar.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-3-edgar.iglesias@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  3 ++-
 target/arm/cpu.c    | 12 +++++++-----
 target/arm/helper.c | 10 +++++++---
 3 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
             uint64_t vbar_el[4];
         };
         uint32_t mvbar; /* (monitor) vector base address register */
+        uint64_t rvbar; /* rvbar sampled from rvbar property at reset */
         struct { /* FCSE PID. */
             uint32_t fcseidr_ns;
             uint32_t fcseidr_s;
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
     uint32_t dcz_blocksize;
-    uint64_t rvbar;
+    uint64_t rvbar_prop; /* Property/input signals.  */
 
     /* Configurable aspects of GIC cpu interface (which is part of the CPU) */
     int gic_num_lrs; /* number of list registers */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         } else {
             env->pstate = PSTATE_MODE_EL1h;
         }
-        env->pc = cpu->rvbar;
+
+        /* Sample rvbar at reset.  */
+        env->cp15.rvbar = cpu->rvbar_prop;
+        env->pc = env->cp15.rvbar;
 #endif
     } else {
 #if defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_cbar_property =
 static Property arm_cpu_reset_hivecs_property =
             DEFINE_PROP_BOOL("reset-hivecs", ARMCPU, reset_hivecs, false);
 
-static Property arm_cpu_rvbar_property =
-            DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);
-
 #ifndef CONFIG_USER_ONLY
 static Property arm_cpu_has_el2_property =
             DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);
@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)
     }
 
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-        qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);
+        object_property_add_uint64_ptr(obj, "rvbar",
+                                       &cpu->rvbar_prop,
+                                       OBJ_PROP_FLAG_READWRITE);
     }
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             ARMCPRegInfo rvbar = {
                 .name = "RVBAR_EL1", .state = ARM_CP_STATE_AA64,
                 .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 0, .opc2 = 1,
-                .type = ARM_CP_CONST, .access = PL1_R, .resetvalue = cpu->rvbar
+                .access = PL1_R,
+                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
             };
             define_one_arm_cp_reg(cpu, &rvbar);
         }
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             ARMCPRegInfo rvbar = {
                 .name = "RVBAR_EL2", .state = ARM_CP_STATE_AA64,
                 .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 1,
-                .type = ARM_CP_CONST, .access = PL2_R, .resetvalue = cpu->rvbar
+                .access = PL2_R,
+                .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
             };
             define_one_arm_cp_reg(cpu, &rvbar);
         }
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         ARMCPRegInfo el3_regs[] = {
             { .name = "RVBAR_EL3", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 1,
-              .type = ARM_CP_CONST, .access = PL3_R, .resetvalue = cpu->rvbar },
+              .access = PL3_R,
+              .fieldoffset = offsetof(CPUARMState, cp15.rvbar),
+            },
             { .name = "SCTLR_EL3", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 0, .opc2 = 0,
               .access = PL3_RW,
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx ZynqMP CRF. At the moment this
is mostly a stub model.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-4-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-zynqmp-crf.h | 211 ++++++++++++++++++++++++
 hw/misc/xlnx-zynqmp-crf.c         | 266 ++++++++++++++++++++++++++++++
 hw/misc/meson.build               |   1 +
 3 files changed, 478 insertions(+)
 create mode 100644 include/hw/misc/xlnx-zynqmp-crf.h
 create mode 100644 hw/misc/xlnx-zynqmp-crf.c

diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-zynqmp-crf.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the CRF - Clock Reset FPD.
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+#ifndef HW_MISC_XLNX_ZYNQMP_CRF_H
+#define HW_MISC_XLNX_ZYNQMP_CRF_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+
+#define TYPE_XLNX_ZYNQMP_CRF "xlnx.zynqmp_crf"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPCRF, XLNX_ZYNQMP_CRF)
+
+REG32(ERR_CTRL, 0x0)
+    FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
+REG32(IR_STATUS, 0x4)
+    FIELD(IR_STATUS, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_MASK, 0x8)
+    FIELD(IR_MASK, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_ENABLE, 0xc)
+    FIELD(IR_ENABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(IR_DISABLE, 0x10)
+    FIELD(IR_DISABLE, ADDR_DECODE_ERR, 0, 1)
+REG32(CRF_WPROT, 0x1c)
+    FIELD(CRF_WPROT, ACTIVE, 0, 1)
+REG32(APLL_CTRL, 0x20)
+    FIELD(APLL_CTRL, POST_SRC, 24, 3)
+    FIELD(APLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(APLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(APLL_CTRL, DIV2, 16, 1)
+    FIELD(APLL_CTRL, FBDIV, 8, 7)
+    FIELD(APLL_CTRL, BYPASS, 3, 1)
+    FIELD(APLL_CTRL, RESET, 0, 1)
+REG32(APLL_CFG, 0x24)
+    FIELD(APLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(APLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(APLL_CFG, LFHF, 10, 2)
+    FIELD(APLL_CFG, CP, 5, 4)
+    FIELD(APLL_CFG, RES, 0, 4)
+REG32(APLL_FRAC_CFG, 0x28)
+    FIELD(APLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(APLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(APLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(APLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(APLL_FRAC_CFG, DATA, 0, 16)
+REG32(DPLL_CTRL, 0x2c)
+    FIELD(DPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(DPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(DPLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(DPLL_CTRL, DIV2, 16, 1)
+    FIELD(DPLL_CTRL, FBDIV, 8, 7)
+    FIELD(DPLL_CTRL, BYPASS, 3, 1)
+    FIELD(DPLL_CTRL, RESET, 0, 1)
+REG32(DPLL_CFG, 0x30)
+    FIELD(DPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(DPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(DPLL_CFG, LFHF, 10, 2)
+    FIELD(DPLL_CFG, CP, 5, 4)
+    FIELD(DPLL_CFG, RES, 0, 4)
+REG32(DPLL_FRAC_CFG, 0x34)
+    FIELD(DPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(DPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(DPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(DPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(DPLL_FRAC_CFG, DATA, 0, 16)
+REG32(VPLL_CTRL, 0x38)
+    FIELD(VPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(VPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(VPLL_CTRL, CLKOUTDIV, 17, 1)
+    FIELD(VPLL_CTRL, DIV2, 16, 1)
+    FIELD(VPLL_CTRL, FBDIV, 8, 7)
+    FIELD(VPLL_CTRL, BYPASS, 3, 1)
+    FIELD(VPLL_CTRL, RESET, 0, 1)
+REG32(VPLL_CFG, 0x3c)
+    FIELD(VPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(VPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(VPLL_CFG, LFHF, 10, 2)
+    FIELD(VPLL_CFG, CP, 5, 4)
+    FIELD(VPLL_CFG, RES, 0, 4)
+REG32(VPLL_FRAC_CFG, 0x40)
+    FIELD(VPLL_FRAC_CFG, ENABLED, 31, 1)
+    FIELD(VPLL_FRAC_CFG, SEED, 22, 3)
+    FIELD(VPLL_FRAC_CFG, ALGRTHM, 19, 1)
+    FIELD(VPLL_FRAC_CFG, ORDER, 18, 1)
+    FIELD(VPLL_FRAC_CFG, DATA, 0, 16)
+REG32(PLL_STATUS, 0x44)
+    FIELD(PLL_STATUS, VPLL_STABLE, 5, 1)
+    FIELD(PLL_STATUS, DPLL_STABLE, 4, 1)
+    FIELD(PLL_STATUS, APLL_STABLE, 3, 1)
+    FIELD(PLL_STATUS, VPLL_LOCK, 2, 1)
+    FIELD(PLL_STATUS, DPLL_LOCK, 1, 1)
+    FIELD(PLL_STATUS, APLL_LOCK, 0, 1)
+REG32(APLL_TO_LPD_CTRL, 0x48)
+    FIELD(APLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(DPLL_TO_LPD_CTRL, 0x4c)
+    FIELD(DPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(VPLL_TO_LPD_CTRL, 0x50)
+    FIELD(VPLL_TO_LPD_CTRL, DIVISOR0, 8, 6)
+REG32(ACPU_CTRL, 0x60)
+    FIELD(ACPU_CTRL, CLKACT_HALF, 25, 1)
+    FIELD(ACPU_CTRL, CLKACT_FULL, 24, 1)
+    FIELD(ACPU_CTRL, DIVISOR0, 8, 6)
+    FIELD(ACPU_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TRACE_CTRL, 0x64)
+    FIELD(DBG_TRACE_CTRL, CLKACT, 24, 1)
+    FIELD(DBG_TRACE_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_TRACE_CTRL, SRCSEL, 0, 3)
+REG32(DBG_FPD_CTRL, 0x68)
+    FIELD(DBG_FPD_CTRL, CLKACT, 24, 1)
+    FIELD(DBG_FPD_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_FPD_CTRL, SRCSEL, 0, 3)
+REG32(DP_VIDEO_REF_CTRL, 0x70)
+    FIELD(DP_VIDEO_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_VIDEO_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_VIDEO_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_VIDEO_REF_CTRL, SRCSEL, 0, 3)
+REG32(DP_AUDIO_REF_CTRL, 0x74)
+    FIELD(DP_AUDIO_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_AUDIO_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_AUDIO_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_AUDIO_REF_CTRL, SRCSEL, 0, 3)
+REG32(DP_STC_REF_CTRL, 0x7c)
+    FIELD(DP_STC_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DP_STC_REF_CTRL, DIVISOR1, 16, 6)
+    FIELD(DP_STC_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DP_STC_REF_CTRL, SRCSEL, 0, 3)
+REG32(DDR_CTRL, 0x80)
+    FIELD(DDR_CTRL, CLKACT, 24, 1)
+    FIELD(DDR_CTRL, DIVISOR0, 8, 6)
+    FIELD(DDR_CTRL, SRCSEL, 0, 3)
+REG32(GPU_REF_CTRL, 0x84)
+    FIELD(GPU_REF_CTRL, PP1_CLKACT, 26, 1)
+    FIELD(GPU_REF_CTRL, PP0_CLKACT, 25, 1)
+    FIELD(GPU_REF_CTRL, CLKACT, 24, 1)
+    FIELD(GPU_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(GPU_REF_CTRL, SRCSEL, 0, 3)
+REG32(SATA_REF_CTRL, 0xa0)
+    FIELD(SATA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(SATA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(SATA_REF_CTRL, SRCSEL, 0, 3)
+REG32(PCIE_REF_CTRL, 0xb4)
+    FIELD(PCIE_REF_CTRL, CLKACT, 24, 1)
+    FIELD(PCIE_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(PCIE_REF_CTRL, SRCSEL, 0, 3)
+REG32(GDMA_REF_CTRL, 0xb8)
+    FIELD(GDMA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(GDMA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(GDMA_REF_CTRL, SRCSEL, 0, 3)
+REG32(DPDMA_REF_CTRL, 0xbc)
+    FIELD(DPDMA_REF_CTRL, CLKACT, 24, 1)
+    FIELD(DPDMA_REF_CTRL, DIVISOR0, 8, 6)
+    FIELD(DPDMA_REF_CTRL, SRCSEL, 0, 3)
+REG32(TOPSW_MAIN_CTRL, 0xc0)
+    FIELD(TOPSW_MAIN_CTRL, CLKACT, 24, 1)
+    FIELD(TOPSW_MAIN_CTRL, DIVISOR0, 8, 6)
+    FIELD(TOPSW_MAIN_CTRL, SRCSEL, 0, 3)
+REG32(TOPSW_LSBUS_CTRL, 0xc4)
+    FIELD(TOPSW_LSBUS_CTRL, CLKACT, 24, 1)
+    FIELD(TOPSW_LSBUS_CTRL, DIVISOR0, 8, 6)
+    FIELD(TOPSW_LSBUS_CTRL, SRCSEL, 0, 3)
+REG32(DBG_TSTMP_CTRL, 0xf8)
+    FIELD(DBG_TSTMP_CTRL, DIVISOR0, 8, 6)
+    FIELD(DBG_TSTMP_CTRL, SRCSEL, 0, 3)
+REG32(RST_FPD_TOP, 0x100)
+    FIELD(RST_FPD_TOP, PCIE_CFG_RESET, 19, 1)
+    FIELD(RST_FPD_TOP, PCIE_BRIDGE_RESET, 18, 1)
+    FIELD(RST_FPD_TOP, PCIE_CTRL_RESET, 17, 1)
+    FIELD(RST_FPD_TOP, DP_RESET, 16, 1)
+    FIELD(RST_FPD_TOP, SWDT_RESET, 15, 1)
+    FIELD(RST_FPD_TOP, AFI_FM5_RESET, 12, 1)
+    FIELD(RST_FPD_TOP, AFI_FM4_RESET, 11, 1)
+    FIELD(RST_FPD_TOP, AFI_FM3_RESET, 10, 1)
+    FIELD(RST_FPD_TOP, AFI_FM2_RESET, 9, 1)
+    FIELD(RST_FPD_TOP, AFI_FM1_RESET, 8, 1)
+    FIELD(RST_FPD_TOP, AFI_FM0_RESET, 7, 1)
+    FIELD(RST_FPD_TOP, GDMA_RESET, 6, 1)
+    FIELD(RST_FPD_TOP, GPU_PP1_RESET, 5, 1)
+    FIELD(RST_FPD_TOP, GPU_PP0_RESET, 4, 1)
+    FIELD(RST_FPD_TOP, GPU_RESET, 3, 1)
+    FIELD(RST_FPD_TOP, GT_RESET, 2, 1)
+    FIELD(RST_FPD_TOP, SATA_RESET, 1, 1)
+REG32(RST_FPD_APU, 0x104)
+    FIELD(RST_FPD_APU, ACPU3_PWRON_RESET, 13, 1)
+    FIELD(RST_FPD_APU, ACPU2_PWRON_RESET, 12, 1)
+    FIELD(RST_FPD_APU, ACPU1_PWRON_RESET, 11, 1)
+    FIELD(RST_FPD_APU, ACPU0_PWRON_RESET, 10, 1)
+    FIELD(RST_FPD_APU, APU_L2_RESET, 8, 1)
+    FIELD(RST_FPD_APU, ACPU3_RESET, 3, 1)
+    FIELD(RST_FPD_APU, ACPU2_RESET, 2, 1)
+    FIELD(RST_FPD_APU, ACPU1_RESET, 1, 1)
+    FIELD(RST_FPD_APU, ACPU0_RESET, 0, 1)
+REG32(RST_DDR_SS, 0x108)
+    FIELD(RST_DDR_SS, DDR_RESET, 3, 1)
+    FIELD(RST_DDR_SS, APM_RESET, 2, 1)
+
+#define CRF_R_MAX (R_RST_DDR_SS + 1)
+
+struct XlnxZynqMPCRF {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    qemu_irq irq_ir;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[CRF_R_MAX];
+    RegisterInfo regs_info[CRF_R_MAX];
+};
+
+#endif
diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-zynqmp-crf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the CRF - Clock Reset FPD.
+ *
+ * Copyright (c) 2022 Xilinx Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "migration/vmstate.h"
+#include "hw/irq.h"
+#include "hw/misc/xlnx-zynqmp-crf.h"
+#include "target/arm/arm-powerctl.h"
+
+#ifndef XLNX_ZYNQMP_CRF_ERR_DEBUG
+#define XLNX_ZYNQMP_CRF_ERR_DEBUG 0
+#endif
+
+#define CRF_MAX_CPU    4
+
+static void ir_update_irq(XlnxZynqMPCRF *s)
+{
+    bool pending = s->regs[R_IR_STATUS] & ~s->regs[R_IR_MASK];
+    qemu_set_irq(s->irq_ir, pending);
+}
+
+static void ir_status_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    ir_update_irq(s);
+}
+
+static uint64_t ir_enable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] &= ~val;
+    ir_update_irq(s);
+    return 0;
+}
+
+static uint64_t ir_disable_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IR_MASK] |= val;
+    ir_update_irq(s);
+    return 0;
+}
+
+static uint64_t rst_fpd_apu_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(reg->opaque);
+    uint32_t val = val64;
+    uint32_t val_old = s->regs[R_RST_FPD_APU];
+    unsigned int i;
+
+    for (i = 0; i < CRF_MAX_CPU; i++) {
+        uint32_t mask = (1 << (R_RST_FPD_APU_ACPU0_RESET_SHIFT + i));
+
+        if ((val ^ val_old) & mask) {
+            if (val & mask) {
+                arm_set_cpu_off(i);
+            } else {
+                arm_set_cpu_on_and_reset(i);
+            }
+        }
+    }
+    return val64;
+}
+
+static const RegisterAccessInfo crf_regs_info[] = {
+    {   .name = "ERR_CTRL",  .addr = A_ERR_CTRL,
+    },{ .name = "IR_STATUS",  .addr = A_IR_STATUS,
+        .w1c = 0x1,
+        .post_write = ir_status_postw,
+    },{ .name = "IR_MASK",  .addr = A_IR_MASK,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IR_ENABLE",  .addr = A_IR_ENABLE,
+        .pre_write = ir_enable_prew,
+    },{ .name = "IR_DISABLE",  .addr = A_IR_DISABLE,
+        .pre_write = ir_disable_prew,
+    },{ .name = "CRF_WPROT",  .addr = A_CRF_WPROT,
+    },{ .name = "APLL_CTRL",  .addr = A_APLL_CTRL,
+        .reset = 0x12c09,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "APLL_CFG",  .addr = A_APLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "APLL_FRAC_CFG",  .addr = A_APLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "DPLL_CTRL",  .addr = A_DPLL_CTRL,
+        .reset = 0x2c09,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "DPLL_CFG",  .addr = A_DPLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "DPLL_FRAC_CFG",  .addr = A_DPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "VPLL_CTRL",  .addr = A_VPLL_CTRL,
+        .reset = 0x12809,
+        .rsvd = 0xf88c80f6,
+    },{ .name = "VPLL_CFG",  .addr = A_VPLL_CFG,
+        .rsvd = 0x1801210,
+    },{ .name = "VPLL_FRAC_CFG",  .addr = A_VPLL_FRAC_CFG,
+        .rsvd = 0x7e330000,
+    },{ .name = "PLL_STATUS",  .addr = A_PLL_STATUS,
+        .reset = 0x3f,
+        .rsvd = 0xc0,
+        .ro = 0x3f,
+    },{ .name = "APLL_TO_LPD_CTRL",  .addr = A_APLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "DPLL_TO_LPD_CTRL",  .addr = A_DPLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "VPLL_TO_LPD_CTRL",  .addr = A_VPLL_TO_LPD_CTRL,
+        .reset = 0x400,
+        .rsvd = 0xc0ff,
+    },{ .name = "ACPU_CTRL",  .addr = A_ACPU_CTRL,
+        .reset = 0x3000400,
+        .rsvd = 0xfcffc0f8,
+    },{ .name = "DBG_TRACE_CTRL",  .addr = A_DBG_TRACE_CTRL,
+        .reset = 0x2500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DBG_FPD_CTRL",  .addr = A_DBG_FPD_CTRL,
+        .reset = 0x1002500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DP_VIDEO_REF_CTRL",  .addr = A_DP_VIDEO_REF_CTRL,
+        .reset = 0x1002300,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DP_AUDIO_REF_CTRL",  .addr = A_DP_AUDIO_REF_CTRL,
+        .reset = 0x1032300,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DP_STC_REF_CTRL",  .addr = A_DP_STC_REF_CTRL,
+        .reset = 0x1203200,
+        .rsvd = 0xfec0c0f8,
+    },{ .name = "DDR_CTRL",  .addr = A_DDR_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "GPU_REF_CTRL",  .addr = A_GPU_REF_CTRL,
+        .reset = 0x1500,
+        .rsvd = 0xf8ffc0f8,
+    },{ .name = "SATA_REF_CTRL",  .addr = A_SATA_REF_CTRL,
+        .reset = 0x1001600,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "PCIE_REF_CTRL",  .addr = A_PCIE_REF_CTRL,
+        .reset = 0x1500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "GDMA_REF_CTRL",  .addr = A_GDMA_REF_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DPDMA_REF_CTRL",  .addr = A_DPDMA_REF_CTRL,
+        .reset = 0x1000500,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "TOPSW_MAIN_CTRL",  .addr = A_TOPSW_MAIN_CTRL,
+        .reset = 0x1000400,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "TOPSW_LSBUS_CTRL",  .addr = A_TOPSW_LSBUS_CTRL,
+        .reset = 0x1000800,
+        .rsvd = 0xfeffc0f8,
+    },{ .name = "DBG_TSTMP_CTRL",  .addr = A_DBG_TSTMP_CTRL,
+        .reset = 0xa00,
+        .rsvd = 0xffffc0f8,
+    },
+    {   .name = "RST_FPD_TOP",  .addr = A_RST_FPD_TOP,
+        .reset = 0xf9ffe,
+        .rsvd = 0xf06001,
+    },{ .name = "RST_FPD_APU",  .addr = A_RST_FPD_APU,
+        .reset = 0x3d0f,
+        .rsvd = 0xc2f0,
+        .pre_write = rst_fpd_apu_prew,
+    },{ .name = "RST_DDR_SS",  .addr = A_RST_DDR_SS,
+        .reset = 0xf,
+        .rsvd = 0xf3,
+    }
+};
+
+static void crf_reset_enter(Object *obj, ResetType type)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
+static void crf_reset_hold(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    ir_update_irq(s);
+}
+
+static const MemoryRegionOps crf_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void crf_init(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), crf_regs_info,
+                              ARRAY_SIZE(crf_regs_info),
+                              s->regs_info, s->regs,
+                              &crf_ops,
+                              XLNX_ZYNQMP_CRF_ERR_DEBUG,
+                              CRF_R_MAX * 4);
+    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_irq(sbd, &s->irq_ir);
+}
+
+static void crf_finalize(Object *obj)
+{
+    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_crf = {
+    .name = TYPE_XLNX_ZYNQMP_CRF,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPCRF, CRF_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void crf_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_crf;
+    rc->phases.enter = crf_reset_enter;
+    rc->phases.hold = crf_reset_hold;
+}
+
+static const TypeInfo crf_info = {
+    .name              = TYPE_XLNX_ZYNQMP_CRF,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(XlnxZynqMPCRF),
+    .class_init        = crf_class_init,
+    .instance_init     = crf_init,
+    .instance_finalize = crf_finalize,
+};
+
+static void crf_register_types(void)
+{
+    type_register_static(&crf_info);
+}
+
+type_init(crf_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
+specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Connect the ZynqMP CRF - Clock Reset FPD device.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-5-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  2 ++
 hw/arm/xlnx-zynqmp.c         | 16 ++++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-zynqmp-efuse.h"
 #include "hw/or-irq.h"
+#include "hw/misc/xlnx-zynqmp-crf.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
     XlnxCSUDMA qspi_dma;
     qemu_or_irq qspi_irq_orgate;
+    XlnxZynqMPCRF crf;
 
     char *boot_cpu;
     ARMCPU *boot_cpu_ptr;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define QSPI_DMA_ADDR       0xff0f0800
 #define NUM_QSPI_IRQ_LINES  2
 
+#define CRF_ADDR            0xfd1a0000
+#define CRF_IRQ             120
+
 /* Serializer/Deserializer.  */
 #define SERDES_ADDR         0xfd400000
 #define SERDES_SIZE         0x20000
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
 }
 
+static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+
+    object_initialize_child(OBJECT(s), "crf", &s->crf, TYPE_XLNX_ZYNQMP_CRF);
+    sbd = SYS_BUS_DEVICE(&s->crf);
+
+    sysbus_realize(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, CRF_ADDR);
+    sysbus_connect_irq(sbd, 0, gic[CRF_IRQ]);
+}
+
 static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
 {
     static const struct UnimpInfo {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     xlnx_zynqmp_create_bbram(s, gic_spi);
     xlnx_zynqmp_create_efuse(s, gic_spi);
+    xlnx_zynqmp_create_crf(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GDMA_CH; i++) {
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add a model of the Xilinx ZynqMP APU Control.

Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  93 +++++++++
 hw/misc/xlnx-zynqmp-apu-ctrl.c         | 253 +++++++++++++++++++++++++
 hw/misc/meson.build                    |   1 +
 3 files changed, 347 insertions(+)
 create mode 100644 include/hw/misc/xlnx-zynqmp-apu-ctrl.h
 create mode 100644 hw/misc/xlnx-zynqmp-apu-ctrl.c

diff --git a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of ZynqMP APU Control.
+ *
+ * Copyright (c) 2013-2022 Xilinx Inc
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
+ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ *
+ */
+#ifndef HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
+#define HW_MISC_XLNX_ZYNQMP_APU_CTRL_H
+
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "target/arm/cpu.h"
+
+#define TYPE_XLNX_ZYNQMP_APU_CTRL "xlnx.apu-ctrl"
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPAPUCtrl, XLNX_ZYNQMP_APU_CTRL)
+
+REG32(APU_ERR_CTRL, 0x0)
+    FIELD(APU_ERR_CTRL, PSLVERR, 0, 1)
+REG32(ISR, 0x10)
+    FIELD(ISR, INV_APB, 0, 1)
+REG32(IMR, 0x14)
+    FIELD(IMR, INV_APB, 0, 1)
+REG32(IEN, 0x18)
+    FIELD(IEN, INV_APB, 0, 1)
+REG32(IDS, 0x1c)
+    FIELD(IDS, INV_APB, 0, 1)
+REG32(CONFIG_0, 0x20)
+    FIELD(CONFIG_0, CFGTE, 24, 4)
+    FIELD(CONFIG_0, CFGEND, 16, 4)
+    FIELD(CONFIG_0, VINITHI, 8, 4)
+    FIELD(CONFIG_0, AA64NAA32, 0, 4)
+REG32(CONFIG_1, 0x24)
+    FIELD(CONFIG_1, L2RSTDISABLE, 29, 1)
+    FIELD(CONFIG_1, L1RSTDISABLE, 28, 1)
+    FIELD(CONFIG_1, CP15DISABLE, 0, 4)
+REG32(RVBARADDR0L, 0x40)
+    FIELD(RVBARADDR0L, ADDR, 2, 30)
+REG32(RVBARADDR0H, 0x44)
+    FIELD(RVBARADDR0H, ADDR, 0, 8)
+REG32(RVBARADDR1L, 0x48)
+    FIELD(RVBARADDR1L, ADDR, 2, 30)
+REG32(RVBARADDR1H, 0x4c)
+    FIELD(RVBARADDR1H, ADDR, 0, 8)
+REG32(RVBARADDR2L, 0x50)
+    FIELD(RVBARADDR2L, ADDR, 2, 30)
+REG32(RVBARADDR2H, 0x54)
+    FIELD(RVBARADDR2H, ADDR, 0, 8)
+REG32(RVBARADDR3L, 0x58)
+    FIELD(RVBARADDR3L, ADDR, 2, 30)
+REG32(RVBARADDR3H, 0x5c)
+    FIELD(RVBARADDR3H, ADDR, 0, 8)
+REG32(ACE_CTRL, 0x60)
+    FIELD(ACE_CTRL, AWQOS, 16, 4)
+    FIELD(ACE_CTRL, ARQOS, 0, 4)
+REG32(SNOOP_CTRL, 0x80)
+    FIELD(SNOOP_CTRL, ACE_INACT, 4, 1)
+    FIELD(SNOOP_CTRL, ACP_INACT, 0, 1)
+REG32(PWRCTL, 0x90)
+    FIELD(PWRCTL, CLREXMONREQ, 17, 1)
+    FIELD(PWRCTL, L2FLUSHREQ, 16, 1)
+    FIELD(PWRCTL, CPUPWRDWNREQ, 0, 4)
+REG32(PWRSTAT, 0x94)
+    FIELD(PWRSTAT, CLREXMONACK, 17, 1)
+    FIELD(PWRSTAT, L2FLUSHDONE, 16, 1)
+    FIELD(PWRSTAT, DBGNOPWRDWN, 0, 4)
+
+#define APU_R_MAX ((R_PWRSTAT) + 1)
+
+#define APU_MAX_CPU    4
+
+struct XlnxZynqMPAPUCtrl {
+    SysBusDevice busdev;
+
+    ARMCPU *cpus[APU_MAX_CPU];
+    /* WFIs towards PMU. */
+    qemu_irq wfi_out[4];
+    /* CPU Power status towards INTC Redirect. */
+    qemu_irq cpu_power_status[4];
+    qemu_irq irq_imr;
+
+    uint8_t cpu_pwrdwn_req;
+    uint8_t cpu_in_wfi;
+
+    RegisterInfoArray *reg_array;
+    uint32_t regs[APU_R_MAX];
+    RegisterInfo regs_info[APU_R_MAX];
+};
+
+#endif
diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of the ZynqMP APU Control.
+ *
+ * Copyright (c) 2013-2022 Xilinx Inc
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Written by Peter Crosthwaite <peter.crosthwaite@xilinx.com> and
+ * Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/log.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+#include "hw/register.h"
+
+#include "qemu/bitops.h"
+#include "qapi/qmp/qerror.h"
+
+#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
+
+#ifndef XILINX_ZYNQMP_APU_ERR_DEBUG
+#define XILINX_ZYNQMP_APU_ERR_DEBUG 0
+#endif
+
+static void update_wfi_out(void *opaque)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
+    unsigned int i, wfi_pending;
+
+    wfi_pending = s->cpu_pwrdwn_req & s->cpu_in_wfi;
+    for (i = 0; i < APU_MAX_CPU; i++) {
+        qemu_set_irq(s->wfi_out[i], !!(wfi_pending & (1 << i)));
+    }
+}
+
+static void zynqmp_apu_rvbar_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    int i;
+
+    for (i = 0; i < APU_MAX_CPU; ++i) {
+        uint64_t rvbar = s->regs[R_RVBARADDR0L + 2 * i] +
+                         ((uint64_t)s->regs[R_RVBARADDR0H + 2 * i] << 32);
+        if (s->cpus[i]) {
+            object_property_set_int(OBJECT(s->cpus[i]), "rvbar", rvbar,
+                                    &error_abort);
+        }
+    }
+}
+
+static void zynqmp_apu_pwrctl_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    unsigned int i, new;
+
+    for (i = 0; i < APU_MAX_CPU; i++) {
+        new = val & (1 << i);
+        /* Check if CPU's CPUPWRDNREQ has changed. If yes, update GPIOs. */
+        if (new != (s->cpu_pwrdwn_req & (1 << i))) {
+            qemu_set_irq(s->cpu_power_status[i], !!new);
+        }
+        s->cpu_pwrdwn_req &= ~(1 << i);
+        s->cpu_pwrdwn_req |= new;
+    }
+    update_wfi_out(s);
+}
+
+static void imr_update_irq(XlnxZynqMPAPUCtrl *s)
+{
+    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
+    qemu_set_irq(s->irq_imr, pending);
+}
+
+static void isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    imr_update_irq(s);
+}
+
+static uint64_t ien_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] &= ~val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t ids_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] |= val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static const RegisterAccessInfo zynqmp_apu_regs_info[] = {
+#define RVBAR_REGDEF(n) \
+    {   .name = "RVBAR CPU " #n " Low",  .addr = A_RVBARADDR ## n ## L,    \
+            .reset = 0xffff0000ul,                                         \
+            .post_write = zynqmp_apu_rvbar_post_write,                     \
+    },{ .name = "RVBAR CPU " #n " High", .addr = A_RVBARADDR ## n ## H,    \
+            .post_write = zynqmp_apu_rvbar_post_write,                     \
+    }
+    {   .name = "ERR_CTRL",  .addr = A_APU_ERR_CTRL,
+    },{ .name = "ISR",  .addr = A_ISR,
+        .w1c = 0x1,
+        .post_write = isr_postw,
+    },{ .name = "IMR",  .addr = A_IMR,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IEN",  .addr = A_IEN,
+        .pre_write = ien_prew,
+    },{ .name = "IDS",  .addr = A_IDS,
+        .pre_write = ids_prew,
+    },{ .name = "CONFIG_0",  .addr = A_CONFIG_0,
+        .reset = 0xf0f,
+    },{ .name = "CONFIG_1",  .addr = A_CONFIG_1,
+    },
+    RVBAR_REGDEF(0),
+    RVBAR_REGDEF(1),
+    RVBAR_REGDEF(2),
+    RVBAR_REGDEF(3),
+    { .name = "ACE_CTRL",  .addr = A_ACE_CTRL,
+        .reset = 0xf000f,
+    },{ .name = "SNOOP_CTRL",  .addr = A_SNOOP_CTRL,
+    },{ .name = "PWRCTL",  .addr = A_PWRCTL,
+        .post_write = zynqmp_apu_pwrctl_post_write,
+    },{ .name = "PWRSTAT",  .addr = A_PWRSTAT,
+        .ro = 0x3000f,
+    }
+};
+
+static void zynqmp_apu_reset_enter(Object *obj, ResetType type)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    int i;
+
+    for (i = 0; i < APU_R_MAX; ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    s->cpu_pwrdwn_req = 0;
+    s->cpu_in_wfi = 0;
+}
+
+static void zynqmp_apu_reset_hold(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+
+    update_wfi_out(s);
+    imr_update_irq(s);
+}
+
+static const MemoryRegionOps zynqmp_apu_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    }
+};
+
+static void zynqmp_apu_handle_wfi(void *opaque, int irq, int level)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(opaque);
+
+    s->cpu_in_wfi = deposit32(s->cpu_in_wfi, irq, 1, level);
+    update_wfi_out(s);
+}
+
+static void zynqmp_apu_init(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    int i;
+
+    s->reg_array =
+        register_init_block32(DEVICE(obj), zynqmp_apu_regs_info,
+                              ARRAY_SIZE(zynqmp_apu_regs_info),
+                              s->regs_info, s->regs,
+                              &zynqmp_apu_ops,
+                              XILINX_ZYNQMP_APU_ERR_DEBUG,
+                              APU_R_MAX * 4);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->reg_array->mem);
+    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq_imr);
+
+    for (i = 0; i < APU_MAX_CPU; ++i) {
+        g_autofree gchar *prop_name = g_strdup_printf("cpu%d", i);
+        object_property_add_link(obj, prop_name, TYPE_ARM_CPU,
+                                 (Object **)&s->cpus[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    /* wfi_out is used to connect to PMU GPIs. */
+    qdev_init_gpio_out_named(DEVICE(obj), s->wfi_out, "wfi_out", 4);
+    /* CPU_POWER_STATUS is used to connect to INTC redirect. */
+    qdev_init_gpio_out_named(DEVICE(obj), s->cpu_power_status,
+                             "CPU_POWER_STATUS", 4);
+    /* wfi_in is used as input from CPUs as wfi request. */
+    qdev_init_gpio_in_named(DEVICE(obj), zynqmp_apu_handle_wfi, "wfi_in", 4);
+}
+
+static void zynqmp_apu_finalize(Object *obj)
+{
+    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    register_finalize_block(s->reg_array);
+}
+
+static const VMStateDescription vmstate_zynqmp_apu = {
+    .name = TYPE_XLNX_ZYNQMP_APU_CTRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxZynqMPAPUCtrl, APU_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void zynqmp_apu_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_zynqmp_apu;
+
+    rc->phases.enter = zynqmp_apu_reset_enter;
+    rc->phases.hold = zynqmp_apu_reset_hold;
+}
+
+static const TypeInfo zynqmp_apu_info = {
+    .name              = TYPE_XLNX_ZYNQMP_APU_CTRL,
+    .parent            = TYPE_SYS_BUS_DEVICE,
+    .instance_size     = sizeof(XlnxZynqMPAPUCtrl),
+    .class_init        = zynqmp_apu_class_init,
+    .instance_init     = zynqmp_apu_init,
+    .instance_finalize = zynqmp_apu_finalize,
+};
+
+static void zynqmp_apu_register_types(void)
+{
+    type_register_static(&zynqmp_apu_info);
+}
+
+type_init(zynqmp_apu_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-crf.c'))
+specific_ss.add(when: 'CONFIG_XLNX_ZYNQMP_ARM', if_true: files('xlnx-zynqmp-apu-ctrl.c'))
 softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
   'xlnx-versal-xramc.c',
   'xlnx-versal-pmc-iou-slcr.c',
-- 
2.25.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Connect the ZynqMP APU Control device.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220316164645.2303510-7-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-zynqmp.h |  4 +++-
 hw/arm/xlnx-zynqmp.c         | 25 +++++++++++++++++++++++--
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-zynqmp-efuse.h"
 #include "hw/or-irq.h"
+#include "hw/misc/xlnx-zynqmp-apu-ctrl.h"
 #include "hw/misc/xlnx-zynqmp-crf.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 /*
  * Unimplemented mmio regions needed to boot some images.
  */
-#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 2
+#define XLNX_ZYNQMP_NUM_UNIMP_AREAS 1
 
 struct XlnxZynqMPState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ struct XlnxZynqMPState {
     XlnxZDMA adma[XLNX_ZYNQMP_NUM_ADMA_CH];
     XlnxCSUDMA qspi_dma;
     qemu_or_irq qspi_irq_orgate;
+    XlnxZynqMPAPUCtrl apu_ctrl;
     XlnxZynqMPCRF crf;
 
     char *boot_cpu;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@
 #define DPDMA_IRQ           116
 
 #define APU_ADDR            0xfd5c0000
-#define APU_SIZE            0x100
+#define APU_IRQ             153
 
 #define IPI_ADDR            0xFF300000
 #define IPI_IRQ             64
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_efuse(XlnxZynqMPState *s, qemu_irq *gic)
     sysbus_connect_irq(sbd, 0, gic[EFUSE_IRQ]);
 }
 
+static void xlnx_zynqmp_create_apu_ctrl(XlnxZynqMPState *s, qemu_irq *gic)
+{
+    SysBusDevice *sbd;
+    int i;
+
+    object_initialize_child(OBJECT(s), "apu-ctrl", &s->apu_ctrl,
+                            TYPE_XLNX_ZYNQMP_APU_CTRL);
+    sbd = SYS_BUS_DEVICE(&s->apu_ctrl);
+
+    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+        g_autofree gchar *name = g_strdup_printf("cpu%d", i);
+
+        object_property_set_link(OBJECT(&s->apu_ctrl), name,
+                                 OBJECT(&s->apu_cpu[i]), &error_abort);
+    }
+
+    sysbus_realize(sbd, &error_fatal);
+    sysbus_mmio_map(sbd, 0, APU_ADDR);
+    sysbus_connect_irq(sbd, 0, gic[APU_IRQ]);
+}
+
 static void xlnx_zynqmp_create_crf(XlnxZynqMPState *s, qemu_irq *gic)
 {
     SysBusDevice *sbd;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_unimp_mmio(XlnxZynqMPState *s)
         hwaddr base;
         hwaddr size;
     } unimp_areas[ARRAY_SIZE(s->mr_unimp)] = {
-        { .name = "apu", APU_ADDR, APU_SIZE },
         { .name = "serdes", SERDES_ADDR, SERDES_SIZE },
     };
     unsigned int nr;
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     xlnx_zynqmp_create_bbram(s, gic_spi);
     xlnx_zynqmp_create_efuse(s, gic_spi);
+    xlnx_zynqmp_create_apu_ctrl(s, gic_spi);
     xlnx_zynqmp_create_crf(s, gic_spi);
     xlnx_zynqmp_create_unimp_mmio(s);
 
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

On older Solaris releases (before Solaris 11), we didn't get a
prototype for madvise, and so util/osdep.c provides its own prototype.
Some time between the public Solaris 11.4 release and Solaris 11.4.42
CBE, we started getting an madvise prototype that looks like this:

extern int madvise(void *, size_t, int);

which conflicts with the prototype in util/osdeps.c. Instead of always
declaring this prototype, check if we're missing the madvise()
prototype, and only declare it ourselves if the prototype is missing.
Move the prototype to include/qemu/osdep.h, the normal place to handle
platform-specific header quirks.

The 'missing_madvise_proto' meson check contains an obviously wrong
prototype for madvise. So if that code compiles and links, we must be
missing the actual prototype for madvise.

Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Message-id: 20220316035227.3702-2-adeason@sinenomine.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build          | 23 +++++++++++++++++++++--
 include/qemu/osdep.h |  8 ++++++++
 util/osdep.c         |  3 ---
 3 files changed, 29 insertions(+), 5 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_FDATASYNC', cc.links(gnu_source_prefix + '''
   #error Not supported
   #endif
   }'''))
-config_host_data.set('CONFIG_MADVISE', cc.links(gnu_source_prefix + '''
+
+has_madvise = cc.links(gnu_source_prefix + '''
   #include <sys/types.h>
   #include <sys/mman.h>
   #include <stddef.h>
-  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }'''))
+  int main(void) { return madvise(NULL, 0, MADV_DONTNEED); }''')
+missing_madvise_proto = false
+if has_madvise
+  # Some platforms (illumos and Solaris before Solaris 11) provide madvise()
+  # but forget to prototype it. In this case, has_madvise will be true (the
+  # test program links despite a compile warning). To detect the
+  # missing-prototype case, we try again with a definitely-bogus prototype.
+  # This will only compile if the system headers don't provide the prototype;
+  # otherwise the conflicting prototypes will cause a compiler error.
+  missing_madvise_proto = cc.links(gnu_source_prefix + '''
+    #include <sys/types.h>
+    #include <sys/mman.h>
+    #include <stddef.h>
+    extern int madvise(int);
+    int main(void) { return madvise(0); }''')
+endif
+config_host_data.set('CONFIG_MADVISE', has_madvise)
+config_host_data.set('HAVE_MADVISE_WITHOUT_PROTOTYPE', missing_madvise_proto)
+
 config_host_data.set('CONFIG_MEMFD', cc.links(gnu_source_prefix + '''
   #include <sys/mman.h>
   int main(void) { return memfd_create("foo", MFD_ALLOW_SEALING); }'''))
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -XXX,XX +XXX,XX @@ void qemu_anon_ram_free(void *ptr, size_t size);
 #define SIGIO SIGPOLL
 #endif
 
+#ifdef HAVE_MADVISE_WITHOUT_PROTOTYPE
+/*
+ * See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for discussion
+ * about Solaris missing the madvise() prototype.
+ */
+extern int madvise(char *, size_t, int);
+#endif
+
 #if defined(CONFIG_LINUX)
 #ifndef BUS_MCEERR_AR
 #define BUS_MCEERR_AR 4
diff --git a/util/osdep.c b/util/osdep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -XXX,XX +XXX,XX @@
 
 #ifdef CONFIG_SOLARIS
 #include <sys/statvfs.h>
-/* See MySQL bug #7156 (http://bugs.mysql.com/bug.php?id=7156) for
-   discussion about Solaris header problems */
-extern int madvise(char *, size_t, int);
 #endif
 
 #include "qemu-common.h"
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

On Solaris, 'sun' is #define'd to 1, which causes errors if a variable
is named 'sun'. Slightly change the name of the var for the Slot User
Number so we can build on Solaris.

Reviewed-by: Ani Sinha <ani@anisinha.ca>
Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20220316035227.3702-3-adeason@sinenomine.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
     Aml *bnum = aml_arg(4);
     Aml *func = aml_arg(2);
     Aml *rev = aml_arg(1);
-    Aml *sun = aml_arg(5);
+    Aml *sunum = aml_arg(5);
 
     method = aml_method("PDSM", 6, AML_SERIALIZED);
 
@@ -XXX,XX +XXX,XX @@ Aml *aml_pci_device_dsm(void)
     UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
     ifctx = aml_if(aml_equal(aml_arg(0), UUID));
     {
-        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sun), acpi_index));
+        aml_append(ifctx, aml_store(aml_call2("AIDX", bnum, sunum), acpi_index));
         ifctx1 = aml_if(aml_equal(func, zero));
         {
             uint8_t byte_list[1];
-- 
2.25.1

From: Andrew Deason <adeason@sinenomine.net>

The include for statvfs.h has not been needed since all statvfs calls
were removed in commit 4a1418e07bdc ("Unbreak large mem support by
removing kqemu").

The comment mentioning CONFIG_BSD hasn't made sense since an include
for config-host.h was removed in commit aafd75841001 ("util: Clean up
includes").

Remove this cruft.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrew Deason <adeason@sinenomine.net>
Message-id: 20220316035227.3702-4-adeason@sinenomine.net
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/osdep.c | 7 -------
 1 file changed, 7 deletions(-)

diff --git a/util/osdep.c b/util/osdep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/osdep.c
+++ b/util/osdep.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-
-/* Needed early for CONFIG_BSD etc. */
-
-#ifdef CONFIG_SOLARIS
-#include <sys/statvfs.h>
-#endif
-
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/sockets.h"
-- 
2.25.1